questions about data/encryption of a linux directory

Question

i have a directory full of sensitive data and want to encrypt this directory to protect against outside attackers. i still want to be able to read from the directory and display this data onto a webpage in it's original form. will data encryption tools, such as, eCryptFs, allow for this? if it does, how does it work exactly if the data is mounted/unmounted? does auto-mounting come into play here?

Answer 1

Generally, if an encrypted filesystem/file is mounted it's contents become accessible to all users who have access to the folder (and root). I think the most feasible solution for your problem is:

• Use LUKS to create an encrypted filesystem
• Mount at boot time (or when you start the HTTP daemon)
• Do not put the key to the container on the box (it's a nuisance to enter the password every time, but a commonly made mistake)
• Change the directory permissions to 700
• Change the ownership to the webserver user (commonly www-data)

This will disallow anyone on the system (except www-data and root) to access the files.

---

If you really want to go for maximum security, you could script something like:

• When accessing the webpage, ask for the encrypted container password
• Mount the encrypted container
• Retrieve the necessary files
• Unmount the container

Keep in mind that mounting/unmounting is a very expensive operation, so your webpage would get really slow.

Answer 2

You can buy the hardware token (smart card) and use the key stored at the card. That will let you to encrypt and decrypt the files in a batch mode without the need of storing the password (when you disabled the card user pin verification) whenever the card is plugged in... but will also prevent for anyone to form just copping the key.