Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

What is the easiest way to encrypt a directory on a Ubuntu based system?

Let's say I have a laptop that is running Ubuntu 10.04, and on that I have some documents that should be kept safe (if I lose the laptop).

Let's say all to documents is in a dir called ~/work/, and nothing secret is outside this dir. So no need to encrypt the entire home dir.

There shall be a way to lock/unlock this dir from the command line.

There seem to be some different ways of doing this:

  • ecryptfs-utils
  • cryptsetup
  • truecrypt (however not OSI approved open source)

But what is the easiest and most reliable method?

Thanks Johan


Update: Related question, but not the same What's the easiest way to encrypt all of my files in ubuntu 10.04?

share|improve this question
2  
Who cares if Truecrypt isn't OSI approved? OSI approved does not equal better software. Truecrypt is the best around and has even thwarted the FBI in several cases. –  TheLQ Aug 29 '10 at 15:04
3  
Software that uses OSI approved licenses feels safer. –  Johan Aug 29 '10 at 19:41
1  
@TheLQ, @Johan: superuser.com/questions/164162/is-truecrypt-truly-safe –  Hello71 Aug 29 '10 at 20:01

5 Answers 5

up vote 8 down vote accepted

There are three methods: set up an encrypted volume on a partition (dm-crypt, configured with cryptsetup), set up a file which is an encrypted volume (truecrypt), set up a directory where each file is encrypted separately (ecryptfs or encfs).

Setting up an encrypted volume gives a little more confidentiality, because the metadata (size, modification time) of your files is invisible. On the downside, it's less flexible (you have to decide on the size of the encrypted volume in advance). The ecryptfs FAQ lists some differences between the two approaches.

If you elect to encrypt file by file, I'm aware of two options: ecryptfs and encfs. The former uses an in-kernel driver while the latter uses FUSE. This may give ecryptfs a speed advantage; it gives encfs a flexibility advantage as nothing needs to be done as root. A possible benefit of ecryptfs is that once you've done the initial setup, you can use your login password as a filesystem password thanks to the pam_ecryptfs module.

For my own use in a similar situation, I chose encfs, because I didn't see any actual security benefit to other solutions so ease-of-use was the determining factor. Performance hasn't been a problem. The workflow is very simple (the first run of encfs creates the filesystem):

aptitude install encfs
encfs ~/.work.encrypted ~/work
... work ...
fusermount -u ~/work

I recommend you also encrypt your swap space and any place where temporary confidential files may be written to, such as /tmp and /var/spool/cups (if you print confidential files). Use cryptsetup to encrypt your swap partition. The easiest way of dealing with /tmp is to keep it in memory by mounting it as tmpfs (this may give a slight performance benefit in any case).

share|improve this answer
    
I did not think about /tmp, but tmpfs solves this problem in a nice way. Just do real shutdown:s. –  Johan Aug 29 '10 at 19:37
1  
Thanks for teaching encfs! This is fantastic! –  user39559 Sep 9 '10 at 17:58

I exclusively use TrueCrypt for such things. OSI-approved or not, I find it's never let me down, and I -have- needed encryption multiple times.

share|improve this answer

If you are only worried about losing your laptop, Ubuntu has ecryptfs already set up for you.

Just choose "encrypted home directory" when you create your user account and give it a decent password. This will protect whatever is inside your home folder.

Yes, it will encrypt more than ~/work, but it's seamless.

For the /tmp use tmpfs.

Pros:

  • You don't need to do anything else, Ubuntu does everything for you.
  • Your friends may use your computer on-the-go, they will only need a password if they want to access your files.

Con:

  • There are other places where you make leak data -- Gilles' answer is the most complete (+1 for him).

So, if you don't think some forensic expert will try to get data from stuff you have printed, this is good enough.

ecryptfs can encrypt the swap as well, but I recommend you just disable swap unless it has happened to you that you went out of RAM. Life is better without swap. (or just run ecryptfs-setup-swap and follow the instructions to change fstab)


Warning: In any case, unless you just got this laptop, there is already lots of stuff written to your hard disk. I found a bunch of stuff in mine and nothing would clear it out. You need to make a backup to another drive or partition, overwrite your current filesystem with zeros, and restore your files (of course, only restore the sensitive files after the encryption is set up).

share|improve this answer

The easiest, fastest way to set this up is to install ecryptfs-utils and cryptkeeper:

sudo apt-get install ecryptfs-utils cryptkeeper

Then, once done, look in your systray. You'll see an icon of two keys. Click it and choose New Encrypted Folder. Type in the name and click the Forward button (oddly in the bottom left, not right). Then, type in the password you want, reconfirm it, and click Forward again, and then OK.

This will mount the encrypted folder and you can copy files into it. When done, if you logout or uncheck that mounted folder (click the Keys icon in the systray to do so), it will require a password again before you remount it.

share|improve this answer

Quick and easy way is to tar and compress and then bcrypt.

tar cfj safe-archive.tar.bz2 Directory/ 
bcrypt safe-archive.tar.bz2 
# will ask you an 8 char password twice to lock it up.
# But, remember to delete your Directory after this,
rm -rf Directory/ 
# And, I hope you don't forget the password, or your data is gone!

Makes safe-archive.tar.bz2.bfe -- which you can rename if you feel paranoid about it.

To open the encrypted pack,

bcrypt safe-archive.tar.bz2.bf3 # Or, whatever you called it
tar xfj safe-archive.tar.bz2 
# And, your directory is back!

If you are ready to get more messy, I'd suggest truecrypt, and making encrypted volumes.
But, I don't think that is necessary for regular data (like not related to national security, say).

ps: note that I am not suggesting bcrypt is weak or incapable of national security in any way.


Reply to the comments on my answer above.
I tried to give a simple answer -- and, I do agree that my choice of not suggesting Truecrypt as the first option may be inappropriate to some here.

The question asks for an easy way to encrypt a directory.
My measure of security here is based on two things,

  1. What do you want to secure and
  2. Who do you want to secure it from

I rate this as the level of your 'paranoia'.

Now, without saying Truecrypt (or other similar methods) are costlier,
all I want to say is, a bcrypt sequence run in tmpfs is sufficient for your daily use today
(it won't be so, probably, in about a decade, I guess, but it really is for now).
And, I also assume that the value of data being secured here is not going to be comparable for a mona-lisa class 'recovery' attempt.

Simple question then -- do you expect someone to try grabbing your powered-off laptop and attempt recovering data from its cold RAM space?
If you do, you probably ought to reconsider your hardware and software in the first place, check which ISP you connect to, who can hear your key-presses, and so on.

ps: I like Truecrypt and use it. The OSI compliance, or lack of it, does not really matter. And, I am not staging bcrypt and the scheme proposed here in competition to it.

share|improve this answer
1  
While I give the answer +1, for the truely paranoid among us ... depending on the value of your data this could be a bad idea. The user must realise that this method obviously leaves the deleted directory's files on disk where they can potentially be recovered by the "bad guys". Just look around SU for "recover deleted files in Linux" to see how safe that is... –  hotei Aug 29 '10 at 13:15
    
@hotei, yes, Truecrypt will tackle such complications. Another trick would be to use a tmpfs mount on RAM for working with the encrypted directory -- copy the bfe to ramdisk, work with it there, encrypt again and save the encrypted archive back to file system. –  nik Aug 29 '10 at 14:08
2  
I would go a step farther than @hotei did and say that this doesn't actually quality as encryption since its so easy to recover the files (there is an entire market dedicated to file recovery). Encryption needs to be encryption. This is only a false sense of encryption –  TheLQ Aug 29 '10 at 15:02
2  
@nik: Not only is the method in your answer insecure as hotei has explained, it's also error-prone (what if you forget to remove the decrypted files?). Even your proposal of using tmpfs is very risky: what if you forget to reencrypt the files and lose your modifications? what if the computer crashes (you'll lose all your modifications)? It's also needlessly complicated. There are many actual ways to solve this problem using appropriate tools, just use one of them. –  Gilles Aug 29 '10 at 19:02
1  
@nik There was an exhibition at a nearby university that showed that even after an hour of the RAM being off, you can still make out a picture of the Mona Lisa that was loaded into memory. Unless you reboot the machine immediately afterwards, it's super easy to recover the data from RAM. Truecrypt, IIRC, encrypts its RAM. –  digitxp Aug 29 '10 at 19:25

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.