2

I want to have a directory(ies) that is only accessible through some password, encrypted. I want something more secure than just permissions. I've been taking a look at truecrypt and dm-crypt for linux but I read some complains about reliability of Truecrypt (problems copying in/out, hung up while working with truecrypt partitions), which at first looked very nice to me.

Some experiences or recommendations, please?

Thanks!

3 Answers 3

4

You can use ecryptfs which encrypts a single-directory in the users /home folder. It works nice, but is always decrypted for the user who created it and always encrypted (iirc) for any other users (e.g. you can't access someone else's encrypted directory).

Installation and use (for Ubuntu, but can be adjusted for any distro).

2
  • ecryptfs can encrypt any directory, not just a single directory in the user's private folder. It just won't be automatically mounted. May 21, 2009 at 23:13
  • I suits perfectly to the situation that I described. I tested it and it just what I was looking for.
    – Álvaro
    May 22, 2009 at 13:25
1

I have used dm-crypt for my entire filesystem on my laptop, and for specific partitions on a couple servers (ubuntu/debian). I have never had any reliability problems. It is not fips-140-2 certified if that matters to you, but I am not aware of anything that is under Linux. I haven't really done anything to measure performance, but I didn't have a huge impact that I noticed. In my usage I was am paranoid then I was worried about speed.

If you are really worried about encrypting things you may want to make sure that your swap, and /tmp filesystesm are encrypted. It is possible to have your data encrypted it /home, and then for some reason it gets swapped out into your swap partition in the clear. In a few cases some applications do some work in /tmp. Encryption doesn't help you much if a copy of your file is also in the clear in some temp file or swap file somewhere.

1
1

As tj111 mentioned, you can use ecryptfs or something similar to encrypt the contents of a directory on the disk. However, when one person mounts the directory, it will be mounted for all users of the computer, and you'll still have to protect the files within using file permissions. This user will also have to be able to mount the directory, so you would need to give them some mechanism of doing that (root access? a setuid binary?).

Beyond that, if your groups are structured correctly, and there are no privilege escalation bugs, your data should be safe with file permissions. If users don't have physical access to the machine, they shouldn't be able to directly read the disk (or remove it) or boot in single-user mode.

Are you concerned about keeping the data encrypted while the computer is in use, or keeping it encrypted only on-disk?

1
  • What I want is to restrict access to that data only to some specific situations, otherwise being encrypted. I don't mind that other users have access, since is my personal computer. This seems to be easier than using openssl to encrypt/decrypt every single file at every use. Is only for some important information of mine.
    – Álvaro
    May 22, 2009 at 0:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .