For my home network I wanted to buy a NAS which supports disk encryption and NFS since it is important for me that the backup is encrypted but also that it preserves owner, groups and permissions (therefore NFS). This way I thought I could use something like rsnapshot or rBackup to backup my data and get multiple snapshots. Unfortunately I didn't find any NAS which supports NFS and encryption at the same time. So I was wondering if there is any possibility to get this using an NAS which without NFS (using for example CIFS instead of NFS). So I am looking for a backup solution which meets the following requirements:

  • backup to a NAS in my local network (i.e. I don't want to use a local usb drive)
  • it should preserve owner, groups and permissions and symbolic links
  • it should be encrypted
  • there should be multiple snapshots available like in rsnapshot or rBackup
  • it should be easy to access the files of a snapshot
  • it should be not too slow

Any ideas how to do this in detail?

Edit: I just try to sum up the answers so far and want to ask some additional question to clarify some points. It seems to be the most flexible option to use a container, FUSE or otherwise "faked" filesystem which doesn't depend on the target device. In this approach I can use any backup script I like and the encryption is done by the client CPU. The possibilities are:

  • EncFS
  • Truecrypt
  • dmcrypt/luks
  • S3QL

I am not sure if it is possible to read and write on the NAS via S3QL from two clients simultanously. Is it correct that this is no problem for the other approaches? Concerning the permissions, in any case I have just to make sure to make it work with NFS. For example I could just make my backup script to preserve numerical uid/gid and setup no users on the NAS at all.

EncFS seems to be the easiest solution so far. In Truecrypt and dmcrypt/luks I have to choose the containersize in advance which seems to be not so flexible as EncFS or Truecrypt. However are there any significant differences between those solutions concerning read/write performance and stability?

Another interesting approach mentioned so far is to use duplicity as a backup script which does the encryption via gpg by itself.

  • What are your specific encryption wishes: Should only the target data be encrypted, or should the transfer to the backup-device (btw: why not a second PC?) be encrypted?
    – Nils
    Commented Aug 26, 2012 at 20:33
  • My question is about encrypting the target. Why not a PC? Because I think an NAS is cheaper, more silent and does consumes less power.
    – student
    Commented Aug 27, 2012 at 6:51
  • What is your OS? Linux?
    – Nils
    Commented Aug 27, 2012 at 21:20
  • Yes its linux...
    – student
    Commented Aug 28, 2012 at 5:38
  • Why don't you just create a huge TrueCrypt container filling the entire NAS, mount it and backup as you would without the encryption?
    – JohnEye
    Commented Aug 29, 2012 at 15:45

4 Answers 4


I would also check S3QL. It provides many interesting functionalities for network backups. It is mainly meant for cloud backup, but you can also use it for the local network, for example, using NFS or SSHFS.

Regarding how to do backups with this software, this is up to you to handle, S3QL is just a remote filesystem with some extra functionalities.

Anyway the S3QL package includes an example script for a way on how to do it. What they basically do is, making use of the data-deduplication capabilities of the software, to backup against a remote directory with the date as the name, then, each time a backup is done, a copy of the previous backup is done and renamed to the current date of the backup, that way only the differences need to be uploaded to the new directory using rsync. You end up with a bunch of directories for all the dates you've run a backup, using only the minimum storage needed as data is not duplicated.

EDIT: (as an answer to the additional questions)

An S3QL filesystem can only be mounted from one client at a time, but well, I think this limitation also applies to EncFS and dmcrypt/luks. Anyway, that wasn't in your requirements right? If it is a new requirement, then you are probably stuck at using NFS or CIFS and some backup software that does the encription on the client for you, like duplicity.

  • Thanks very much. Same question as in the case of duplicity (other answer): suppose I did a backup every week for 8 month using S3QL(backup1,...,backup8). Now I want to recover the version of a file from backup6, how would this work? Could you add some details about this?
    – student
    Commented Aug 28, 2012 at 5:50
  • Well, this is for you to handle, anyway the S3QL package includes an example script for a way on how to do it.
    – adosaiguas
    Commented Aug 28, 2012 at 7:45
  • Added some more details to the answer
    – adosaiguas
    Commented Aug 28, 2012 at 7:57

It's possible to install debian on an NAS box and encrypt the entire hard disk. The problem is that the processors in most NAS boxes (and specifically in the DNS-323 from that article) are very slow and local disk encryption makes them extremely slow and unresponsive.

Another solution would be to host an encrypted truecrypt container on any unencrypted NFS share. Then you can mount it on the client computer and use whatever backup method you prefer inside the encrypted container. That way the server doesn't have to do the encryption calculations.

A third option would be to use duplicity to make encrypted incremental backups to an unencrypted filesystem with permissions and symlinks preserved. It works a lot like rsync but the data is encrypted with PGP. The downside is that it's a little less transparent about how your backups are stored so accessing a previous version of a specific file is sort of nontrivial.

I personally use a D-Link DNS-323 running Debian with unencrypted RAID and do my backups with duplicity. It's not the perfect solution but it's the best I've found short of running a full PC as a backup server. I've had alright experiences with truecrypt but it's difficult to automate that process as easily as duplicity since you have to mount a separate container each time.

  • Thanks very much. Suppose I did a backup every week for 8 month using duplicity (backup1,...,backup8). Now I want to recover the version of a file from backup6, how would this work? Could you add some details about this?
    – student
    Commented Aug 25, 2012 at 7:50
  • Could you also add some details how to mount and unmount the truecrypt container over nfs and how to avoid any problems concerning root permissions... I just googled about truecrypt and nfs and didn't find any good resource about this only much threads about problems that occured when trying to do this... so it would be nice if you could provide more details on this...
    – student
    Commented Aug 25, 2012 at 9:13
  • Sorry, didn't see your responses right away.
    – jmp
    Commented Aug 28, 2012 at 16:30
  • restoring a duplicity backup is easy. Say you backed up a directory with: duplicity /user/Documents scp://uid@host//usr/backup run repeatedly, once a month, you could restore a backed up version with duplicity restore --time ... scp://uid@host//usr/backup restored_dir where ... is replaced by the time from which you would like to restore, as described in the duplicity man page
    – jmp
    Commented Aug 28, 2012 at 16:37
  • Truecrypt containers can be created and mounted through the truecrypt GUI or the command line. It shouldn't matter whether the container is on a remote system or the local host or a series of punch cards, truecrypt should treat it the same no matter what. You just mount the NFS volume as usual (unencrypted) and then save the truecrypt container to it. The container just looks like a big file full of gibberish to anyone else. The nice thing about this method is the container remains a constant size and so even the frequency of your backups and how much you're backing up remains secret.
    – jmp
    Commented Aug 28, 2012 at 16:48

You can use EncFS on top of NFS

encfs /encrypted_place_at_nfs /mnt/place_to_access_it_unencrypted

  • Thanks. Is it correct, that the encryption is done in this case by the client. So this method doesn't require any fast NAS because of the encryption..??
    – student
    Commented Aug 26, 2012 at 9:24
  • that is correct
    – jet
    Commented Aug 26, 2012 at 14:12
  • Are there any (newbie) pitfalls concerning the permissions, owner and groups in this approach?
    – student
    Commented Aug 26, 2012 at 14:45
  • this encryption manipulates files the same way as are regular files / directories- it is not like container. If you have permissions to work with regular files- then should be able to encrypt. You can even see list of the encrypted files, sizes and permissions without decrypt them- they are only as gibberish
    – jet
    Commented Aug 26, 2012 at 14:59

Since you are using Linux you can use dmcrypt/luks.

On Red-Hat-alike systems (including Fedora)

yum install cryptsetup-luks luks-tools

This will give you some luks-commands.

Now you need to create a container on you NAS-device (let us assume it is mounted rw on /mnt):

# Create a sparse file
dd if=/dev/zero of=/mnt/cryptdisk.dat seek=2G bs=1 count=1
# Create a key
dd if=/dev/urandom of=/root/crypt.key bs=1 count=2048
# Assign a device
losetup -a /dev/loop0 /mnt/cryptdisk.dat
# Encrypt device
cryptsetup luksFormat /dev/loop0 /root/crypt.key
# Create mapping to an encrypted device
cryptsetup luksOpen /dev/loop0 cryptdev -d /root/crypt.key

Now you have a /dev/mapper/cryptdev that you can use like a partition (e.g. format it with ext3, mount it, ...)

Use the mounted partition for your purposes...

Further reading: man cryptsetup, man losetup.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .