Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I want to have a directory(ies) that is only accessible through some password, encrypted. I want something more secure than just permissions. I've been taking a look at truecrypt and dm-crypt for linux but I read some complains about reliability of Truecrypt (problems copying in/out, hung up while working with truecrypt partitions), which at first looked very nice to me.

Some experiences or recommendations, please?

Thanks!

share|improve this question
add comment

3 Answers

up vote 4 down vote accepted

You can use ecryptfs which encrypts a single-directory in the users /home folder. It works nice, but is always decrypted for the user who created it and always encrypted (iirc) for any other users (e.g. you can't access someone else's encrypted directory).

Installation and use (for Ubuntu, but can be adjusted for any distro).

share|improve this answer
    
ecryptfs can encrypt any directory, not just a single directory in the user's private folder. It just won't be automatically mounted. –  Paul Fisher May 21 '09 at 23:13
    
I suits perfectly to the situation that I described. I tested it and it just what I was looking for. –  Álvaro May 22 '09 at 13:25
add comment

I have used dm-crypt for my entire filesystem on my laptop, and for specific partitions on a couple servers (ubuntu/debian). I have never had any reliability problems. It is not fips-140-2 certified if that matters to you, but I am not aware of anything that is under Linux. I haven't really done anything to measure performance, but I didn't have a huge impact that I noticed. In my usage I was am paranoid then I was worried about speed.

If you are really worried about encrypting things you may want to make sure that your swap, and /tmp filesystesm are encrypted. It is possible to have your data encrypted it /home, and then for some reason it gets swapped out into your swap partition in the clear. In a few cases some applications do some work in /tmp. Encryption doesn't help you much if a copy of your file is also in the clear in some temp file or swap file somewhere.

share|improve this answer
    
Those remarks are actually very useful. Thanks!! –  Álvaro May 21 '09 at 23:58
1  
By the way, you can set up a dm-crypt encryption on your filesystems directly from Ubuntu installation, see kuparinen.org/martti/comp/ubuntu/en/cryptolvm.html for further details. –  paulgreg Jun 6 '09 at 21:03
add comment

As tj111 mentioned, you can use ecryptfs or something similar to encrypt the contents of a directory on the disk. However, when one person mounts the directory, it will be mounted for all users of the computer, and you'll still have to protect the files within using file permissions. This user will also have to be able to mount the directory, so you would need to give them some mechanism of doing that (root access? a setuid binary?).

Beyond that, if your groups are structured correctly, and there are no privilege escalation bugs, your data should be safe with file permissions. If users don't have physical access to the machine, they shouldn't be able to directly read the disk (or remove it) or boot in single-user mode.

Are you concerned about keeping the data encrypted while the computer is in use, or keeping it encrypted only on-disk?

share|improve this answer
    
What I want is to restrict access to that data only to some specific situations, otherwise being encrypted. I don't mind that other users have access, since is my personal computer. This seems to be easier than using openssl to encrypt/decrypt every single file at every use. Is only for some important information of mine. –  Álvaro May 22 '09 at 0:13
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.