Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Is it possible to implement scheme where remote server just share its filesystem (or resizable container file in it) and it's locally encrypted and mounted? And what is best practical method? (On linux.)

Example use is backup storage on not very trusted server.

share|improve this question

2 Answers 2

up vote 3 down vote accepted

Sounds like what you're looking for is encfs. It's FUSE layer on top of any existing FS which encrypts and decrypts on-the-fly, storing the encrypted version in the underlying filesystem. The catch is that file metadata (ownership, sizes, times) is visible, but content and names are not.

You can also use --reverse to go the other way around: make an encrypted view of an unencrypted fs -- useful for making rsync-friendly encrypted backups.

EDIT TO ADD
As pointed out by Æsahættr, another usable option is eCryptfs. This is an in-kernel FS driver, which means root permission is required. But it's very low performance overhead and much faster then encfs in my own tests. While the implementation is quite a bit different between the two, the way you use them is nearly identical:

encfs /base_dir/ /view_dir/
# or
mount -t ecryptfs /base_dir/ /view_dir/

By default, encfs scrambles filenames while ecryptfs does not, but these options are configurable. Also, ecryptfs adds much more per-file overhead than encfs does because it stores metadata in the file itself, while encfs stores it in a hidden xml file. Also, the --reverse option that encfs has doesn't really translate well to ecryptfs; ecryptfs has ecryptfs_encrypted_view but it probably won't work the way you expect it to. Supposedly this is a work-in-progress.

Both can use any filesystem as a base; including, for example sshfs. But bear in mind that file ownership and permissions are stored as-is on the base filesystem, which could mean access-denied errors if you don't match things up correctly, or losing permissions completely if you base on a FS that doesn't support them.

share|improve this answer
    
I only fear that fuse stuff is slow and encfs is not enough crypto audited. But I may be wrong. –  catpnosis Nov 6 '12 at 13:31
1  
@catpnosis Fuse is going to be no slower than any other userspace encryption tool. The crypto itself is OpenSSL which you may or may not trust. Encfs has been audited a few times and has been revised because of it. –  tylerl Nov 6 '12 at 18:12
    
There's also ecryptfs which Ubuntu uses for its home directory encryption, etc. This is another stacked file system. I believe it would also work over networks. –  user2213 Nov 6 '12 at 22:09
    
Edited to add ecryptfs and associated comparison –  tylerl Nov 7 '12 at 18:25
    
@tylerl Thanks for the follow up about eCryptfs! That is interesting. –  catpnosis Nov 9 '12 at 2:18

Yes, if you want to use encrypted container file, you can access the remote filesystem using NFS, CIFS or SSHFS protocols. For remote access to a block device you can use iSCSI, NBD or AoE. Personally, I'd benchmark access over CIFS and NFS with an encrypted container file and then use the one that is the fastest for me.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.