I have this unlimited online backup solution, which has very few good things to say about it apart from it being free. For instance, though it claims to offer encryption, this seems not to be the case.

I was thinking there might be some FUSE-based FS, similar to the standard Ubuntu "encrypt your home folder" (LUKS) option, that did the opposite of LUKS. That is, it would take my local, unencrypted files, and present them in a virtual FS, encrypted, for my backup program to back up on the online service. So that all my files on the backup servers (which are out of my control) would be completely unreadable to anyone, even if those servers were compromised.

Preferably, it would also be able to do the reverse, in case I needed to restore files. So that I could, for instance, write encrypted files to the virtual FS and it'd unencrypt them before writing them to disk. Or there'd be some other way to achieve this, such as it using standard libraries like gpgp or something like that...

Does this make sense? Does any one of you know about anything like this?

I find it really hard to formulate a Google query that doesn't offer me pages and pages of the opposite of what I'm looking for.

TIA, Daniel


What you want to do could be achieved using a cryptographic filesystem in userspace (FUSE) that transparently en- and decrypts data on the fly like EncFS or eCryptFS.

With EncFS you can create a new volume as easy as executing encfs ~/crypt ~/plain and follwing the instructions. While the volume is mounted every file saved to ~/plain will be written encrypted on the fly to ~/crypt. You can then unmount the plaintext volume with fusermount -u ~/plain and mount again by issuing encfs ~/crypt ~/plain and entering the password.

It should be easy to set up your backup process so that only ~/crypt is included. Also if you really only need the encrypted values for backups, take a look at the reverse mode of EncFS.

There have been concerns about the security of former versions EncFS if an attacker gains access to multiple different snapshots of the same encrypted directory, which might be the case for backups or syncing to a cloud storage service.

If you are concerned about this eCryptFS will probably be the better choice, being the probably more mature and performant tool, but it depends on a linux kernel module being installed and needs a more complex setup. You will also be able to backup encrypted versions of your data by adding a directory to your backup.


Tahoe-LAFS sort of does this, though it will be a little involved to set up and won't do anything for an existing folder (you'd have to copy your initial files into it). Here's the general scheme you'd need to follow:

  • Install Tahoe-LAFS
  • If using the Tahoe-LAFS commands isn't good enough and you really need it to mirror something file-addressable, enable sftp in the Tahoe configuration and mount it using SSHFS.
  • Create a storage node. Symlink the storage directory in that node to the folder watched by your backup service.
  • When you add, remove, or update files in Tahoe, the changes will be reflected in that storage directory, and they'll be encrypted. You can retrieve them unencrypted using the Tahoe commands or the sftp/SSHFS frontend.
  • Hm. Unsure if I've expressed myself badly or if I'm misunderstanding Tahoe-LAFS. Isn't it expressly for distributing data across multiple nodes? What I'm looking for is something pretty much exactly like LUKS, except with the behavior reversed, so that — staying in the LUKS analogy — I have clear data in my "LUKS folder" and encrypted data in my "home folder". Does that make sense? Thanks :) – DanielSmedegaardBuus Aug 10 '13 at 20:30
  • You don't have to install it on multiple nodes. You can configure it for single-node usage if you want. I've done a similar thing experimenting with this to get it to upload files securely to a cloud service and it sounds like you might be doing something similar. – LawrenceC Aug 10 '13 at 22:52
  • Yes, but I still don't see how it can be used to create a transparent, virtual FS with files that are encrypted using actual files on a regular FS that are not encrypted? – DanielSmedegaardBuus Aug 11 '13 at 21:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.