EncFS

Related articles
gocryptfs
eCryptfs
Data-at-rest encryption
Warning
A
security review
(February 2014) of
encfs
discovered a number of security issues (in the stable release 1.7.4 of 2014). Please consider the report and the references in it for updated information before using the release, since the development has halted and
not all issues are fixed
. After a long hiatus the project was revived and is migrating the code to the Rust programming language.
[1]
EncFS
is a userspace stackable cryptographic file-system similar to
eCryptfs
, and aims to secure data with the minimum hassle. It uses
FUSE
to mount an encrypted directory onto another directory specified by the user. It does not use a loopback system like some other comparable systems such as
TrueCrypt
and
dm-crypt
.
EncFS is definitely the simplest software if you want to try disk encryption on Linux.
Advantages of EncFS: Firstly, it does not require any root privileges to implement; any user can create a repository of encrypted files. Secondly, one does not need to create a single file and create a file-system within that; it works on existing file-system without modifications.
Disadvantages: The encrypted files are not stored in their own file, someone who obtains access to the system can still see the underlying directory structure, the number of files, their sizes and when they were modified. They cannot see the contents, however.
This particular method of securing data is obviously not perfect, but there are situations in which it is useful.
For more details on how EncFS compares to other disk encryption solutions, see
Data-at-rest encryption#Comparison table
.
Comparison to eCryptFS
eCryptFS
is implemented in kernelspace and therefore a little bit harder to configure. You have to remember various encryption options (used cyphers, key type, etc...). With EncFS this is not the case, because it stores the encryption metadata information in a per-directory configuration file (
.encfs6.xml
). So you do not have to remember anything (except the passphrase).
The performance of both depends on the type of disk activity. While eCryptFS can perform faster in some cases because there is less overhead by context switching (between kernel and userspace), EncFS has advantages in other cases because the encryption metadata is centralized and not stored in the individual files' headers. For more information
benchmark examples
are provided by the EncFS project.
Installation
Install
the
encfs
package.
Note
The
encfs
project is not maintained anymore.
[2]
Usage
To create a secured repository, type:
$ encfs ~/.
encrypted
~/
origin
Note that absolute paths must be used. This will be followed by a prompt about whether you want to go with the default options, expert configuration or a paranoid preset. The first is a fairly secure default setup. The second allows specifying algorithms and other options. After entering a key for the encryption, the encoded file-system will be created and mounted. The encoded files are stored, in this example, at
~/.
encrypted
, and their unencrypted versions in
~/
origin
.
Tip
Using EncFS on a FUSE
file system
, e.g.
NTFS-3G
, might end up with slow performance. Consider changing the file system if possible.
To unmount the file-system, type:
$ fusermount -u ~/
name
To remount the file-system, issue the first command, and enter the key used to encode it. Once this has been entered, the file-system will be mounted again.
Changing the password
To change the password of a directory encrypted by EncFS, the following command can be used:
$ encfsctl passwd ~/.
name
In this example,
~/.
name
is the path to the directory which contains the encoded files. The tool will ask for your current password and afterwards, you will be able to set a new one.
User friendly mounting
Gnome Encfs Manager
The
Gnome Encfs Manager
is an easy to use manager and mounter for encfs stashes featuring per-stash configuration, Gnome Keyring support, a tray menu inspired by Cryptkeeper but using the AppIndicator API and lots of unique features.
Both
gnome-encfs-manager-bin
AUR
and a slightly more up to date
gnome-encfs-manager-bzr
AUR
are available.
Mount using encfsui
A bash script
encfsui
provides a simple
zenity
gui around the EncFS command line utility to mount and unmount an encrypted directory. It includes a desktop launcher. Install it from
encfsui
AUR
.
Mount via fstab
Adding an entry in
/etc/fstab
will allow you to mount the encfs volume with a simple
mount /target/path
and you will be prompted for your password.
/etc/fstab
encfs#/path/to/encfs/data  /mnt/decrypted  fuse  noauto,user  0  0
The
noauto
option prevents an attempt to mount the volume at boot, which could delay the boot process while it waits for a password to be entered.
user
can be omitted if only the
root
user should be able to mount the volume.
Mount at login using pam_encfs
This article or section is out of date.
Reason:
The instructions are based on a very old version of
pambase
and confusing for that reason, they need to be reviewed/shortened to the
/etc/pam.d/
changes required to add the module. The
pam_encfs
AUR
package was updated 2010 last, the template may alternatively also be changed to
Template:Remove
, since
#Mount at login using pam mount
is an available alternative. (Discuss in
Talk:EncFS
)
Install
pam_encfs
AUR
. See also:
https://web.archive.org/web/20160505055352/http://pam-encfs.googlecode.com/svn/trunk/README
https://web.archive.org/web/20160428084352/http://pam-encfs.googlecode.com/svn/trunk/pam_encfs.conf
https://wiki.edubuntu.org/EncryptedHomeFolder
https://code.google.com/archive/p/pam-encfs/
Single password
Warning
Note that if you will use same password (eg.: using try_first_pass or use_first_pass) for login and encfs (so encfs will mount during your login) then you should use
SHA password hashes
(Preferably SHA512 with some huge number of rounds) and (which is most important)
secure password
, because hash of your password is probably stored in unencrypted form in
/etc/shadow
and it can be cracked in order to get your encfs password (because it is same as your regular unix login password).
/etc/pam.d/
Note that when you are using
try_first_pass
parameter to
pam_unix.so
then you will have to set EncFS to use same password as you are using to login (or vice-versa) and you will be entering just single password. Without this parameter you will need to enter two passwords.
setup pam_encfs for all login methods
Put encfs line to /etc/pam.d/system-login as follows:
...
auth       sufficient pam_encfs.so
...
login
This section tells how to make encfs automount when you are logging in by virtual terminal.
Note
If you only want to use it through GDM, you may pass this and go right to the
GDM section
below.
Edit the file
/etc/pam.d/login
:
#%PAM-1.0

auth		required	pam_securetty.so
auth		requisite	pam_nologin.so
auth		sufficient	pam_encfs.so
auth		required	pam_unix.so nullok try_first_pass
#auth		required	pam_unix.so nullok
auth		required	pam_tally.so onerr=succeed file=/var/log/faillog
# use this to lockout accounts for 10 minutes after 3 failed attempts
#auth		required	pam_tally.so deny=2 unlock_time=600 onerr=succeed file=/var/log/faillog
account		required	pam_access.so
account		required	pam_time.so
account		required	pam_unix.so
#password	required	pam_cracklib.so difok=2 minlen=8 dcredit=2 ocredit=2 retry=3
#password	required	pam_unix.so md5 shadow use_authtok
session		required	pam_unix.so
session		required	pam_env.so
session		required	pam_motd.so
session		required	pam_limits.so
session		optional	pam_mail.so dir=/var/spool/mail standard
session		optional	pam_lastlog.so
session		optional	pam_loginuid.so
-session	optional	pam_ck_connector.so nox11
#Automatic unmount (optional):
#session	required	pam_encfs.so
Warning
Note that automatic unmount will process even when there is another session. eg.: logout on VC can unmount encfs mounted by GDM session that is still active.
gdm
This section explains how to make encfs automount when you are logging in by GDM.
Note
For debug purposes you may try automount on virtual console login first.
This article has a section about automount on virtual console login
.
Edit the file
/etc/pam.d/gdm-password
.
Insert (do not overwrite) the following into the bottom of gdm-password:
#%PAM-1.0
auth            requisite       pam_nologin.so
auth            required        pam_env.so
auth            sufficient      pam_encfs.so
auth            required        pam_unix.so try_first_pass
auth            optional        pam_gnome_keyring.so
account         required        pam_unix.so
session         required        pam_limits.so
session         required        pam_unix.so
session         optional        pam_gnome_keyring.so auto_start
password        required        pam_unix.so
session         required        pam_encfs.so
Save and exit.
Configuration
Edit
/etc/security/pam_encfs.conf
:
Recommended: comment out the line
encfs_default --idle=1
This flag will unmount your encrypted folder after 1 minute of inactivity.  If you are automounting this on login, you probably would like to keep this mounted for as long as you are logged in.
At the bottom, comment any existing demo entries and add:
#USERNAME       SOURCE                                  TARGET PATH                 ENCFS Options           FUSE Options
archie          /home/archie/EncryptedFolder          /home/archie/DecryptedFolder    -v                    allow_other
Note
It is not possible to mount multiple EncFS folders at login using
pam_encfs
. If multiple entries are specified in
/etc/security/pam_encfs.conf
, only the first one will be mounted, and the rest will be ignored. To mount multiple EncFS folders at login it is necessary to use
pam_mount
. See
#Mount at login using pam_mount
for details.
Also, if you see the following line, remove
allow_root
from the options. Otherwise, it will be in conflict with
allow_other
defined above.
fuse_default allow_root,nonempty
Next, edit
/etc/fuse.conf
:
Uncomment:
user_allow_other
To test your config, open a new virtual terminal (e.g.
Ctrl+Alt+F6
) and login.  You should see pam successfuly mount your EncFS folder.
Mount at login using pam_mount
Install and configure
pam_mount
as explained on its wiki page. EncFS mounts can be specified in pam_mount's configuration file as follows:
/etc/security/pam_mount.conf.xml
<volume fstype="fuse" path="encfs#
/path/to/encfs/encrypted/data
" mountpoint="
/path/to/decrypted/data/mountpoint
" options="nonempty" />
The EncFS mounts need to have the same password than your user account. The
nonempty
option makes it possible to mount the encrypted file system even when the mount point is non-empty. You may remove this option if this is not the desired behaviour.
It is possible to mount multiple EncFS folders at login specifying multiple consecutive
<volume>
entries in the configuration file.
Encrypted backup
Warning
If you follow below examples to separate the encryption options file from the data, you - of course - need to ensure you have a separate backup of the options file in plaintext as well. If your disk crashes and you have not backed it up in plaintext, the backup alone will help nothing because the file contains cryptographic metadata! The good point is that the file is static, you do not need to back it up repetitively over time unless you change the password.
Backup encrypted directory
An encrypted directory may be backed up and restored to another location like it is. This is possible, because the configuration file for the encryption options/metadata is actually stored in the directory itself in plaintext in the hidden
.encfs6.xml
file. This poses no direct problem, because the password is not in it.
However, if you - for example - store the backup on a remote location (e.g. in the cloud) or a portable device, you might feel uncomfortable about it. In this case it also is no problem to manually move the file out of the directory before creating the backup. You can even move it permanently and still mount and access the files, if you pass its location to
encfs
via the
ENCFS6_CONFIG
environment variable. For the
#Usage
example above:
$ mv ~/.name/.encfs6.xml ~/.
$ ENCFS6_CONFIG=~/.encfs6.xml encfs ~/.name ~/name
Backup plaintext directory
The following example assumes you want to create an encrypted  backup of an existing plaintext directory
~/mythesis
which contains the file
thesis.txt
.
First, we create the encrypted backup of the existing plaintext directory:
$ encfs --reverse ~/mythesis /tmp/thesisbackup
Note the directory order is reversed to normal usage in this case. Using the
--reverse
option has two effects: Firstly, the configuration file is now stored in the plaintext directory and
/tmp/thesisbackup
only contains it in encrypted form. Secondly, the files in
/tmp/thesisbackup
are not persistent. They will vanish once it is unmounted (no, this is not due to usage of the
/tmp
mountpoint).
For the second reason, now is the time to copy the encrypted files to the desired backup location,
before
unmounting the temporary
encfs
directory again:
$ cp -R /tmp/thesisbackup/* /mnt/usbstick/
$ fusermount -u /tmp/thesisbackup
and done.
To restore (or view) the backup, we need access to the encryption options in plaintext, which has to be passed to
encfs
with the environment variable
ENCFS6_CONFIG
(we use a different directory in order not to mess up the existing
~/mythesis
):
$ ENCFS6_CONFIG=~/mythesis/.encfs6.xml encfs ~/mnt/usbstick/thesisbackup ~/restoremythesis
If you now list the restore location, it will contain two files:
$ ls -la ~/restoremythesis
... 
-rw-r--r--  1 student student    1078  3. Jan 12:33 .encfs6.xml
-rw-r--r--  1 student student      42  3. Jan 12:33 thesis.txt
...
See also
EncFS
- project homepage
Security audit
of EncFS by Taylor Hornby (January 14, 2014).
EncFS micro-how-to
by Anthony Thyssen.