Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I want to create a truecrypt container using ext4 in a linux server. I also want to access the truecrypt volume over the network from a windows desktop.

The docs mention something about having to mount the encrypted container (as read-only), but if the container is in ext4, will windows be able to recognize the ext4 volume? I know linux can recognize windows filesystem, but the reverse is not true without some ugly hack.

Would using a TC FAT container be the only way to do this?

share|improve this question

migrated from security.stackexchange.com Jul 22 '13 at 21:16

This question came from our site for Information security professionals.

1 Answer 1

up vote 1 down vote accepted

As the TrueCrypt documentation says, there are two ways to share a Truecrypt volume:

  1. The volume is mounted in a single server. That server understands the filesystem in it, and then gives access to the files through some file-sharing protocol (e.g. CIFS or NFS) to other systems. The other systems are not aware of the TrueCrypt nature of the actual data storage. The protection offered by TrueCrypt does not extend to the file-sharing protocol, so some other protection is needed for the network data transfers.

  2. The volume image is shared with other systems as one big file. Each system then mounts that image locally, as if it was a local file or USB drive or whatever. Each system must then run TrueCrypt. Each system is responsible for making sense of the filesystem structure in the volume. The restriction to read-only usage is inherent to the lack of coordination protocol between the various systems: indeed, none of the systems is aware of what other systems access the same volume.

The basic point is that TrueCrypt does not know what files are; TrueCrypt provides volumes: a volume is a single big sequence of bytes. A filesystem is a convention on the interpretation of bytes in such a volume, into distinct files in directories. If an ext4 filesystem is used in a given volume, then seeing the volume data as individual files requires some interpretation by a computer whose operating system knows what ext4 is. In the first file sharing method described above, only the server in which the volume is mounted needs know what ext4 means, because it is the only system which actually sees the volume; the other system only see a file-sharing protocol. In the second method, on the other hand, every system sees the volume itself, so every system must interpret its contents.

The second sharing method has the same prerequisites as a USB drive which you plug and mount in the various systems: this works only as long as the filesystem type can be handled by all OS. The list of filesystems that both Linux and Windows can manage includes FAT, NTFS, ISO 9660 and UDF. The last two were meant for CD-ROM and DVD, respectively, and may be cumbersome for read-write access. NTFS ought to be fine for your usage, except that it can have some irksome quirks (e.g. a Linux system will have trouble with a NTFS volume if it was last written to by a Windows system and not cleanly unmounted). FAT is probably the most robust solution in your case, if you can live with its limitations (e.g. no access rights, no individual file larger than 2 or 4 GB...).

share|improve this answer
    
Damn. I was gonna post an answer, but as usual The Bear just pwns it. –  Iszi Jul 22 '13 at 19:12
    
@ThomasPornin Is there a way to create NTFS? I don't see it as an option. –  user1812844 Jul 22 '13 at 19:38
    
Linux has a mkntfs command which creates a NTFS filesystem on a volume. It is possible that TrueCrypt does not offer it in whatever interface it uses (I don't know), but it should be possible from the command-line. –  Thomas Pornin Jul 22 '13 at 19:41

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.