How to best encrypt and decrypt a directory via the command line or script?

Question

I have a directory of text files under bazaar version control and keep a copy (a branch, actually) on each of my machines. I want to encrypt and unencrypt the directory via the command line.

Ideally, I would also be able to have a script run at logout to check if the directory is encrypted and encrypt it if not, all without user intervention. I do not, however, want the dir to be decrypted on login. (I want the script as a guard against forgetting to encrypt manually. This is especially important for the netbook.)

I'm running ubuntu 10.04.1 and two versions of crunchbang linux, one a derivative of ubuntu 9.04, the either of a late June snapshot of the Debian Squeeze repos.

What is the best way to do this?

(I tried to tag with encryption and directories, but lack the rep to create a tag.)

Answer 1

Do you have administrative access to the machines? One could use an encrypted loopback device. Example:

make a container file for the encrypted fs:

dd if=/dev/urandom of=container bs=1024k count=100 

bind container file to loopback device 0:

losetup container /dev/loop0

create encrypted device (-y asks for passphrase twice; line split by \):

cryptsetup -c serpent-xts-essiv:sha256 -b 512 \
   -y create container /dev/loop0 

create ext2 filesystem on encrypted device (can use anything really):

mkfs.ext2 /dev/mapper/container

mounts encrypted filesystem to crypt directory:

mount /dev/mapper/container crypt

For reference:

man cryptsetup && man losetup

Also, read up on cryptography best practises, for information on choosing cipher and key lengths to use, etc.

Answer 2

It looks like what you're after is not a way to encrypt and decrypt directories, but a way to work with encrypted storage transparently. Note that the scheme you propose, with actual mass decryption and encryption, is not very secure: it leaves things unencrypted if you don't log out normally (power failure, system crash, stolen laptop...); and it leaves traces of your confidential data that a determined attacker could find (the data from erased files is still on the disk, just hard to find).

Current Linux systems offer several ways to achieve transparent encryption. You can encrypt a whole volume with dm-crypt or one of its alternatives. There are several tools available to encrypt a specific directory tree, including ecryptfs (which works at the kernel level) and encfs (which works purely in userland via fuse). (The three I mention are available in Debian lenny and should be offered by all of your distributions.)

You can set up the encrypted directories to be mounted when you log in either via PAM (libpam-mount package; recommended option for ecryptfs) or through your profile scripts (recommended option for encfs). Note that there is no problem with “forgetting to encrypt manually” since nothing is ever written unencrypted to the disk.

For best protection, you should encrypt not just your confidential files, but also other places where confidential data may be stored by programs. At least, you should encrypt your swap partition. Other places to watch include /tmp (best solved by making it tmpfs), /var/spool/cups if you print confidential documents, and per-application files in your home directory such web caches/histories (e.g. ~/.mozilla).

Answer 3

How about using gpgdir? This should be scriptable for login and logout. You can also select subdirectories which are supposed to be encrypted (you may want file such as .bash_rc to remain decrypted, for example).

Another alternative may be Truecrypt. You can create a container for your data and encrypt/decrypt it via shell scripts.

Answer 4

You could also use ecryptfs, which is standard on Ubuntu and its derived distributions. That's what is used when the install process asks you if you want to crypt your home directory (http://www.linuxjournal.com/article/9400). The advantage of ecryptfs is that you don't need a separate partition, or a loopback mounted file to use it.