I got a VPS with a user dedicated to store my files. As i am aware of the current situation with the NSA and many other governments, and my VPS is hosted on a doubtful country i would like to ensure my privacy (not that i have any top-secret file, or anything similar).

I am thinking of making the home folder of my user a truecrypt file, which would be mounted after a successful user login. Is it possible?

And can the SSH login also prompt for the password to mount the file after login and before shell access? Something like: "insert user@host password:" and then "insert home folder password:" before shell access. If wrong it would start the working directory somewhere else, like on fs root. Can it be done?

  • 1
    Have you looked at the ecryptfs system Ubuntu uses? They have a PAM module that handles the decryption (so there's only a single password involved). – Bandrami Dec 25 '13 at 4:06
  • But there's two problems: A) Its an Arch vps (yes, i am crazy) B) I don't want the server to know its own password, it should get it from me otherwise the encryption would make no sense in case the ISP wants to spy. – SOMN Dec 25 '13 at 4:18
  • 1
    I'm pretty sure there's an AUR package for it. Also, the server doesn't know the password in this setup; it verifies it with shadow and uses it to decrypt. Alternately, you could have a real home directory with a true crypt file and a .login that asks for a password, decrypts the file, and mounts it over the home directory. But PAM really is the "right" place to do this. – Bandrami Dec 25 '13 at 4:55
  • When i was looking i misspelled the name, and i want to install as few as possible AUR packages in the VPS. It seems that eCryptfs is not Ubuntu specific, it is well supported with mainstream kernel modules. I'll try tomorrow to follow this guide (wiki.archlinux.org/index.php/ECryptfs) but if you or anyone else have/has a better one or want(s) to complete the answer I'll flag is as correct as soon as i get working results.(soon i hope) – SOMN Dec 25 '13 at 7:47

So, since you seem Ok with the idea, for any searchers:

Ecryptfs and its associated PAM facilities do more or less what you want. The filesystem stores an encrypted key which the PAM module locks and unlocks as appropriate. This key is used to read and write files on a fuse filesystem that is mounted on top of the real filesystem over the user's home directory. Anyone else just sees the encrypted key and a bunch of encrypted files with obfuscated names (ie, even if you name your file "super secret stuff", without the user's password somebody else only sees "x18vb45" or something like that).

There's a bit of memory and processor overhead, and someone who can see arbitrary memory locations can get more when the user is logged in, but that's true for an file encryption.

  • I've decided to setup the whole OS again. I'll encrypt the whole root file system with the exception of the kernel and the bootloader, using LUKS. However your answer pointed me in the right direction, and it is still right. Thanks ;) – SOMN Dec 27 '13 at 3:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.