Use-cases

Some common use-cases for EncFS are:

• Encrypting a directory or directories

A common situation is to keep files encrypted on a laptop. With EncFS you can encrypt some sections of the drive while leaving others to natively use the filesystem. The user can also have multiple encrypted volumes (e.g project1, project2).

• Keeping an encrypted volume on a portable drive

Whether as a back-up to files or as a separate file store. USB sticks or portable drives are easily lost, EncFS can protect the files when the USB stick is disconnected.

• Keeping an encrypted volume online (eg. in the Cloud)

EncFS can be used to keep a volume on-line encrypted, when it is accessed you temporarily decrypt it. The common use-case is something like DropBox or an SSHFS. Have a look at the security review of EncFS before doing this. EncFS has some clever tricks for inspecting files that are encrypted but are transparent on the local system.

• Backing up data online

Probably not, there are better systems like duplicity for this.

• Using an encrypted volume on Linux, Mac and Windows

There are ports available so it's pretty cross-platform, and it's open source and based on a well-understood system (FUSE).

Alternatives

Encryption is a complex area with a variety of options. Common alternatives are:

• eCryptFS

eCryptFS is integrated into Ubuntu to encrypt the whole of the home directory filesystem. It's easy to use, but has a kernel module element. I don't use it because it wasn't around when I started using EncFS.

• TrueCrypt varient

If cross-platform is a significant consideration then a variant of TrueCrypt is an option.

• Dm-crypt/Luks

These are complete disk encryption (block device encryption) where you want all filesystems transparently encrypted.

Ubuntu installation

Install fuse and then install encfs:

$ apt-get install fuse
$ apt-get install encfs

Source installation

a. Install fuse:

$ sudo apt-get install fuse-utils
$ sudo apt-get install fuse-source
$ sudo apt-get install module-assistant
$ sudo apt-get install linux-headers-$(uname -r)
$ sudo apt-get install libfuse2
$ sudo apt-get install libfuse-dev

b. Setup fuse

To build the kernel module for fuse you use the module-assistant command which is a nice commandline utility put together by Debian. You launch it from the commandline and then just run through each menu from top to bottom.:

$ sudo module-assistant prepare
$ sudo module-assistant build fuse
$ sudo module-assistant install fuse

After module assistant has run through and installed fuse you can load it into the kernel:

    $ sudo modprobe fuse
    $ sudo lsmod | grep fuse
# You should see fuse running

c. Add your user to the fuse group

In order that your user can use the fusermount command you need to add them into the fuser group:

$ sudo adduser <youruserid> fuse

d. Add fuse into /etc/modules

To tell the kernel to load the fuse module everytime it boots you add it into the /etc/modules file:

$ sudo cp /etc/modules /etc/modules.bak ; echo fuse >> /etc/modules

e. Install supporting software:

$ sudo apt-get install openssl
$ sudo apt-get install libssl-dev

f. Install Rlog

Download it from http://arg0.net/users/vgough/rlog/ - the version I got was 1.3. You can unzip it with the GNOME Archive Manager, or on the command line do:

$ gunzip -c <tgz_file> | tar -xvf -

By default it will install in /usr/local, but because I move my home directory on movable media between two machines I decided to install it into /home/steve. In order to get it to compile into /home/steve/bin I provide the --prefix switch:

$ ./configure --prefix=/home/steve
$ make
$ make install

If you are installing into /usr/local you don't need the prefix and should be done. In my case I needed to tell my environment where to find it so in .bashrc I added:

LD_LIBRARY_PATH=$LD_LIBRARY_PATH;/home/steve/lib
PKG_CONFIG_PATH=$PKG_CONFIG_PATH;/home/steve/lib/pkgconfig
export LD_LIBRARY_PATH, PKG_CONFIG_PATH

g. Get encfs and install it

Download it from http://arg0.net/wiki/encfs - the version I got was 1.2.3. Again unzip it with the GNOME Archive Manager, or on the command line do:

$ gunzip -c encfs-1.2.2-2.tgz | tar -xvf -
$ ./configure --prefix=/home/steve
$ make ; make install

h. Test it all works:

mkdir ~/tmp/crypt-raw
mkdir ~/tmp/crypt-safe
encfs ~/tmp/crypt-raw ~/tmp/crypt-safe
vi ~/tmp/crypt-safe
fusermount -u ~/tmp/crypt-safe

At this point you are done as you can now make encrypted volumes without a problem.

Create an EncFS volume

a. Create mount directories for the raw and unencrypted files:

$ mkdir ~/tmp/crypt-raw
$ mkdir ~/tmp/crypt-safe

The crypt-raw directory will have the encrypted files in it, they appear as long strings. The crypt-safe directory is the mount point you change directory into to access the unencrypted files.

b. Create the Encfs:

$ encfs ~/tmp/crypt-raw ~/tmp/crypt-safe

The command gives you the option of configuring with standard or paranoid configurations.

c. Inspect the configuration file:

$ view ~/tmp/crypt-raw/.encfs6.xml

This is the configuration file for the EncFS volume, where you can see the encryption level used, keysize, block size and so forth.

d. Unencrypt the volume and mount it:

$ encfs --verbose ~/tmp/crypt-raw ~/tmp/crypt-safe

e. Use the volume:

$ cd ~/tmp/crypt-safe
$ touch test.txt

Create files in the volume, you can also see it is mounted as a volume with the 'mount' command.

Unmount an EncFS volume

a. Find the mounted volume you want:

$ mount

b. Use fusermount:

$ fusermount -u ~/tmp/crypt-safe

You can confirm the volume is unmounted by running the mount command again.