Sparse files written to eCryptfs will produce larger, non-sparse encrypted files in the lower directory.

If in doubt, EncFS may be a better choice in this case. However, if you want to set up eCryptfs directly on top of an NFS mount, with no local copy of the files, eCryptfs may crash or behave incorrectly. It is always possible to use eCryptfs on a local directory and then copy the encrypted files from the local directory to a network host. This can break some programs in your home directory (for example Symfony caching).ĮCryptfs has long-standing bugs when used on top of NFS and possibly other networked filesystems, for example, #Mounting may fail on a remote host when connecting via Mosh. The package also includes low-level tools which are fully configurable, but they are somewhat more difficult to use compared to alternatives like EncFS.įile names longer than 143 bytes cannot be encrypted (with the FNEK option) when stacked on a filesystem with a maximum file name length of 255 bytes. The high-level #Ubuntu tools are the easiest to use, but they hard-code the lower directory path and other settings, limiting their usefulness. The ecryptfs-utils package provides several different ways of setting up eCryptfs.

FNEK refers to a File Name Encryption Key, a key to (optionally) encrypt the filenames stored in the encrypted directory.īefore using eCryptfs, the following disadvantages should be checked for applicability.

FEKEK refers to a File's Encryption Key Encryption Key (see kernel documentation).

eCryptfs uses the term wrapped passphrase to refer to the cryptographically secured mount passphrase.

The mount passphrase (or key) is what gives access to the encrypted files, i.e.

While not relevant for this article, the Overlay filesystem introduced with Linux 3.18 uses the same upper/lower nomenclature for the stacking of filesystems.

The encrypted directory is referred to as the lower and the unencrypted as the upper directory throughout the eCryptfs documentation and this article.

Several eCryptfs terms are used throughout the documentation:.

It is also possible to share a directory with differently encrypted files (different passphrases). However, the encryption is linked to one passphrase so this must be shared as well.

It is possible to share an encrypted directory between users.

As a stacked filesystem, a mounting of an eCryptfs directory refers to mounting a (stacked) encrypted directory to another unencrypted mount point (directory) at Linux kernel runtime.

To familiarize with eCryptfs a few points: If you are just starting to set up disk encryption, swap encryption and other points to consider are covered in Data-at-rest encryption#Preparation. There are other advantages, but there are also drawbacks, for instance eCryptfs is not suitable for encrypting complete partitions which also means you cannot protect swap space with it (but you can, of course, combine it with Dm-crypt/Swap encryption). All cryptographic metadata is stored in the headers of files, so encrypted data can be easily moved, stored for backup and recovered. That includes, for example, a user's entire home directory or single dedicated directories within it. Instead, you can mount eCryptfs on top of any single directory to protect it.

One distinguished feature is that the encryption is stacked on an existing filesystem eCryptfs can be mounted onto any single existing directory and does not require a separate partition (or size pre-allocation).Īs mentioned in the summary eCryptfs does not require special on-disk storage allocation effort, such as a separate partition or pre-allocated space. For comparison of the two you can refer to Data-at-rest encryption#Block device vs stacked filesystem encryption. In implementation eCryptfs differs from dm-crypt, which provides a block device encryption layer, while eCryptfs is an actual file-system – a stacked cryptographic file system. It guides you through the process of creating a private and secure encrypted directory within your home directory to store sensitive files and private data.

This article describes basic usage of eCryptfs.

Any way to edit encrypted bin files