I'm considering switching from Windows Server to Ubuntu Server. One of feature that I can't figure out is - what should I use instead of NTFS Encryption (EFS). So, basically, what I need:
1) This applies only to some specific files in storage, e.g. wallet.dat & bitcoin.conf files of bitcoin core (not the whole 150Gb blockchain repo)
2) The file stays physically encrypted, if this is cloud server and admins took HDD away - there is nothing they can do to decrypt it.
3) File is symmetrically encrypted (so, even large files have excellent performance) but the key is assigned to one or more users using their public keys. E.g. service account and admin account that assigned to perform configuration for that service. No other admin accounts are capable to read internal data of the file (that contains passwords or keys for the service, e.g.), neither they can override or capture the permissions, just because they can't physically decrypt it. Users enlisted for decryption can assign certificates for other users if they have proper permissions for file.
4) encryption is transparent for the software, so, the services is not aware about encryption at all and text editors (for config files) can transparently modify it, as long as they are running under granted user.
5) certificate container is only decrypted for user (or service account) when he logon using his password. If password is reset by admin - user loosing his cryptographic container for good. And certificate are optionally exportable in case if user have to move HDD to other machine.
All of that I can do in Windows (since Windows 2000) using one checkbox (and optional list of assigned certificates). It even creates certificate automatically in case of first time usage and recommends to back it up in notification area.
What do you guys doing in Linux world for this, any advise? I'm not a big fun of separate containers (that probably are accessible to any user logged-in in a system) and mounting points (but may be this is the only way to go), I do believe there are some solution that extends file system.