4

I am looking for a backup solution and while trying to anonymize and protect my data one of the problems I've found is that the filenames leak a lot of information.

I am looking for a piece of software that can encrypt a directory of files creating one encrypted file per actual file so that each can be downloaded individually without wasting bandwith while also hashing the filename in such a way so that each file can be easily identified and converted to its original form given the encryption key and the hash dictionary

  • What Unix are you wanting to do this on? – Kusalananda May 14 '17 at 16:09
  • @Kusalananda Linux, preferably something that works on all major distros. – fscr May 14 '17 at 16:11
5

You can use the fuse filesystem encfs to do this simply. Install rpm fuse-encfs or apt package encfs and use encfs --reverse to mount an encrypted version of any directory, eg /tmp/mycleardata, at a new point, eg /tmp/crypt-view. Backup this directory in your usual way, and then unmount the fuse filesystem. You also need to backup the .encfs6.xml that will have been added to your original directory, and remember the password you used when encfs asked you for one. When you want to update the backup, do the same commands. This will re-use the .encfs6.xml file and need the same password.

Here's an example script to play with. Obviously, normally you do not provide the password inline, and you do not normally destroy the .encfs6.xml file.

# create some test data directory
mkdir -p /tmp/mycleardata/dira
date > /tmp/mycleardata/dira/filea
date > /tmp/mycleardata/fileb
# mount an encrypted view. encfs asks for a config (blank line) and pw
mkdir -p /tmp/crypt-view
if [ -f /tmp/mycleardata/.encfs6.xml ]
then encfs --stdinpass --reverse /tmp/mycleardata /tmp/crypt-view <<\!
mypassword
!
else encfs --stdinpass --reverse /tmp/mycleardata /tmp/crypt-view <<\!

mypassword
mypassword
!
fi

# show files, do a backup
ls -ltRA /tmp/mycleardata/
ls -ltR /tmp/crypt-view
rsync -a /tmp/crypt-view/ /tmp/mybackup
# remove the crypted view
fusermount -u /tmp/crypt-view
ls -ltR /tmp/mybackup

# restore from backup. use encfs to mount backup and show clear view
mkdir -p /tmp/newclear
ENCFS6_CONFIG=/tmp/mycleardata/.encfs6.xml encfs --stdinpass /tmp/mybackup /tmp/newclear <<\!
mypassword
!
ls -ltR /tmp/newclear # should be same as original dir
fusermount -u /tmp/newclear # remove clear view

Here's an example of the resulting filenames:

/tmp/mybackup:
-rw-r--r-- 1 meuh     30 May 14 17:40 42eg5KinDst09lDzN4YNRAIG
-rw-r--r-- 1 meuh   1264 May 14 17:32 bj5Su3csNAALZEAJEB,CazsC
drwxr-xr-x 2 meuh     60 May 14 17:18 sJzZa,U7Oeyfq2j8tfeLqkm,
/tmp/mybackup/sJzZa,U7Oeyfq2j8tfeLqkm,:
-rw-r--r-- 1 meuh     30 May 14 17:40 q-c1AOYzAcy06HJ8klCZewsD

Note this security message from the encfs package installation:

According to a security audit by Taylor Hornby (Defuse Security), the current implementation of Encfs is vulnerable or potentially vulnerable to multiple types of attacks. For example, an attacker with read/write access to encrypted data might lower the decryption complexity for subsequently encrypted data without this being noticed by a legitimate user, or might use timing analysis to deduce information.

Until these issues are resolved, encfs should not be considered a safe
home for sensitive data in scenarios where such attacks are possible.

You might also look at ecryptfs, which can optionally encrypt filenames, and duplicity which encrypts rsync.

| improve this answer | |
  • There's also eCryptfs, but not as easy to set up as Encfs. I think the "security message" for Encfs is a little overdramatic, all encryption is potentially vulnerable to some attacks, especially if the attacker has read-write access multiple times - if it's a personal device then installing spyware would be a much bigger threat than breaking EncFS. It may not be ideal for online storage though – Xen2050 Jun 9 '17 at 9:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.