Slashdot Mirror
Encrypt Filesystems with EncFS and Loop-AES
Linux.com (Slashdot sister site) has a quick look a file encryption using EncFS and Loop-AES as examples before briefly examining other options. From the article: "you can find a number of options for filesystem encryption in Linux exist, depending on your needs. The most important thing when choosing which one to use is to be clear about your needs. Will the size of the files you need to encrypt grow or stay static? Do you need to encrypt certain files or entire partitions? What level of security do you need? Answers to these questions will help determine the most appropriate program to use."
I see....
"Who are in control, they are not in control of anything - they don't even control themselves!" - Glen Beck
How much is the performance hit when using an encrypted filesystem ? How much will filework-heavy tasks impact performance ? I want to know , because I might want to use this on an older system .
I use LUKS (Linux Unified Key Setup) on several of my machines. It is an extension onto cryptsetup and uses dm-cryp instead of loopaes. It is fairly easy to setup and allows for multiple users with different phrases if needed as well as tokens. It has treated me much better than loop aes had in the past.
http://luks.endorphin.org/
Don't forget this new competitor: eCryptfs, mostly written and supported by IBM, and fully GPL:
http://ecryptfs.sf.net/
It's all in the kernel, which means that shares memory mapping work (unlike userspace filesystems), and it keeps metadata on a per-file basis, which is *really* nice for things like incremental backup utilities.
An unjust law is no law at all. - St. Augustine
I threw together the following quick script to allow you to mount and unmount the EncFS encrypted filesystem easily:
I think that pretty much summarizes the state of encryption on Linux. Yes, it can be done if you hack around with it, and has been so for a long time. Let me know when LUKS (Linux Unified Key Setup)/dm-crypt or any other of these tools can actually make a simple out-of-the-box GUI which is usable. To dick around on the command line and writing scripts to do that went out of fashion about the same time you stopped doing it for normal disks.
Live today, because you never know what tomorrow brings
Encfs is great, if you are x86. I made the mistake of unmasking it on gentoo amd64 and it flipped out and I ended up sorting through 300+ files in my l+f directory from my corrupted partition. But for x86 it is very convenient, I highly recommend.
I had a parition (approx 80 GB of data) encrypted via loop-AES in kernel 2.4. After the upgrade to kernel 2.6, I found I was unable to mount the partition correctly, unless I specified a depricated option when building the crypto loop tools.
After doing so, I mounted the parition and everything proceeded normally...
That is until a few months later when I upgraded my system again. Suddenly my parition was unreadable, and the previous option did not work in cryptoloop anymore. I posted for weeks on boards and IRC channels trying to decrypt this data, but no one could help me.
So in the end I gave up on it.
After that nightmare I am never using kernel-level decryptuon again. The fact that the routines lie in the kernel, but the utilities in userspace, makes for a maitence nightmare when you end up upgrading one but the other. From now on all my encryption options will be userspace *only*.
What is so important that you Linux hippies feel the need to encrypt?
I may be a Linux user, but if anyone thinks I'm a "hippie" then they really need to re-define the term.
Do you have something to hide?
Maybe, maybe not. Either way, it's none of your business or anybody else's.
It's kiddy porn, isn't it? Be honest!
<sarcasm>You know, if kiddie porn is such a problem on the internet, how come I can never find any?</sarcasm>
I for one am glad that Microsoft doesn't help out the terrorists and pedophiles in their illegal activity.
So am I. We don't want their kind of "help."
Their encrypting filesystem includes numerous backdoors to assist law enforcement.
Case in point.
I just wish the OSS community would do the same.
Simple enough. Write your own. Make it as terrible as you want. Post the source on Sourceforge. Then the "OSS community" will have done the same. It won't be very popular, but it'll be there.
In all seriousness, it's not about hiding criminal activity. Honestly, the current state of US politics (that is, after all, where I live) kind of scares me. I may not be engaging in illegal activity now, but how many of my current activities will be considered illegal in the future? The last thing I need is for some "law enforcement" entity to go grepping my emails and IM logs looking for something to pin on me.
I have nothing to hide. I also have nothing to share. Nothing to see here, please move along.
http://publicvoidlife.blogspot.com
MacOS includes this functionality, in what sounds like a very similar manner. It can create a disk file, which is AES encrypted, and you can mount like any other disk. They also have the option of encrypting your whole home directory, but I've heard of people having problems with that..
Which, if any, encrypted Linux filesystems are compatible with MacOS's filevault?
What is so important that you Linux hippies feel the need to encrypt? Do you have something to hide? It's kiddy porn, isn't it? Be honest! I for one am glad that Microsoft doesn't help out the terrorists and pedophiles in their illegal activity. Their encrypting filesystem includes numerous backdoors to assist law enforcement. I just wish the OSS community would do the same.
Mr President, is that you? What are you doing on the internet?
What I would like to see is an encrypted filesystem that does not require pre-allocating a certain amount of space whether it is used or not. The major problem with loopback filesystems for encryption is that the file must be the maximum size you intend to use, even if you are only only using a small fraction of the maximum size at the time. I would be willing to use an encrypted filesystem if it worked more like Vmware's disk images, which grow and shrink as data is added and deleted.
Not to mention some thief* rifling through my financial info.
*) could be a thief with a warrant. Or who doesn't need one under some future law. Presence of a warrant does not insure that the individual law enforcement officer is honest.
Why bother waiting so long:
1. boot into the old kernel/backout the upgrade.
2. Mount encrypted filesystem and copy data elsewhere
3. Create encrypted filesystem such that you don't get deprecated warnings.
4. Copy the data back.
I really can't understand continuing with something marked deprecated anyway - certainly not doing an upgrade while doing so. What do you think deprecated means? I'd be doing steps 2-4 as soon as the deprecated option was needed.
In stead of giving up on it, why didn't you just downgrade, decrypt, and upgrade again?
See the problem there?
Get your own free personal location tracker
Only because you snipped out his first step, which was to boot with the old kernel. I presume that something prevented you from doing so.
Mind the Gap
Don't use a relatively "proprietary" crypto then. By proprietary, I mean "highly dependent on the running kernel and system". Linux kernel encryption is tough as it's changing regularly. I've avoided it.
Instead I use Truecrypt which gives kernel level encryption but is far more platform independent, and hence by extension needs to be more stable.
Works via a kernel module, but also the same encrypted "partition" (actually a file or partition) can be read and written to in Linux or Windows. Excellent for dual-booting systems.
And because it's a module independent of the main kernel tree, you're not likely to get caught out when Linus changes the crypto that gets included in the kernel.
Sparks:Gadget:Beer Maker
No.
Backing out the upgrade shouldn't be difficult. At the very worst you install whatever version it was on a UCB pen drive and boot from it... (or CD-R or HDD or whatever you have available). The old rescue disk might even be good enough...
But as I said deprecated means what it says, doing an upgrade when you are relying on something marked deprecated is pretty foolish - unless you checked the release notes to make sure they say it hasn't been removed of course.
Mr President, is that you? What are you doing on the internet?
Ummm, you misspelled interweb.
It's easy to say this when it isn't you with the problem.
You will just have to trust me when I say that I tried every single method at my disposal, every combination I could figure out of kernel / cryptoloop, to try to decrypt this data. I even tried reverse-enginerring the source to the decryption modules myself to try to get some kind of a command-line thing going.
All I can figure is I was using some weird odd combination of cryptoloop and kernel thay should not have worked, but did. Then I lost it all.
As for "I really can't understand continuing with something marked deprecated anyway " - again that's easy to say, but hard to avoid in practice, when you have nowhere to copy the data to in order to change the parition, and no time to do it in.
I pity someone else who I found on a forum who was in my exact same situation, and had a 600 GB RAID array they could not access
Needless to say, I an *NEVER EVER* using linux kernel encryption again. If I do this again, I will use TrueCrypt or some other third-party level encryption which can be decrypted from the commandline if need be, so I can burn the needed utilities to a backup CD.
I am just checking out my new rig that Bill gave me. Apparently it is called Windows 95. Sweet!
I've been looking at Truecrypt...but, I'm under the impression that you can NOT create partitions with it under linux...only can create under windows...
Is this true?
Light travels faster than sound. This is why some people appear bright until you hear them speak.........
If you have no where to copy the data then clearly you also have no backups in which case the data clearly isn't worth a lot to you anyway. When a disk I ordered the other day finally arrives I have the fun task of moving a bunch of data around in order to turn the drives into RAID-5 - I don't have enough disk elsewhere for all the meantime and the disk it's currently on is to be part of the RAID... So all the stuff I don't use/care about too much is just going to stay on the 40 or so DVDs it's also on while the stuff I use gets transferred to a smaller drive and copied back after the conversion. I'd add encryption to the RAID volume, but I don't think the tiny little device running it with it's 32MB of RAM and underpowered CPU would like it :)
Yes restoring backups is a PITA, but less time than hoping for forum answers to questions of the form "I used this deprecated format and upgraded my system and the deprecated format was removed and now I can't access the data, how do I get it back?"...
I'd be annoyed too if I did such a thing to myself, but seriously doing an upgrade when your actively using something marked deprecated just isn't something you do. At least not without making the procedure roll backable (by copying / somewhere else and keeping the old kernel around so you can boot them together, for example). Staying away from kernel/user space combinations is perfectly reasonable, but so is just making sure you don't stay with deprecated features through an upgrade.
Also I see no reason why you couldn't make a bootable CD with the right kernel and user space to get at the data if such an upgrade disaster occurs.
I'll bite.
My work requires me to have data which my clients consider confidential. I encrypt this in case my laptop is stolen.
If you have no where to copy the data then clearly you also have no backups in which case the data clearly isn't worth a lot to you anyway
Ever think that maybe I don't have a secure location to keep these backups?If you're backing up encrypted data in an unencrypted form, you'd better be moving it off site to some very secure location. In my case I can't really justify any kind of budget for this @ my house.
If you're talking about backing up the *encrypted* data, then it's all moot since it would not have helped me anyway.
The /home partition is rsync'ed nightly to my fileserver at home so if I do lose the data, I've lost less than 24 hours of it.
Alas, this is true. You also have to rebuild it every time you upgrade the kernel. I believe the truecrypt developers are planning on including a way to create partitions/containers in a future version (also a gui front-end).
From that link: "We still need some UI for setting up volumes..."
Which sounds to me like: if you've already gone to the effort to figure out how to set it up by hand, we'll make it less painful for you to use it, but if you're not a filesystem-encryption geek and just want to click a button to encrypt all your files, you're still SOL.
And that's basically what the GP was complaining about. I'm with him: wake me when I can click one button and be done.
- Revert upgrade of kernel
- Copy encrypted data to backup, unecrypting as you go (i.e. back it up unencrypted)
- Upgrade kernel
- Trash old encrypted partition and replace with whatever you want to use now
- Restore backup, encrypting as you go
- Back it up again, this time encrypted
For that matter, why could you not have just downgraded the kernel and stayed on the old version?<sarcasm>You know, if kiddie porn is such a problem on the internet, how come I can never find any?</sarcasm>
<sarcasm>That's the problem!</sarcasm>
Well you could use a different encryption system for backups. In fact you're likely to unless you have some fancy filesystem which lets you track changes or if you are doing non-incremental backups all the time. Personally I use duplicity for encrypted backups (and would do so from an encrypted file system too - you really want to be able to diff the unencrypted data and then encrypt the backups seperately).
You were fristy pornster and still got a REDUNDANT. Ownage in its finest measures. Now I'm off to masturbate to this coolness.
If "using encryption suggests criminality", what does posting anonymously suggest ?
Oh, I can't help quoting you because everything that you said rings true
Encryption on servers makes sense when they can be physically accesses or seized. :-)
In my opinion, the number of servers physically seized is too low to bother about FS encryption. Infact when in use in a network server, all those files get somehow unencrypted to be sent over the network.
And, AFAIK, almost all the intrusions, data thefts and the likes happen without accessing the actual file blocks on the disks.
So, where are the FS encyption technologies supposed to be expoited?
I see one area: mobile computing and communication. That is laptops, palms, smartphones, portable media like USB keys etc.
Here the encryption is very important for the sake of privacy as all those piece of hardware are very often subject to be stolen or lost. And here the effectiveness and the efficiency of the encryption technology is very important because of the reduced computing resources involved.
But maybe I'm wrong!
Maybe Computers will never be as intelligent as Humans.
For sure they won't ever become so stupid. [VR-1988]
The problem is to have one solution that Works For Me(TM), and Is Fast and Stable...
Only LoopAES is in mainstream kernel right now and most people don't like partition meddling at all.
I dream about one-click in a Konqueror menu "Encrypt this folder".
l33t hax0r sk1llz 0bvi0usly!! OMFG n00b, duh.
What is so important that you Linux hippies feel the need to encrypt? Do you have something to hide?
Yes I do have something to hide.
For starters to prevent banking identity theft, I use various passwords instead of a publicly searchable mother's maiden name.
First thing to hide is the list of all my CC's, expiration dates, phone numbers to call in case of theft, and the password used for each instead of mother's maiden name.
Second is past years Turbo Tax tax returns. Those are a gold mine for identity thieves including SSN DOB Dependants Property address etc. You bet that goes into encrypted storage.
3rd is Website log-ins. I visit Slashdot often enough to remember my password. The same is not true for my UBS account.
4th is a central repository of registered software including ID number and keys.
5th is a property inventory list including make model serial number date of purchase etc. You many not be interested in my laptop serial number, but I don't need anyone with an axe to grind listing it with the local police as stolen. Can you prove you own your laptop if someone else lists it as stolen? If it is stolen, can you provide a list including model, serial number for both police and insurance?
This is not a complete list.
Just what do you have on your computer that you don't mind me looking into?
I'm sure there is something you'd rather not have public.
The truth shall set you free!
Nope. Imagine a voting machine. Would you like to have someone to know the votes casted in that machine cause someone stole or messed or just had access to the machine? I would not like it, for sure.
Or would you love to have a ATM easily hackable to someone put a keylogger/trojan there so he can have all your banking passwords along with complete card data enough for an atacker rebuild a fake card with everything working perfectly (and your bank account going down real fast)?
I could continue on that for an enormous amount of time but I would really love that your comment would be just a joke. If USA was not so important (in military terms) and without crazy enough people in command to really think they are the blessed ones that need to conquer the world to impose their (lack of) vision, I would say that the rest of the world just encrypted anything with an algorithm that USA would not be allowed to use and we would really see if encryption was not usefull. But half the USA citizens blindly believe on these lies and the other half doesn't care even to know about it and I don't know which is worse.
I don't want a government saying what I can do with MY files. They are mine. It's not government business if I'm storing all the emails I wrote to some women I may be seeing in parallel of my wedding (just joking, hope wife does not believe in it, it's a joke), it's not their business also if someone store the medical receipts of their anti-AIDS cocktail in an easily searchable file for reference, it's not their business to access any private file we have. Sure, crime can be registered in these files and we would never have access to it and ease a prosecution but crime is just a very SMALL percentage of the activities that happens in the world, not the norm. The exception cannot govern the norm, it's basic as that.
Man, that kind of comment about hoping government access people files is creeping, too much orwellian for my taste.
That way your backups are mostly secure even if your physical security is second rate or gets beaten, but you still get the security and convenience of an encrypted file system.
B) Eliminate all the stupid users. This is frowned upon by society.