Your two options are Ecryptfs and EncFS. Both present a FUSE interface, so the data is stored in files on your ext4 filesystem and is accessed through a mount point.
Both have the same security goals: they encrypt file contents and file names but leave directory structure and metadata (e.g. sizes, modification times) visible.
With either of these, you first create the filesystem, which starts out empty. Then you move data into it, which encrypts the data. The disk usage remains roughly the same throughout the move since the cleartext data is erased as the encrypted data is created.
Once you've moved your data, completely fill the cleartext filesystem with a file: cat /dev/zero >zero; rm zero
. This will wipe the former content of the erased files. There will still be traces of names and metadata of erased files in directory entries here and there; the only realistic way to get rid of them would be to erase the whole partition.
Ecryptfs is what you get when you select home directory encryption under Ubuntu; you can set it up after installation through the GUI. The Arch Wiki has detailed command line instructions. Ecryptfs comes with tools that automate putting encrypted data in ~/.Private
and mounting it on ~/Private
: just run ecryptfs-setup-private
. In the default Ubuntu setup, your login password becomes the passphrase for your Ecryptfs key file; this may not be desirable if you prefer a short login/screen-unlock password and a long decryption passphrase.
Between Ecryptfs and EncFS, I recommend Ecryptfs because its design looks a lot cleaner, and it has better performance because it hooks into the kernel. The only reason I would choose EncFS is if I'm on a machine whose kernel doesn't support Ecryptfs: it can't be installed without root access, whereas EncFS only requires the permission to use FUSE.