Tag Info

Hot answers tagged

14

Full disclosure: I am one of the authors and the current maintainer of the eCryptfs userspace utilities. Great question! Linux has a maximum filename length of 255 characters for most filesystems (including EXT4), and a maximum path of 4096 characters. eCryptfs is a layered filesystem. It stacks on top of another filesystem such as EXT4, which is ...


6

Situation: you have an encrypted home directory. Step 1: you log in over SSH. Your encrypted data is not mounted, so what you see is your “real” home directory on the (unencrypted) main filesystem. This home directory doesn't contain much that's directly usable: ~/.ecryptfs/ contains control data for your encrypted data ~/.Private/ contains your encrypted ...


5

As of ecryptfs-utils version 96, ecryptfs-find is the best way to go from an encrypted path to a non-encrypted path. It meets the needs of most users that need to map between filenames, but there are some things to note about the tool: It doesn't decrypt filenames. It maps the filenames based on the inode number corresponding to a file. You must have a ...


5

Deep down, mounting is performed by root anyway: only root can call the mount system call. Programs such as mount, pmount and fusermount are setuid root and restrict what non-root callers are allowed to mount. If you're mounting a filesystem that doesn't implement file ownership (e.g. FAT), the user calling mount will end up owning the files (unless ...


4

This is a bug but it isn't related to the one that Aaron linked to. I'm unable to reproduce it at the moment, so can you please file a new bug here: https://bugs.launchpad.net/ecryptfs/+filebug You can copy and paste from the description above, but I also need to know more about the Linux distribution and kernel version that you're using. Thanks!


4

As for the tutorial, search engines seem to work, e.g. this one on howtoforge.com seems to give reasonable hints. Generally you might want to reconsider what exactly you are trying to achieve in the end. While eCryptfs will (to some degree) guarantee confidentiality you should be aware of several things: to hide the contents of home directory from other ...


4

Mounting does not change your current working directory. I guess that the mountpoint is the directory you are in. You either have to do the mount from elsewhere or to get out of that directory: ls -al ecryptfs-mount-private ls -al cd .. cd - ls -al or cd .. ecryptfs-mount-private cd - ls -al All symlinks have lrwxrwxrwx. This doesn't matter as the ...


4

Don't encrypt the whole hard drive (as in /dev/sda, do it per partition (or more precisely per file system - see below). Have separate file systems mounted at homes for the two users. I'm intentionally avoiding writing separate partitions, since while that is the usual way of doing things, it is constraining in some aspects. It might be more convenient to ...


4

This thread is very interesting because I was wondering the exact same thing. I can live with having to rename 20 files out of 50 000 if the filenames need to be 140 characters or less, but 45 or less isn't feasible (in my situation) because it would require me to rename too many files. I asked the exact same question directly to Synology (even pointing ...


3

Not possible. Someone, or something has to supply the password for decryption. Obviously it can't be on your home directory (as that is encrypted). It should not be on your hard disk at all, as that would be pointless: An attacker could extract it from there. So I don't see a way to make this automated (i.e, not requiring you) while preserving that only ...


3

Ecryptfs stores each encrypted file in one file (the lower file, in ecryptfs terminology). The directory structure of the lower files mirrors that of the payload files, although the file names are encrypted. The metadata (modification times, in particular) of the lower files also reveals that of the payload files. The size of the lower file is slightly ...


3

Yes, this is definitely doable! You'll just want to run rsync from a remote machine. To back up my encrypted data, I use an hourly cronjob, like this: 00 * * * * rsync -aP username@remotehost:/home/.ecryptfs/username /path/to/local/backup Note that this directory, /home/.ecryptfs/username, has two subdirectories: /home/.ecryptfs/username/.ecryptfs ...


3

In the ssh_config file, you can can change the location of where it looks for your private key. You could probably do something like make a new folder at /etc/ssh/keys/ and put your id_rsa private key file in there and then change the IdentityFile option in ssh_config to look in the new location. In doing so you'll want to take certain measures to secure ...


3

If your home directory is encrypted, the ssh daemon can't get in it to check if your private key matches your public one. Your .ssh folder is encrypted after all. A workaround for this might be to have your .ssh folder with your authorized_keys in plaintext in your unencrypted home directory. But if your encryption techinque uses your password as a key to ...


2

First of all, it's extremely doubtful that you'll see a noticeable performance improvement using xattrs for eCryptfs metadata. As for specifying particular mount options, you can sort of do this using the "ALIAS" feature, which I've documented in the mount.ecryptfs_private manpage. Here, you can add some fstab-style mount options, which can work for other ...


2

It is absolutely essential that you record your randomly generated mount passphrase, without which it's impossible to recover your data. I can't stress that more strongly :-) You should write this down, or print it out and store it somewhere safe. Alternatively, you might consider using the zEscrow service from Gazzang. In Ubuntu (or Mint) 12.04 or ...


2

Solution is to use luks/dm-crypt and then modify /etc/crypttab file to do what I need.


2

I can think of two valuable ways to achieve such a system w/o encrypting you home twice. separate home partition: create a separate partition that gets mounted to /home. Each user then encrypts its home via encfs. separate home partition for each user: every user gets a separate partition for his home which is itself encrypted using dm-crypt. This ...


1

If you didn't have an initramfs, you could do it with kernel parameters. Just add a random string as kernel parameter and then use /proc/cmdline as the key for your encryption. If it's not easy to add such parameters to your boot loader, the Linux kernel has a CMDLINE config option that lets you compile it in. (Note: it is possible for kernel parameters to ...


1

Hidden files are files with a name starting with a period, they are not displayed unless explicitely requested, by using the -a option or specifically mentioning dot in the argument list. eg `ls -la or ls -l .* file aliases are called links, they can be hard or symbolic. you have symbolic links there (the first character of permissions is an l denoting ...


1

Encryption is a red herring here. It only protects against a very small set of threats. The administrator of the cluster can read all your files as soon as you enter the key to decrypt them. Encryption would only protect you against the administrator if you never decrypted the files on the cluster, in which case you could use some offline form of encrypted ...


1

What do I need to backup apart from the obvious data there and my password. I don't know exactly how ecryptfs works, but I'd say that should be it, yes. There is an easy way to find out though: just copy your backup to another computer and try to mount it. If everything works as expected, then you're fine. If you're missing something, you'll notice it ...


1

It seems that OpenVZ is the problem (again). OpenVZ uses the parent kernel and I can't do anything with that.


1

How can I debug this? Try to strace the command. That should show the syscalls the program is making, which could help you narrow it down.


1

I think the behaviour you see is just because the Vim backup process is slow. On my plain Ext4 system, this problem manifests as a "file is empty" error from the compiler. To check the timings, I used this Bash sequence: strace -tt -o /dev/stdout gvim --nofork main.cxx | grep 'main.cxx\|close' With backups turned on, I see a 200 ms gap between the file ...


1

It's probably a bug / by-design defect in ecryptfs. See this launchpad bug report. In a nutshell, ecryptfs simply doesn't write the file to disk immediately. My guess this is because of the encryption overhead (the filesystem probably encrypts the data in a background thread and writes it only after that has completed). The bug is from 2009 and the ...


1

You could create an encrypted partition on the RAID, and give each user a directory there (just like /home/user with respect to user/group ownership), and symlink the offending directories in there. I don't know offhand if such a setup will work with all users of those directories, or if there is a way to make the user's Downloads just really be at ...


1

The encrypted home utilities don't support the ability to enable encrypted filenames after you've set up your encrypted home directory. But, I looked at the ecryptfs-migrate-home script and believe that it should be enabling filename encryption by default. Let's verify that filename encryption is enabled. Do you have two lines in your key signature file? $ ...


1

Like people said in the comments, if you don't recall your old password or ecryptfs passphrase, there's nothing which can be done. So I made a "dictionary attack", helped by the fact that I remembered a fair big part of the old password, and could log in again and update the ecryptfs password so that it uses the new one. The moral of the story: the password ...



Only top voted, non community-wiki answers of a minimum length are eligible