LinuxQuestions.org
View the Most Wanted LQ Wiki articles.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Software
User Name
Password
Linux - Software This forum is for Software issues.
Having a problem installing a new program? Want to know which application is best for the job? Post your question in this forum.

Notices



Reply
 
Search this Thread
Old 04-13-2011, 09:48 AM   #1
Skaperen
Senior Member
 
Registered: May 2009
Location: WV, USA
Distribution: Slackware, CentOS, Ubuntu, Fedora, Timesys, Linux From Scratch
Posts: 1,777
Blog Entries: 20

Rep: Reputation: 116Reputation: 116
encfs not working all the way


I am trying to get Encfs working on Ubuntu 10.10 with only partial success. I am using the Ubuntu package which is version 1.6.1. I am also trying to build 1.7.4 source on Ubuntu 10.10 which is failing.

First the problem with the Ubuntu package, which I realize may be fixed in 1.7.4.

I am mounting a clear directory with the --reverse option to have an encrypted view of this data. This so far works, although I do not know if it really works correctly. I used rsync to copy all the encrypted data to a third directory outside of this first mounting. Then I do a second mounting (without --reverse) using that copy as the source, to make a mountpoint with a clear view of the copied encrypted files. This fails as no files show up at all.


I am doing it this way because my intended first use for Encfs is to copy an encrypted view of a local physically secured backup directory containing clear data to another remote machine where sometimes it is not physically secure. Transfer is by ssh over rsync, but that is not sufficient security for the remote machine. So the role of Encfs is to be sure the data is never in a clear state on that machine when the machine is not attended. This location is the home of the owner of the company who is not always at home. The machine is, in theory, at risk for theft when no one is at home (this is the risk we want to address). The owner will personally have the Encfs password, and may need access to some of these files. So it would be treated as an encrypted store and Encfs would be used to view it in the clear by manually mounting it that way (e.g. not with --reverse).

I am doing the test entirely on my desktop at the moment, as described above. I am using a script to carry out the entire setup of my tests, so it is fully reproducible, and that configuration can be incrementally changed as desired. I have a suspicion that certain messages resulting from the setup may indicate the problem. This is from the first mount with --reverse:

Code:
Creating new encrypted volume.
Standard configuration selected.
--reverse specified, not using unique/chained IV

Configuration finished.  The filesystem to be created has
the following properties:
Filesystem cipher: "ssl/aes", version 2:2:1
Filename encoding: "nameio/block", version 3:0:1
Key Size: 192 bits
Block Size: 1024 bytes
File holes passed through to ciphertext.

Now you will need to enter a password for your filesystem.
You will need to remember this password, as there is absolutely
no recovery mechanism.  However, the password can be changed
later using encfsctl.
Then after copying the encrypted view to another directory and mounting that copy without --reverse:

Code:
Creating new encrypted volume.
Standard configuration selected.

Configuration finished.  The filesystem to be created has
the following properties:
Filesystem cipher: "ssl/aes", version 2:2:1
Filename encoding: "nameio/block", version 3:0:1
Key Size: 192 bits
Block Size: 1024 bytes
Each file contains 8 byte header with unique IV data.
Filenames encoded using IV chaining mode.
File holes passed through to ciphertext.

Now you will need to enter a password for your filesystem.
You will need to remember this password, as there is absolutely
no recovery mechanism.  However, the password can be changed
later using encfsctl.
So is it the case that there is a difference in how the file tree is encrypted, especially the naming scheme, depending on whether --reverse is used or not? Are they supposed to be compatible, or incompatible? Is there an option I can make them work the same?

Now ... on to the source issue for 1.7.4. I downloaded the source for 1.7.4 and ran ./configure. It gets the following error:

Code:
...
checking for joinable pthread attribute... PTHREAD_CREATE_JOINABLE
checking if more special flags are required for pthreads... no
checking for cc_r... gcc
checking for boostlib >= 1.34... configure: error: We could not detect the boost libraries (version 1.34 or higher). If you have a staged boost library (still not installed) please specify $BOOST_ROOT in your environment and do not give a PATH to --with-boost option.  If you are sure you have boost installed, then check your version number looking in <boost/version.hpp>. See http://randspringer.de/boost for more documentation.
This Ubuntu 10.10 system has the following installed:

Code:
lorentz/root /root 1391# dpkg -l | fgrep boost
ii  libboost-filesystem1.42.0             1.42.0-3ubuntu1                                   filesystem operations (portable paths, iteration over directories, etc) in C++
ii  libboost-iostreams1.42.0              1.42.0-3ubuntu1                                   Boost.Iostreams Library
ii  libboost-program-options1.42.0        1.42.0-3ubuntu1                                   program options library for C++
ii  libboost-regex1.42.0                  1.42.0-3ubuntu1                                   regular expression library for C++
ii  libboost-serialization1.42.0          1.42.0-3ubuntu1                                   serialization library for C++
ii  libboost-system1.42.0                 1.42.0-3ubuntu1                                   Operating system (e.g. diagnostics support) library
lorentz/root /root 1392#
It appears the version is suitable since it is greater than 1.34. Has Ubuntu mangled it so the path cannot be found? Any suggestion on how to tell ./configure where this is (and which path should be used)?

Would it be better to switch all this to Slackware?

Here is the script I am doing the test with:
Code:
#!/bin/bash

pass="OhF00barz"
cwd=$( exec pwd )

[[ -n "${workdir}" ]] || workdir="test-encfs"
[[ -d "${workdir}" ]] || mkdir "${workdir}" || exit
workdir=$( cd "${workdir}" && exec pwd ) || exit 1
dir1="${workdir}/cleardata"
dir2="${workdir}/cryptview"
dir3="${workdir}/cryptcopy"
dir4="${workdir}/clearview"

cmd() {
	echo "EXECUTING:" "$@" 1>&2
	time "$@"
	return $?
}

# if being called for password, output it and exit
if [[ -n "${OUTPUT_ENCFS_PASSWORD}" ]] ; then
	echo "${pass}"
	exit 0
fi

# set this to recursively run the password output
# it is just a flag and does not contain the password
export OUTPUT_ENCFS_PASSWORD=1

# be sure the source directory exits
[[ -n "${1}" ]] || { echo "No source directory specified" ; exit 1 ; }
[[ -e "${1}" ]] || { echo "Source directory '${1}' does not exist" ; exit 1 ; }
[[ -d "${1}" ]] || { echo "Source directory '${1}' is not a directory" ; exit 1 ; }
[[ -r "${1}" ]] || { echo "Source directory '${1}' is not readable" ; exit 1 ; }
[[ -x "${1}" ]] || { echo "Source directory '${1}' is not accessible" ; exit 1 ; }

# which version is this?
cmd encfs --version
sleep 1

# be sure these are not mounted
cmd fusermount -u "${dir2}"
sync
sleep 1

cmd fusermount -u "${dir4}"
sync
sleep 1

# be sure these are not existing YET
cmd rm -fr "${dir1}" "${dir2}" "${dir3}" "${dir4}"
sync
sleep 1

# populate the clear data tree
cmd rsync -aHSW --temp-dir="${cwd}" "${1}/." "${dir1}" || exit 1
sync
sleep 1

# make the mount point for the encrypted view
cmd mkdir "${dir2}" || exit 1
sync
sleep 1

# mount the encrypted view
cmd encfs --standard --extpass="${0}" --reverse "${dir1}" "${dir2}" || exit 1
sync
sleep 1

# replicate the encrypted view
cmd rsync -aHSW --temp-dir="${cwd}" "${dir2}/." "${dir3}" || exit 1
sync
sleep 1

# make the mount point for the clear view
cmd mkdir "${dir4}" || exit 1
sync
sleep 1

# mount the clear view of the encrypted copy
cmd encfs --standard --extpass="${0}" "${dir3}" "${dir4}" || exit 1
sync
sleep 1

# see what we end up with
echo =============================================================================
cat /proc/mounts | egrep "${dir1}|${dir2}|${dir3}|${dir4}"
echo =============================================================================
for d in "${dir1}" "${dir2}" "${dir3}" "${dir4}" ; do
	( ls -dl "${d}"/.encfs[5-9].xml ) 2>/dev/null
	echo -n "total number of files in '${d}' is: "
	find "${d}" -mindepth 1 -print | wc -l
done
echo =============================================================================

# if noclean requested, we are done
[[ -z "${noclean}" ]] || exit 0

# clean up
cmd fusermount -u "${dir2}"
sync
sleep 1

cmd fusermount -u "${dir4}"
sync
sleep 1

cmd rm -fr "${dir1}" "${dir2}" "${dir3}" "${dir4}"
sync
sleep 1
 
Old 04-18-2011, 04:11 PM   #2
vaccaaa
LQ Newbie
 
Registered: Feb 2011
Distribution: Arch Linux
Posts: 5

Rep: Reputation: 1
Looking at the manual of encfs:
Quote:
--reverse
...
You could then copy the /tmp/crypt-view directory in order to have
a copy of the encrypted data. You must also keep a copy of the
file /home/me/.encfs5 which contains the filesystem information.

Together, the two can be used to reproduce the unencrypted data:

ENCFS5_CONFIG=/home/me/.encfs5 encfs /tmp/crypt-view /tmp/plain-$

Now /tmp/plain-view contains the same data as /home/me
...
So... Did you remember to copy that file (.encfs5 or .encfs6.xml, it depends...), which is located inside the original encrypted directory? There's the encrypting key inside it (the one you unlock with the password...)
 
Old 04-18-2011, 05:48 PM   #3
Skaperen
Senior Member
 
Registered: May 2009
Location: WV, USA
Distribution: Slackware, CentOS, Ubuntu, Fedora, Timesys, Linux From Scratch
Posts: 1,777
Blog Entries: 20

Original Poster
Rep: Reputation: 116Reputation: 116
Once I make the reverse mount, where the "device" directory is clear data and the mount point is encrypted, file ".encfs6.xml" exists in the clear data, but not in the encrypted view. I copy the encrypted view, so there is no ".encfs6.xml" to copy in that view. Should I copy ".encfs6.xml" from the clear side to merge with the encrypted files? Or should I copy it into the forward mount point (clear again) side? Shouldn't this file be passed through? Or is it always on the "device" side no matter which direction the mount works?
 
Old 04-18-2011, 06:15 PM   #4
Skaperen
Senior Member
 
Registered: May 2009
Location: WV, USA
Distribution: Slackware, CentOS, Ubuntu, Fedora, Timesys, Linux From Scratch
Posts: 1,777
Blog Entries: 20

Original Poster
Rep: Reputation: 116Reputation: 116
A LOT of the stored clear files will be hard linked together (e.g. same inode, two or more different names). Will those hard linked files appear as linked that same way (e.g. have the same inode and encrypted content) in the mounted encrypted view? The reason this is critical is because efficient rsync transfer of this data depends on those hard links being utilized by rsync to avoid redundant transfers, and to avoid redundant storage on the target (which will be storing files encrypted and, when needed, viewed in the clear there or transfered back here). If the perception of hard links is lost through this, it is a showstopper.

Also, what about (different project) doing an NFS export of a reverse encfs mount (data is stored in the clear, but exported over NFS encrypted), where the NFS clients do a forward mount (so they have a clear view of the encrypted NFS export)? Is that even possible?
 
Old 04-22-2011, 02:44 AM   #5
unSpawn
Moderator
 
Registered: May 2001
Posts: 27,703
Blog Entries: 54

Rep: Reputation: 2964Reputation: 2964Reputation: 2964Reputation: 2964Reputation: 2964Reputation: 2964Reputation: 2964Reputation: 2964Reputation: 2964Reputation: 2964Reputation: 2964
Quote:
Originally Posted by Skaperen View Post
Also, what about (different project) doing an NFS export of a reverse encfs mount (data is stored in the clear, but exported over NFS encrypted), where the NFS clients do a forward mount (so they have a clear view of the encrypted NFS export)? Is that even possible?
Please note OP created new thread for this problem here: http://www.linuxquestions.org/questi...-mount-876393/ (moved from Linux Security since not a security issue and title changed to reflect contents better).
 
Old 04-25-2011, 12:16 PM   #6
Skaperen
Senior Member
 
Registered: May 2009
Location: WV, USA
Distribution: Slackware, CentOS, Ubuntu, Fedora, Timesys, Linux From Scratch
Posts: 1,777
Blog Entries: 20

Original Poster
Rep: Reputation: 116Reputation: 116
Quote:
Originally Posted by unSpawn View Post
Please note OP created new thread for this problem here: http://www.linuxquestions.org/questi...-mount-876393/ (moved from Linux Security since not a security issue and title changed to reflect contents better).
It's actually a different problem.

This thread is about copying files between a forward and a reverse encfs mount. It seems the issue is about getting the .encfs6.xml file conveyed over to the replica (still trying to decide on a strategy for it). The other thread is about sharing encrypted data between different mounts over NFS where the .encfs6.xml file is definitely present and readable (md5sum reads it and shows the same checksum at each host).
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Encfs on current brixtoncalling Slackware 5 05-15-2010 11:54 PM
encfs hangs mattydee Linux - Software 7 01-19-2007 08:10 PM
encfs, laggy system Lancet Linux - Software 0 04-21-2006 07:29 PM
EncFS and fuse EdoardoC MEPIS 0 05-26-2005 12:33 PM
ENCFS with SAMBA PAB Linux - Security 1 04-21-2005 07:38 AM


All times are GMT -5. The time now is 02:38 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration