encfs uses FUSE to mount an encrypted directory (a hidden ".directory" by convention) onto another directory specified by the user.
I want to share the encrypted ".directory" via NFS where it will be decrypted on the client (on demand).
When I try doing that the mount command succeeds and no errors are reported (even with "-vvv" parameter). However, the mount on the client is always empty. Why? How do I resolve this?
My plan is that the client will not have to keep the decrypted directory mounted at all times, thus increasing security (I hope).
The other way of sharing it, where it is decrypted on the NFS server means it will have to stay decrypted at all times (afaik).
UPDATE: I want to clarify that I am not mounting the decrypted directory on the NFS server and then trying to share that. I am trying to share the raw encrypted directory.
NFS server (192.168.1.1 fileserver)
/etc/fstab:
/home/.shared /export/home/.shared none bind 0 0
/etc/exports:
/export/home/.shared 192.168.1.10(fsid=2,rw,no_root_squash,sync,no_subtree_check,nohide)
NFS client (192.168.1.10)
I haved tried two approaches:
first try:
fileserver:/export/home/.shared /home/.shared nfs4 noauto,x-systemd.automount,x-systemd.device-timeout=10,timeo=14,rw,relatime,vers=4.0,rsize=1048576,wsize=1048576,namlen=255,intr,timeo=600,retrans=2,sec=sys,clientaddr=192.168.1.10,local_lock=none,addr=192.168.1.1 0 0
I have also tried:
fileserver:/export/home/.shared /home/.shared nfs4 noauto,_netdev,relatime,vers=4.0,rsize=1048576,wsize=1048576,namlen=255,intr 0 0
/export
on a separate filesystem? Out of curiousity, afterfileserver
has started, what happens if you runexportfs -a
and then on the clientmount
the filesystem? I wonder if you're hitting asystemd
race condition between mounting and exporting...encfs
on two of my test VMs and what you're trying to do worked just fine (CentOS 7.2; EPEL) but the small VMs had $HOME/encrypted on the root disk (small VMs; single disk volume). FWIW, the export is/home/sweh/encrypted *(fsid=2,rw,no_root_squash,sync,no_subtree_check,nohide)
and I manually just ransudo mount test1:/home/sweh/encrypted /home/sweh/encrypted
.