13

Heres the closest I've gotten: I installed gitolite in the /Private folder using ecryptfs-utils (sudo apt-get install ecryptfs-utils adduser git ecryptfs-setup-private then the rest was configuring gitolite using a root install).

It worked just fine as long as someone was logged in as the user git using a password (su git using root does not work). Since the private folder activates through logging in with a password and gitolite uses RSA keys (required) the private folder is hidden thus error occurs.

Is there a way I can log into my server after a reboot, type in the password and have the git user private folder available until next time the machine restarts?

Or maybe theres an easy way to encrypt a folder for git repositories?

6
  • I'm not sure what you mean. Pushing and pulling over SSH is already encrypted. Do you need encryption beyond that?
    – jonescb
    Mar 31, 2011 at 17:29
  • Does su - git work? Also, what is the point of encrypting the FS if you want to have it always available if the machine is on? Is it strictly to protect against offline attacks?
    – Hank Gay
    Mar 31, 2011 at 17:33
  • @jonescb filesystem encryption
    – user4069
    Mar 31, 2011 at 17:41
  • @Hank Gay: Yes. offline attacks is all i want to secure with this. It should always be available so reasonably offline+securing the user who access the encrypt files+using good software that access said files is really all i could do. -edit- and su - git didnt solve it unfortunately.
    – user4069
    Mar 31, 2011 at 17:46
  • maybe you wanna close the other thread: unix.stackexchange.com/questions/10355/…
    – D4RIO
    Mar 31, 2011 at 20:32

6 Answers 6

5

You simply need to remove the file ~/.ecryptfs/auto-umount.

This file is a flag that pam_ecryptfs checks on logout. This file exists by default at setup, along with ~/.ecryptfs/auto-mount, such that your private directory is automatically mounted and unmounted at login/logout. But each can be removed independently to change that behavior. Enjoy!

2

Sorry, can't post as a comment...

Maybe you could mount your ssh through sshfs and use encfs inside?

2
  • git is pretty automatic. I dont think i can tell git to execute commands over ssh before/after doing its git stuff
    – user4069
    Mar 31, 2011 at 17:42
  • I meant mount your remote dir as a local dir with sshfs, then mount an encrypted folder inside that with encfs and then use your git folder inside that. Git doesn't need to know what's going on.
    – solarc
    Mar 31, 2011 at 17:57
1

Use screen. just create a screen, su into the user and do what you need to do. Detach from it by using Ctrl+A,d. Then you should be able to disconnect without killing the process thus someone is logged in at all time.

0

Maybe packing your repo in an GPG encrypted tar. It's possible to delete the private key from your home each time, so your repo will be almost undecryptable. Each time you log-in, you write the private key to your home, decrypt the repo, and use it.

0

If you can disable the pam_ecryptfs session module, than ecryptfs mount points won't be unmounted on log-out, but this also affects everyone. Another idea is to use a different passphrase from your login to wrap your mount phasephrase. In this case, it will fail to mount it automatically on log-in, and therefore it shouldn't (won't?) unmount on log-out. You can then manually mount ecryptfs and it should stay mounted until next reboot:

ecryptfs-umount-private
ecryptfs-rewrap-passphrase .ecryptfs/wrapped-passphrase
ecryptfs-mount-private
0

If you're looking for strictly offline protection, then something like an auto-mounted encrypted partition should do the trick. I see you're using apt-get, so there's a fair chance you're on Ubuntu. In that case, it might interest you to know that Ubuntu has encryption as an option during installation. If you're using Debian, here's an article I found that covers How to set up an encrypted filesystem in several easy steps.

You must log in to answer this question.