Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a production server (Ubuntu, running 24/7) with a git repository and some client computers each with a working copy of this repository. In the client computers, simply using home folder encryption seems to solve the problem that in case of stolen hardware nobody can access the files in the git.

How can I encrypt the remote side of the git repository to make sure that in case of stolen hardware nobody can reconfigure and clone the git repository?

At first, I thought of encrypting the home directory of the git user, but then I realised that this wouldn't make any sense, since when and by whom should it be decrypted?

Can I put the git repository in my own home directory / link to it so it will only be available when I have logged into the server via SSH? Or is there a similar solution to this problem?

Thanks for any tips in advance!

share|improve this question
up vote 5 down vote accepted

You could use an ecrypted home directory. You would have to login and manually mount the encrypted drive and provide the decryption key when the server reboots. You can't have the drive automatically mounted for obvious reasons.

share|improve this answer
Thanks. So you mean encrypt the home directory of user git? Since I am not the user git when I login with SSH, how do I mount the ecryptfs then? Or should I login with user git? – leemes May 14 '12 at 19:45
(sorry, I only know ecryptfs in an auto configuration since I use Ubuntu on all my computers with encrypted home directories using ecryptfs, and so I never have to worry about any manual commands ;)) – leemes May 14 '12 at 19:47
you could encrypt just a single folder. you would be creating a file on the disk which represents the encrypted filesystem, then if you setup /etc/fstab correctly, it could just be something like running "mount /home/git/repository" which would prompt you for a password. here is a decent writeup of how you might accomplish this:… – stew May 14 '12 at 21:00

You could use a smudge/clean filter to encrypt the contents of the repository on the remote filesystem:

share|improve this answer
That actually encrypts the local repository as well – Tobias Kienzler Oct 11 '12 at 6:22
Try instead -- uses CTR mode and understands crypto rather better; it leaves the local repo unencrypted in the working tree, via the smudge/clean filters. – Phil P Apr 13 '14 at 22:30

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.