i have a directory full of sensitive data and want to encrypt this directory to protect against outside attackers. i still want to be able to read from the directory and display this data onto a webpage in it's original form. will data encryption tools, such as, eCryptFs, allow for this? if it does, how does it work exactly if the data is mounted/unmounted? does auto-mounting come into play here?


The only benefit you'll get by encrypting the directory that way is that if someone physically steals your server and attempts to read the hard drive, they will not be able to do so without knowing the encryption passphrase. If you must be able to constantly read data from that directory, then you gain very little by encrypting the files in it, as attackers are more likely to try to gain access to it remotely than by stealing your server or your hard drive. Furthermore, you will have to manually enter the decryption passphrase every time you reboot that system, which will add to the complexity of your setup.

If you must satisfy some data at rest requirement, then you are better off investing into one of those self encrypting hard drives, as long as your system bios supports it.

  • i should preface this by saying that both the application/sensitive data and web servers are on the same local network behind a tough firewall. so i would think that filesystem encryption should be enough in this case? i would be particularly leery only if the servers were in remote locations outside of the network. in order to gain access, the outsider would need to enter multiple login credentials as well as have access to a PIV card and pin. <-if any of this is the case, there is a bigger problem. – milesmiles55 Jun 19 '14 at 15:12
  • 1
    @milesmiles55 The question you need to ask yourself is, what am I protecting myself from by encrypting the drive? When you ask, "is it enough?" you need to define what your goal is. mricon's first sentence is key for you: it will only protect against physical threats, not remote ones. – schroeder Jun 19 '14 at 15:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.