What is the easiest way to encrypt a dir? (on Ubuntu)

Question

What is the easiest way to encrypt a directory on a Ubuntu based system?

Let's say I have a laptop that is running Ubuntu 10.04, and on that I have some documents that should be kept safe (if I lose the laptop).

Let's say all to documents is in a dir called ~/work/, and nothing secret is outside this dir. So no need to encrypt the entire home dir.

There shall be a way to lock/unlock this dir from the command line.

There seem to be some different ways of doing this:

• ecryptfs-utils
• cryptsetup
• truecrypt (however not OSI approved open source)

But what is the easiest and most reliable method?

Thanks Johan

---

Update: Related question, but not the same What's the easiest way to encrypt all of my files in ubuntu 10.04?

Answer 1

There are three methods: set up an encrypted volume on a partition (dm-crypt, configured with cryptsetup), set up a file which is an encrypted volume (truecrypt), set up a directory where each file is encrypted separately (ecryptfs or encfs).

Setting up an encrypted volume gives a little more confidentiality, because the metadata (size, modification time) of your files is invisible. On the downside, it's less flexible (you have to decide on the size of the encrypted volume in advance). The ecryptfs FAQ lists some differences between the two approaches.

If you elect to encrypt file by file, I'm aware of two options: ecryptfs and encfs. The former uses an in-kernel driver while the latter uses FUSE. This may give ecryptfs a speed advantage; it gives encfs a flexibility advantage as nothing needs to be done as root. A possible benefit of ecryptfs is that once you've done the initial setup, you can use your login password as a filesystem password thanks to the pam_ecryptfs module.

For my own use in a similar situation, I chose encfs, because I didn't see any actual security benefit to other solutions so ease-of-use was the determining factor. Performance hasn't been a problem. The workflow is very simple (the first run of encfs creates the filesystem):

aptitude install encfs
encfs ~/.work.encrypted ~/work
... work ...
fusermount -u ~/work

I recommend you also encrypt your swap space and any place where temporary confidential files may be written to, such as /tmp and /var/spool/cups (if you print confidential files). Use cryptsetup to encrypt your swap partition. The easiest way of dealing with /tmp is to keep it in memory by mounting it as tmpfs (this may give a slight performance benefit in any case).

Answer 2

Quick and easy way is to tar and compress and then bcrypt.

tar cfj safe-archive.tar.bz2 Directory/ 
bcrypt safe-archive.tar.bz2 
# will ask you an 8 char password twice to lock it up.
# But, remember to delete your Directory after this,
rm -rf Directory/ 
# And, I hope you don't forget the password, or your data is gone!

Makes safe-archive.tar.bz2.bfe -- which you can rename if you feel paranoid about it.

To open the encrypted pack,

bcrypt safe-archive.tar.bz2.bf3 # Or, whatever you called it
tar xfj safe-archive.tar.bz2 
# And, your directory is back!

If you are ready to get more messy, I'd suggest truecrypt, and making encrypted volumes.
But, I don't think that is necessary for regular data (like not related to national security, say).

^{ps: note that I am not suggesting bcrypt is weak or incapable of national security in any way.}

---

Reply to the comments on my answer above.
I tried to give a simple answer -- and, I do agree that my choice of not suggesting Truecrypt as the first option may be inappropriate to some here.

The question asks for an easy way to encrypt a directory.
My measure of security here is based on two things,

1. What do you want to secure and
2. Who do you want to secure it from

I rate this as the level of your 'paranoia'.

Now, without saying Truecrypt (or other similar methods) are costlier,
all I want to say is, a bcrypt sequence run in tmpfs is sufficient for your daily use today
(it won't be so, probably, in about a decade, I guess, but it really is for now).
And, I also assume that the value of data being secured here is not going to be comparable for a mona-lisa class 'recovery' attempt.

Simple question then -- do you expect someone to try grabbing your powered-off laptop and attempt recovering data from its cold RAM space?
If you do, you probably ought to reconsider your hardware and software in the first place, check which ISP you connect to, who can hear your key-presses, and so on.

^{ps: I like Truecrypt and use it. The OSI compliance, or lack of it, does not really matter. And, I am not staging bcrypt and the scheme proposed here in competition to it.}

Answer 3

I exclusively use TrueCrypt for such things. OSI-approved or not, I find it's never let me down, and I -have- needed encryption multiple times.

Answer 4

If you are only worried about losing your laptop, Ubuntu has ecryptfs already set up for you.

Just choose "encrypted home directory" when you create your user account and give it a decent password. This will protect whatever is inside your home folder.

Yes, it will encrypt more than ~/work, but it's seamless.

For the /tmp use tmpfs.

Pros:

• You don't need to do anything else, Ubuntu does everything for you.
• Your friends may use your computer on-the-go, they will only need a password if they want to access your files.

Con:

• There are other places where you make leak data -- Gilles' answer is the most complete (+1 for him).

So, if you don't think some forensic expert will try to get data from stuff you have printed, this is good enough.

ecryptfs can encrypt the swap as well, but I recommend you just disable swap unless it has happened to you that you went out of RAM. Life is better without swap. (or just run ecryptfs-setup-swap and follow the instructions to change fstab)

---

Warning: In any case, unless you just got this laptop, there is already lots of stuff written to your hard disk. I found a bunch of stuff in mine and nothing would clear it out. You need to make a backup to another drive or partition, overwrite your current filesystem with zeros, and restore your files (of course, only restore the sensitive files after the encryption is set up).

Answer 5

The easiest, fastest way to set this up is to install ecryptfs-utils and cryptkeeper:

sudo apt-get install ecryptfs-utils cryptkeeper

Then, once done, look in your systray. You'll see an icon of two keys. Click it and choose New Encrypted Folder. Type in the name and click the Forward button (oddly in the bottom left, not right). Then, type in the password you want, reconfirm it, and click Forward again, and then OK.

This will mount the encrypted folder and you can copy files into it. When done, if you logout or uncheck that mounted folder (click the Keys icon in the systray to do so), it will require a password again before you remount it.