Linux.com

EncFS is included with the distribution I'm using on the desktop, Ubuntu Dapper, so all I needed to do to install it was a few clicks in Synaptic. Look for the encfs package, and select if for installation. It should pull down all of the dependencies for the system.

If you're not so lucky, and your distro doesn't include EncFS packages, you can download the latest tarball from here and build it from the source. See the EncFS site for dependencies.

In addition, you'll need to load the fuse kernel module in order to use EncFS. To do this, run modprobe fuse, which should take care of loading the fuse kernel module. You also need to add your user ID to the fuse group before you can use EncFS. To add the user ID to the fuse group, run usermod -a -G fuse username -- this will add username to the fuse group, without removing the user from other groups.

Here's how it works. When you start EncFS at the command line, you tell it where to keep the encrypted and decrypted versions of your "filesystem." The encrypted version stays put, right where you tell it to stay, but the plain-text version disappears when you want it to; either by use of an unmount command or by reaching a predetermined period of inactivity. Let's take a hypothetical case to illustrate the process.

I'm planning a surprise birthday party for someone near and dear to me, someone who occasionally uses my desktop computer, so I decide to use EncFS to hide the evidence. To get started, I simply enter the following at the CLI:

encfs ~/.partyplans ~/partyplans

Since this is the first time EncFS has heard about partyplans, it double-checks to make sure I haven't made a typo before proceeding to create the directories, set the options, and get a password to use with them:

The directory "/home/warthawg/.partyplans/" does not exist. Should it be created? (y,n) y
The directory "/home/warthawg/partyplans" does not exist. Should it be created? (y,n) y
Creating new encrypted volume.
Please choose from one of the following options:
 enter "x" for expert configuration mode,
 enter "p" for pre-configured paranoia mode,
 anything else, or an empty line will select standard mode.
?



Standard configuration selected.


Configuration finished.  The filesystem to be created has
the following properties:
Filesystem cipher: "ssl/blowfish", version 2:1:1
Filename encoding: "nameio/block", version 3:0:1
Key Size: 160 bits
Block Size: 512 bytes
Each file contains 8 byte header with unique IV data.
Filenames encoded using IV chaining mode.


Now you will need to enter a password for your filesystem.
You will need to remember this password, as there is absolutely
no recovery mechanism.  However, the password can be changed
later using encfsctl.


New Encfs Password:
Verify Encfs Password:
warthawg@wartslair:~$

Then I can plot and scheme and plan for the surprise party to my heart's content, and remember to save the evidence in the secure ~/partyplans directory. As soon as I do so, the secret data is available in both encrypted form -- in the hidden ~/.partyplans directory -- and in plain-text in the visible directory. Test that by entering ls -al and looking for the .partyplans and partyplans entries. It's all there, in plain sight, and that's not good.

We need to use a related tool to make the plain-text version disappear until it's needed again. Like this:

fusermount -u ~/partyplans

That unmounts the files in the partyplans directory. The directories are still there, the encrypted versions of any files are still there. But the human-readable data files are gone. Pretty neat, huh? To make them reappear, simply enter the original EncFS command specifying the directories to be used, and after it checks the password, the invisible becomes visible again.

EncFS also has an option which creates the "filesystem" which allows you to set a predetermined period of inactivity, which will automatically unmount the plain-text "filesystem" after the specified number of minutes of inactivity is reached. To set a one hour period, for example, you would enter this when creating the "filesystem:"

encfs -i=60 ~/.autohide ~/autohide

But what if...

You know what the say about the best laid plans. So what do you do if you need to change the password for, or the location of, your super-sekrit (TM) party plans appear? You use the encfsctl command, that's what. Just like this, if you need to change the password:

encfsctl passwd ~/.partyplans

That triggers the following dialog, which asks for the current password, then the new one, then for verification of the new one.

Enter current Encfs password
EncFS Password:
Enter new Encfs password
New Encfs Password:
Verify Encfs Password:
Volume Key successfully updated.

There you have it, basic usage for EncFS and friends, more than enough to keep your own party plans safe from prying eyes. Of course, there's more to EncFS, so be sure to read the man pages for encfs, encfsctl, and fusermount.

Share    Print    Comments