If you’re like most people, you probably use Linux to run your business. But if you’re also like most people, you probably don’t know how to encrypt files. That’s because encryption is a vital part of the security of your files and it’s something that many businesses don’t take seriously. But there’s a way to encrypt files on Linux without any software or even a lot of effort - using the gocryptfs filesystem feature. gocryptfs is a powerful filesystem that can help protect your files from unauthorized access. It’s free and open source, so it’s easy to use and it works on most Linux distributions. To get started with gocryptfs, first install the gocryptfs package on your system. Then create a directory for it on your hard drive and copy the following file into that directory: /etc/gocryptfs/crypto-server.conf This file contains information about how gocryptfs should work when encrypting files. You’ll need to change some of the defaults if you want to use this feature, but for now, just leave everything as it is. The next step is to create an encrypted file in this directory: Now let’s start up the crypto-server service: (assuming you have an account at https://www2.nist.gov/certs/ ) Type this command into a terminal: (assuming you have an account at https://www2.nist.gov/certs/ ) sudo service crypto-server start
gocryptfs Offers Protection From Data Breaches
Privacy is big news. Hardly a week goes by without the announcement of a breach at one organization or another. Companies either report recent incidents or disclose breaches that happened some time ago. In both cases, it’s bad news for those whose data has been exposed.
Because millions of people use services like Dropbox, Google Drive, and Microsoft OneDrive, a seemingly never-ending stream of data is pushed to the cloud every day. If you store some (or all) of your data on the cloud, what can you do to protect classified information and private documents should a breach occur?
Data breaches come in all shapes and sizes, of course, and they’re not limited to the cloud. A lost memory stick or stolen laptop is just a data breach on a smaller scale. But the scale isn’t the critical factor. If the data is sensitive or confidential, someone else having it could be disastrous.
One solution is to encrypt your documents. Traditionally, this is done by encrypting your hard drive in its entirety. This is secure, but it also slightly slows down your computer. Plus, if you suffer a catastrophic failure, it can complicate the process of restoring your system from backups.
The gocryptfs system allows you to encrypt only the directories that need protection and avoid the system-wide overhead of encryption and decryption. It’s fast, lightweight, and easy to use. It’s also easy to move encrypted directories to other computers. As long as you have the password to access that data, it leaves no trace of your files on the other computer.
The gocryptfs system is constructed as a lightweight, encrypted file system. It’s also mountable by regular, non-root accounts because it uses the Filesystem in Userspace (FUSE) package. This acts as a bridge between gocryptfs and the kernel file-system routines it needs to access.
Installing gocryptfs
To install gocryptfs on ubuntu, type this command:
To install it on Fedora type:
On Manjaro, the command is:
Creating an Encrypted Directory
Part of the glory of gocryptfs is how simple it is to use. The principles are:
Create a directory to contain the files and subdirectories you’re protecting. Use gocryptrfs to initialize that directory. Create an empty directory as a mount point, and then mount the encrypted directory onto it. In the mount point, you can see and use the decrypted files and create new ones. Unmount the encrypted folder when you’re done.
We’re going to create a directory called “vault” to hold the encrypted data. To do so, we type the following:
We need to initialize our new directory. This step creates the gocryptfs file system within the directory:
Type a password when you’re prompted; you’ll type it twice to ensure it’s correct. Choose a strong one: three unrelated words that include punctuation, digits, or symbols is a good template.
Your master key is generated and displayed. Copy and save this somewhere safe and private. In our example, we’re creating a gocryptfs directory on a research machine that’s wiped after each article is written.
As it’s necessary for an example, you can see the master key for this directory. You’ll definitely want to be much more secretive with yours. If someone obtains your master key, they can access al of your encrypted data.
If you change into the new directory, you’ll see two files have been created. Type the following:
The “gocryptfs.diriv” is a short binary file, while “gocryptfs.conf” contains settings and information you should keep safe.
If you upload your encrypted data to the cloud or back it up to small, transportable media, don’t include this file. If, however, you back up to local media that remains under your control, you can include this file.
With sufficient time and effort, it might be possible to extract your password from the “encrypted key” and “salt” entries, as shown below:
Mounting the Encrypted Directory
The encrypted directory is mounted on a mount point, which is simply an empty directory. We’re going to create one called “geek”:
We can now mount the encrypted directory on the mount point. Strictly speaking, what’s actually mounted is the gocryptfs file system inside the encrypted directory. We’re prompted for the password:
When the encrypted directory is mounted, we can use the mount point directory the same as we would any other. Anything we edit and create in this directory is actually written to the mounted, encrypted directory.
We can create a simple text file, like the following:
We can edit it, add some content to it, and then save the file:
Our new file has been created:
If we switch into our encrypted directory, as shown below, we see a new file has been created with an encrypted name. You can’t even tell which file type it is from the name:
If we try to view the contents of the encrypted file, we can see it’s truly scrambled:
Our simple text file, shown below, is now anything but simple to decipher.
Unmounting the Encrypted Directory
When you’re finished with your encrypted directory, you can unmount it with the fusermount command. Part of the FUSE package, the following command unmounts the gocryptfs file system inside the encrypted directory from the mount point:
If you type the following to check your mount point directory, you’ll see it’s still empty:
Everything you did is safely stored in the encrypted directory.
Simple and Secure
Simple systems have the advantage of being used more often, while more complicated processes tend to fall by the wayside. Using gocryptfs is not only simple, it’s also secure. Simplicity without security wouldn’t be worthwhile.
You can create as many encrypted directories as you need or just one to hold all of your sensitive data. You might also want to create a few aliases to mount and unmount your encrypted file system and simplify the process even more.
RELATED: How to Create Aliases and Shell Functions on Linux
