eCryptfs

eCryptfs - это POSIX-совместимая промышленного уровня файловая система многоуровневого (stacked) шифрования для Линукс. Располагаясь поверх уровня файловой системы, eCryptfs защищает файлы безотносительно к нижележащим файловым системам, типам разделов и пр.

В процессе установки существует опция зашифровать раздел /home. Она автоматически настроит все необходимое для шифрования и монтирования раздела.

В качестве примера в этом разделе будет рассмотрена настройка шифрования /srv с использованием eCryptfs.

First, install the necessary packages. From a terminal prompt enter:

sudo apt-get install ecryptfs-utils

Now mount the partition to be encrypted:

sudo mount -t ecryptfs /srv /srv

You will then be prompted for some details on how ecryptfs should encrypt the data.

To test that files placed in /srv are indeed encrypted copy the /etc/default folder to /srv:

sudo cp -r /etc/default /srv

Now unmount /srv, and try to view a file:

sudo umount /srv cat /srv/default/cron

Remounting /srv using ecryptfs will make the data viewable once again.

There are a couple of ways to automatically mount an ecryptfs encrypted filesystem at boot. This example will use a /root/.ecryptfsrc file containing mount options, along with a passphrase file residing on a USB key.

First, create /root/.ecryptfsrc containing:

key=passphrase:passphrase_passwd_file=/mnt/usb/passwd_file.txt ecryptfs_sig=5826dd62cf81c615 ecryptfs_cipher=aes ecryptfs_key_bytes=16 ecryptfs_passthrough=n ecryptfs_enable_filename_crypto=n

Adjust the ecryptfs_sig to the signature in /root/.ecryptfs/sig-cache.txt.

Next, create the /mnt/usb/passwd_file.txt passphrase file:

passphrase_passwd=[secrets]

Now add the necessary lines to /etc/fstab:

/dev/sdb1 /mnt/usb ext3 ro 0 0 /srv /srv ecryptfs defaults 0 0

Make sure the USB drive is mounted before the encrypted partition.

Finally, reboot and the /srv should be mounted using eCryptfs.

The ecryptfs-utils package includes several other useful utilities:

  ecryptfs-setup-private: creates a ~/Private directory to contain encrypted information. This utility can be run by unprivileged users to keep data private from other users on the system.

  ecryptfs-mount-private and ecryptfs-umount-private: will mount and unmount respectively, a users ~/Private directory.

  ecryptfs-add-passphrase: adds a new passphrase to the kernel keyring.

  ecryptfs-manager: manages eCryptfs objects such as keys.

  ecryptfs-stat: allows you to view the ecryptfs meta information for a file.

  For more information on eCryptfs see the Launchpad project page.

  There is also a Linux Journal article covering eCryptfs.

  Also, for more ecryptfs options see the ecryptfs man page.

  The eCryptfs Ubuntu Wiki page also has more details.