Heres the closest I've gotten: I installed gitolite in the /Private folder using ecryptfs-utils (sudo apt-get install ecryptfs-utils adduser git ecryptfs-setup-private then the rest was configuring gitolite using a root install).

It worked just fine as long as someone was logged in as the user git using a password (su git using root does not work). Since the private folder activates through logging in with a password and gitolite uses RSA keys (required) the private folder is hidden thus error occurs.

Is there a way I can log into my server after a reboot, type in the password and have the git user private folder available until next time the machine restarts?

Or maybe theres an easy way to encrypt a folder for git repositories?

  • I'm not sure what you mean. Pushing and pulling over SSH is already encrypted. Do you need encryption beyond that? – jonescb Mar 31 '11 at 17:29
  • Does su - git work? Also, what is the point of encrypting the FS if you want to have it always available if the machine is on? Is it strictly to protect against offline attacks? – Hank Gay Mar 31 '11 at 17:33
  • @jonescb filesystem encryption – user4069 Mar 31 '11 at 17:41
  • @Hank Gay: Yes. offline attacks is all i want to secure with this. It should always be available so reasonably offline+securing the user who access the encrypt files+using good software that access said files is really all i could do. -edit- and su - git didnt solve it unfortunately. – user4069 Mar 31 '11 at 17:46
  • maybe you wanna close the other thread: unix.stackexchange.com/questions/10355/… – D4RIO Mar 31 '11 at 20:32

You simply need to remove the file ~/.ecryptfs/auto-umount.

This file is a flag that pam_ecryptfs checks on logout. This file exists by default at setup, along with ~/.ecryptfs/auto-mount, such that your private directory is automatically mounted and unmounted at login/logout. But each can be removed independently to change that behavior. Enjoy!

| improve this answer | |

You could use a smudge/clean git filter approach; this will encrypt the contents of the repository, and decrypt it for working with in the working tree.

See https://gist.github.com/873637.

It will not encrypt the names of the files, however.

| improve this answer | |

Sorry, can't post as a comment...

Maybe you could mount your ssh through sshfs and use encfs inside?

| improve this answer | |
  • git is pretty automatic. I dont think i can tell git to execute commands over ssh before/after doing its git stuff – user4069 Mar 31 '11 at 17:42
  • I meant mount your remote dir as a local dir with sshfs, then mount an encrypted folder inside that with encfs and then use your git folder inside that. Git doesn't need to know what's going on. – solarc Mar 31 '11 at 17:57

Use screen. just create a screen, su into the user and do what you need to do. Detach from it by using Ctrl+A,d. Then you should be able to disconnect without killing the process thus someone is logged in at all time.

| improve this answer | |

Maybe packing your repo in an GPG encrypted tar. It's possible to delete the private key from your home each time, so your repo will be almost undecryptable. Each time you log-in, you write the private key to your home, decrypt the repo, and use it.

| improve this answer | |

If you can disable the pam_ecryptfs session module, than ecryptfs mount points won't be unmounted on log-out, but this also affects everyone. Another idea is to use a different passphrase from your login to wrap your mount phasephrase. In this case, it will fail to mount it automatically on log-in, and therefore it shouldn't (won't?) unmount on log-out. You can then manually mount ecryptfs and it should stay mounted until next reboot:

ecryptfs-rewrap-passphrase .ecryptfs/wrapped-passphrase
| improve this answer | |

If you're looking for strictly offline protection, then something like an auto-mounted encrypted partition should do the trick. I see you're using apt-get, so there's a fair chance you're on Ubuntu. In that case, it might interest you to know that Ubuntu has encryption as an option during installation. If you're using Debian, here's an article I found that covers How to set up an encrypted filesystem in several easy steps.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy