Encfs

Install

apt-get install encfs

You'll also need the fuse module:

apt-get install fuse-source fuse-utils
cd /usr/src; tar xjf fuse.tar.bz2
cd linux; make-kpkg --us --uc --revision $REVISION --append-to-version $APPEND modules_image

Note that fuse is already present in the last kernel versions (at least 2.6.15)

Test:

• Under Debian, the user must be member of the fuse group to have the right to use fuse:

adduser phil fuse

• To load automatically the module fuse:

echo fuse >> /etc/modules

• To mount:

encfs /home/user/crypt-raw /home/user/crypt%%%First time, choose "p" for paranoia settings

• To unmount:

fusermount -u /home/user/crypt

Another cool use of fuse is sshfs (apt-get install sshfs)
For other cool stuffs, check here, among others the amazing HTTP-FUSE-KNOPPIX
Note on fusesmb: contrary to use of smbfs where users are identified as USER/DOMAIN, here ~/.smb/fusesmb.conf must use username=DOMAIN/USER notation. On big Windows networks, I've problems discovering the neighborhood, in that case it's much easier to populate ~/.smb/fusesmb.cache by yourself with lines such as /WORKGROUP/COMPUTER/SHARE

Encfs homedir

Personal script

My first attempt was a bash script:

#!/bin/bash

# This scripts automatically attempts to mount
# an encrypted home directory at login time
#
# Usage: how to setup this for e.g. user <foo>
# Put this script as shell of the user foo in /etc/passwd instead of /bin/bash
# Encrypted data will be under /home/.foo and mount point will be /home/foo
# Don't forget to put user foo in the group "fuse": adduser foo fuse
#
# Requirements:
#   Encfs, module fuse and fuse-utils
#
# Copyright:
#   2005, Philippe Teuwen <phil@teuwen.org>
#
# License:
#   This script is under GPLv3 or later
#
# History:
# v0.02
#   Change $(whoami) to $(USER)
# v0.01
#   Initial version
#
# TODO:
#   Check [xkg]dm login capability
#   Abs paths
#   Test presence of progs
#   Test used only as login

# When using several users with the same UID, only environment
# variables USER and HOME tell the difference
# So don't use whoami but USER

echo "Welcome $USER, please type your master key :-)"
# Mount the home dir
/usr/bin/encfs /home/.$USER $HOME
# Check if encrypted fs was mounted properly otherwise exit
/bin/cat /etc/mtab|/bin/grep -q "^encfs $HOME"||exit 1
# Required to refresh the home directory
cd $HOME
# Finally gives a bash to the user
/bin/bash
# Required to exit the home dir to be able to unmount it
cd /
# Unmount the home dir
/usr/bin/fusermount -u $HOME

PAM module

There exists an encfs PAM.
My notes for a Debian installation:

cp pam_encfs.so /lib/security

/etc/pam.d/common-auth:
#auth    required         pam_unix.so nullok_secure
auth    sufficient      pam_encfs.so
auth    required        pam_unix.so use_first_pass nullok_secure

/etc/pam.d/common-session:
session required        pam_encfs.so
session required        pam_unix.so

/etc/security/pam_encfs.conf:
drop_permissions
encfs_default
fuse_default
- /home/encfs - - -

#To add a user with encfs homedir:
adduser testuser (put him in the fuse group if you have one)
mkdir -p /home/encfs/testuser /home/testuser
chown testuser:testuser /home/encfs/testuser /home/testuser
su testuser
encfs /home/encfs/testuser  /home/testuser
#*use same password as your login atm*
fusermount -u /home/testuser

#To enable encfs homedir on existing user:
sudo mkdir -p /home/encfs/phil /home/encfs/tmp
sudo chmod 777 /home/encfs/tmp
sudo chown phil:phil /home/encfs/phil
#*use your main password on next part*
encfs /home/encfs/phil /home/encfs/tmp
cd /home/phil
find . -xdev | cpio -pamd /home/encfs/tmp
fusermount -u /home/encfs/tmp
cd /
sudo mv /home/phil /home/phil.BAK
sudo mkdir /home/phil
sudo chown phil:phil /home/phil
sudo rmdir /home/encfs/tmp
#*logout*

Problem after fuse upgrade:

• didn't work anymore.
• I had to enable "user_allow_other" in /etc/fuse.conf

Problems:

• --idle=1 is nice but how to avoid unwanted auto umount when still logged? (pam_encfs.so should maybe keep a file/dir open)
• if drop_permissions disabled, root needs explicit write access to user's home mount point
• if drop_permissions disabled and --public disabled, HOME env var set by default to / (while it was apparently defined in pam_encfs as mount point path was correctly found)
  • No directory, logging in with HOME=/
  • if drop_permissions disabled and --public enabled, no problem.
  • Don't know how to solve that
• specific fuse options added only if generic fuse_default declared
  • patch:

--- pam_encfs.c.orig   :50:29.000000000 +0200
+++ pam_encfs.c:34:46.000000000 +0200
@@ -427,11 +427,11 @@
   arg_pos += buildCmd(arg,arg_pos,path);
   arg_pos += buildCmd(arg,arg_pos,targetpath);

-  if (strlen(default_fuse_options) > 0) {
-    if (strlen(fuse_options) > 0) {
+  if (strlen(default_fuse_options) > 0 && strlen(fuse_options) > 0) {
       strcat(fuse_options,",");
     }
-    strcat(fuse_options,default_fuse_options);
+  strcat(fuse_options,default_fuse_options);
+  if (strlen(fuse_options) > 0) {
     arg_pos += buildCmd(arg,arg_pos,"--");
     arg_pos += buildCmd(arg,arg_pos,"-o");
     arg_pos += buildCmd(arg,arg_pos,fuse_options);

• if fuse_default or encfs_default empty, garbage produced on call to encfs or fuse
  • patch:

@@ -235,13 +235,12 @@
       continue;
     }
     if (strcmp("encfs_default",username) == 0) {
-
-      if (!strcmp("-",path) == 0)
+      if (parsed == 2 && !strcmp("-",path) == 0)
         strcpy(default_encfs_options,path);
       continue;
     }
     if (strcmp("fuse_default",username) == 0) {
-      if (!strcmp("-",path) == 0)
+      if (parsed == 2 && !strcmp("-",path) == 0)
         strcpy(default_fuse_options,path);
       continue;
     }

• multiple options not supported for encfs_default
  • patch:

@@ -253,6 +252,7 @@
       if (strcmp("-",fuse_options) == 0)
         strcpy(fuse_options,"");

+      searchAndReplace(default_encfs_options);
       searchAndReplace(encfs_options);

       if ((strcmp(user,username) == 0) || (strcmp("-",username) == 0)) {

• On some circumstances, fusermount fails while it shouldn't:

testphil@mercure:~$ mount
[...]
encfs on /home/phil type fuse (rw,nosuid,nodev,default_permissions,user=phil)
encfs on /home/testphil type fuse (rw,nosuid,nodev,default_permissions,user=testphil)
testphil@mercure:~$ logout
fusermount: entry for /home/testphil not found in /etc/mtab
phil@mercure:~$ mount
[...]
encfs on /home/phil type fuse (rw,nosuid,nodev,default_permissions,user=phil)
encfs on /home/testphil type fuse (rw,nosuid,nodev,default_permissions,user=testphil)
phil@mercure:~$ sudo su testphil -c "fusermount -u /home/testphil"
* and here it works with exactly the same command*

• /etc/pam_encfs.conf is not the best place
  • /usr/share/doc/libpam0g/Debian-PAM-~MiniPolicy.gz tells to have /lib/security/encfs.conf which is awful
  • but libpam-modules has e.g. /etc/security/pam_env.conf so we will have /etc/security/pam_encfs.conf
  • I should ask Sam Hartman <hartmans at ...> about this incoherence
  • patch:

@@ -81,7 +81,7 @@
 #define USERNAME_MAX           127
 #define PATH_MAX               256
 #define BUFSIZE ((USERNAME_MAX +1) + ((PATH_MAX+1) * 2))
-#define CONFIGFILE     "/etc/pam_encfs.conf"
+#define CONFIGFILE     "/etc/security/pam_encfs.conf"

 static void _pam_log ( int err, const char *format, ... );
 static char default_encfs_options[USERNAME_MAX];

• It looks like the argument allow_root given to fuse is transformed into allow_other when displayed by mount

Problems linked to the absence of locking support:

• encfs or fuse doesn't allow locking, cf similar problem with samba
  • Not sure which operation fails, flock() or open with O_EXCL flag.
• with KDE: could not read network connection list /home/.../.DCOPserver_machine__0
  • Indeed dcopserver refuses to start (error in locking .ICEauthority)
  • Solution: add to ~/.bashrc (or ~/.bash_profile if ~/.bash_profile does not include ~/.bashrc)
    • export XAUTHORITY=/tmp/.Xauthority-$USER
    • export ICEAUTHORITY=/tmp/.ICEauthority-$USER
• with X: creates multiple ~/.serverauth.1234 with locking failures
  • cf bug #469478, hack into startx script
• with unison: error (error message is not adequate...)
  Fatal error: Warning: the archives are locked.
  If no other instance of unison is running, the locks should be removed.
  Please delete lock files as appropriate and try again.
  • Create a soft link from ~/.unison to an dir out of the encfs
• with courier-imap: this doesn't work if Maildir is on encfs
  • For read-only IMAP, create a soft link from e.g. /home/user_noencfs/Maildir out of the encfs to ~/Maildir (so your mails will remain encrypted!) and tell to courier-imap that your homedir is the /home/user_noencfs
  • For read-write, this is not possible

Problems with hard links

When using paranoid mode, the default is External IV Chaining which means it's not possible to have hard links, i.e. having 2 different files (and filenames) pointing to the same data.
This is a problem with e.g. gpgsm which is using link().

Problems with tiger

I get a very similar problem as this guy: I always get the following msg

--CONFIG-- [con010c] Filesystem 'fuse' used by 'encfs' is not recognised as a local filesystem

and no way to get rid of it via /etc/tiger (except skipping all "system" tests) so I had also to add to /usr/lib/tiger/systems/Linux/2/gen_mounts a line with

[ "$2" = "encfs" ] && LOCAL=0

but I know next Debian upgrade will silently restore the original (or new) version :-(