1

encfs uses FUSE to mount an encrypted directory (a hidden ".directory" by convention) onto another directory specified by the user.

I want to share the encrypted ".directory" via NFS where it will be decrypted on the client (on demand).

When I try doing that the mount command succeeds and no errors are reported (even with "-vvv" parameter). However, the mount on the client is always empty. Why? How do I resolve this?

My plan is that the client will not have to keep the decrypted directory mounted at all times, thus increasing security (I hope).

The other way of sharing it, where it is decrypted on the NFS server means it will have to stay decrypted at all times (afaik).

UPDATE: I want to clarify that I am not mounting the decrypted directory on the NFS server and then trying to share that. I am trying to share the raw encrypted directory.

NFS server (192.168.1.1 fileserver)

/etc/fstab:

/home/.shared /export/home/.shared        none    bind 0 0

/etc/exports:

/export/home/.shared 192.168.1.10(fsid=2,rw,no_root_squash,sync,no_subtree_check,nohide)

NFS client (192.168.1.10)

I haved tried two approaches:
first try:

fileserver:/export/home/.shared /home/.shared  nfs4    noauto,x-systemd.automount,x-systemd.device-timeout=10,timeo=14,rw,relatime,vers=4.0,rsize=1048576,wsize=1048576,namlen=255,intr,timeo=600,retrans=2,sec=sys,clientaddr=192.168.1.10,local_lock=none,addr=192.168.1.1      0 0

I have also tried:

fileserver:/export/home/.shared /home/.shared     nfs4    noauto,_netdev,relatime,vers=4.0,rsize=1048576,wsize=1048576,namlen=255,intr    0 0
  • Thanks for the updated question; I've deleted my wrong answer :-). What you've written looks correct. Is /export on a separate filesystem? Out of curiousity, after fileserver has started, what happens if you run exportfs -a and then on the client mount the filesystem? I wonder if you're hitting a systemd race condition between mounting and exporting... – Stephen Harris Jul 24 '16 at 20:41
  • @StephenHarris-thanks. I will try your suggestion and report back tomorrow. (I can't mess with the fileserver during the day while people are using it.) – MountainX Jul 24 '16 at 20:44
  • Is it common to do what I'm trying to do (NFS share the encrypted encfs directory and then decrypt it on the client)? Or am I trying to do something really unusual? – MountainX Jul 24 '16 at 20:46
  • If you want user encrypted data to be shared between machines then exporting the encrypted data is the right way to go; it's a lot more secure! I just installed encfs on two of my test VMs and what you're trying to do worked just fine (CentOS 7.2; EPEL) but the small VMs had $HOME/encrypted on the root disk (small VMs; single disk volume). FWIW, the export is /home/sweh/encrypted *(fsid=2,rw,no_root_squash,sync,no_subtree_check,nohide) and I manually just ran sudo mount test1:/home/sweh/encrypted /home/sweh/encrypted. – Stephen Harris Jul 24 '16 at 20:51
  • I got a change to test it. I checked all settings on the server and the clients. Then I shut all systems down, booted the server first, then booted the clients. It is working now. My problem must have been something else. Thanks for confirming that I was on the right track. I might have given up otherwise. :-) – MountainX Jul 25 '16 at 0:03
1

The data stored in the encrypted directory just looks like normal files to the filesystem (just with odd names and encrypted data). So exporting the encrypted mountpoint will work as normal.

So, on server test1 we can create a test directory:

$ cd /home/sweh
$ mkdir encrypted decrypted
$ encfs ~/encrypted ~/decrypted
[...]
$ echo hello > decrypted/foo
$ ls encrypted
C-1Ky9g41JBTIYaBJC7EeiiH

Now we can export this. /etc/exports has:

/home/sweh/encrypted *(rw,no_root_squash,sync,no_subtree_check,nohide)

And we run exports -a to export it.

Now on test2 we can mount it:

$ mkdir encrypted decrypted
$ sudo mount test1:/home/sweh/encrypted encrypted
$ ls encrypted
C-1Ky9g41JBTIYaBJC7EeiiH

And we can use this with encfs on the client:

$ encfs /home/sweh/encrypted /home/sweh/decrypted 
EncFS Password: 
$ cat decrypted/foo 
hello

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.