{"id":8534,"date":"2021-04-02T17:17:09","date_gmt":"2021-04-02T14:17:09","guid":{"rendered":"https:\/\/kifarunix.com\/?p=8534"},"modified":"2024-03-19T08:28:21","modified_gmt":"2024-03-19T05:28:21","slug":"encrypt-files-and-directories-with-ecryptfs-on-ubuntu-20-04","status":"publish","type":"post","link":"https:\/\/kifarunix.com\/encrypt-files-and-directories-with-ecryptfs-on-ubuntu-20-04\/","title":{"rendered":"Encrypt Files and Directories with eCryptFS on Ubuntu 20.04"},"content":{"rendered":"\n

In this tutorial, you will learn how to encrypt files and directories with eCryptFS on Ubuntu 20.04. Encryption<\/strong> is the process in which a plain text data, a message or information, is converted to a random and meaningless data, commonly known as ciphertext. Encrypted data can only accessed by authorized parties while those who are not authorized cannot access it.<\/p>\n\n\n\n

There are several methods of encrypting data in Linux for example EncFS, eCryptFS for filesystem level encryption, Loop-AES, DMCrypt, CipherShield for full disk encryption.<\/p>\n\n\n\n

eCryptfs<\/span> is a POSIX-compliant enterprise-class stacked cryptographic filesystem for Linux. Layering on top of the filesystem layer eCryptfs<\/span> protects files no matter the underlying filesystem, partition type, etc<\/p>\n\n\n\n

During installation, Ubuntu provides an option to encrypt the \/home<\/span> partition using eCryptfs<\/span>. This will automatically configure everything needed to encrypt and mount the partition However, if you dont get on pretty well with this, run through the following steps to ecnrypt your files and directories manually.<\/p>\n\n\n\n

Using eCryptFS to Encrypt Files and Directories<\/h2>\n\n\n\n

Install eCryptFS<\/h3>\n\n\n\n

To use eCryptFS, install the necessary packages. However, if you enabled home directory encryption during installation, this utility should already be installed.<\/p>\n\n\n\n

If the package doesn’t already exist, then you need to update your system package cache and install ecryptfs.<\/p>\n\n\n\n

apt update<\/code><\/pre>\n\n\n\n
apt install ecryptfs-utils -y<\/code><\/pre>\n\n\n\n
Encrypting a Directory with eCryptFS<\/h3>\n\n\n\n
Now that the installation is done, it is time to see eCryptFS in action.<\/p>\n\n\n\n
To encrypt a directory with eCryptFS, mount the directory in question with ecryptfs filesystem type.<\/p>\n\n\n\n
Let say  you want to encrypt ~\/mydocuments<\/strong>, then;<\/p>\n\n\n\n
sudo mount -t ecryptfs ~\/mydocuments\/ ~\/mydocuments\/<\/code><\/pre>\n\n\n\n
When this command is run, it asks for a passphrase and several other prompts. Answer them accordingly.<\/p>\n\n\n\n
Passphrase:    Enter your passpharase here<\/strong>\nSelect cipher:\n1) aes: blocksize = 16; min keysize = 16; max keysize = 32\n2) blowfish: blocksize = 8; min keysize = 16; max keysize = 56\n3) des3_ede: blocksize = 8; min keysize = 24; max keysize = 24\n4) twofish: blocksize = 16; min keysize = 16; max keysize = 32\n5) cast6: blocksize = 16; min keysize = 16; max keysize = 32\n6) cast5: blocksize = 8; min keysize = 5; max keysize = 16\nSelection [aes]:  Press Enter<\/strong>\nSelect key bytes: \n1) 16\n2) 32\n3) 24\nSelection [16]:  Press Enter<\/strong>\nEnable plaintext passthrough (y\/n) [n]: n<\/strong>\nEnable filename encryption (y\/n) [n]: n<\/strong>\nAttempting to mount with the following options:\n   ecryptfs_unlink_sigs\n   ecryptfs_key_bytes=16\n   ecryptfs_cipher=aes\n   ecryptfs_sig=96b6fac91e0a01b8\n WARNING: Based on the contents of [\/root\/.ecryptfs\/sig-cache.txt],\n it looks like you have never mounted with this key \n before. This could mean that you have typed your \n passphrase wrong.\n Would you like to proceed with the mount (yes\/no)? : yes\n Would you like to append sig [96b6fac91e0a01b8] to\n [\/root\/.ecryptfs\/sig-cache.txt] \n in order to avoid this warning in the future (yes\/no)? : yes\n Successfully appended new sig to user sig cache file\n Mounted eCryptfs<\/code><\/pre>\n\n\n\n
The encrypted directory is now mounted. Run the command below to verify the mounting.<\/p>\n\n\n\n
sudo mount | grep mydocuments<\/code><\/pre>\n\n\n\n
\/home\/koromicha\/mydocuments on \/home\/koromicha\/mydocuments type ecryptfs (rw,relatime,ecryptfs_sig=96b6fac91e0a01b8,ecryptfs_cipher=aes,ecryptfs_key_bytes=16,ecryptfs_unlink_sigs)<\/code><\/pre>\n\n\n\n
You can now start putting your sensitive data to the directory.<\/p>\n\n\n\n
As an example, let us create a file with random data within the encrypted directory.<\/p>\n\n\n\n
cat > ~\/mydocuments\/clients-contacts.txt << 'EOL'\nClientA: 020-000001\nClientB: 020-000002\nClientC: 020-000003\nClientD: 020-000004\nEOL<\/code><\/pre>\n\n\n\n
As long as the directory is mounted, the data is accessible.<\/p>\n\n\n\n
Let us unmount the directory and see if it is possible to access the data.<\/p>\n\n\n\n
sudo umount ~\/mydocuments<\/code><\/pre>\n\n\n\n
Try to view the data now.<\/p>\n\n\n\n
cat ~\/mydocuments\/clients-contacts.txt<\/code><\/pre>\n\n\n\n
P.p\"3DUfw`\u0584[PJP5~p_CONSOLE9mx\u01eeP|Xt\u07eb0ak!f(B\u01ac \n:i>0o989<\u0464k@OmD(WZ=&Ss<g9#@\\e`\\A]L!\\U]s\/zU.x|B$HPmTTzyrrx4%@$8!r]sI\\#4q1Z8&\u06ffGGb$7\n^QU\ufdf1Ia4\u0275K,tyhUUHi 0]h<S+fK2DH-mC[iO-XbKd\u05f0@%xYs, w'\nO-nt!z\"\u027e6AZy\u01b7.\u0603T`\u01e10Ff\u04f2\u072e%O{@[\u07d58wLR\u047bsr&]^ XoeA\"m?SVb&\/Nrg\u03b8o?&[sj!\n\"lL C\u042f5)+H^rA2aKxf.a+}LiA\u031d|gSOj2y_x~Ma^p.PmPUvdjv34 c5-F\\hFQ\u00bdCTLB#OI+5.WXsDlb\u02ba\nf50)> AJa7$~4V!R;udP]\u07b1ABSyT!qg D;fY(&4!aX@\"Jy\u026cPwvJ\"h}B<nS>e\n)@[K~w39PK^ j~p\"G'eQEK&3Ywe,\u03f7,AVj\u01ba!yUoX \u00b7@\\:!{mQf\u06e2'w\u0163ap]4}% \u03b1u[0M#>S\u9b4dg9t_A0k=\u06ca;\nw\u210dGZN$V2\"HI-4oI\u12adEoK?]9sIr0J:{uTJ8\ue74bD\u058d+ n\u026a7CI&iCELYa\u0305\u00ff\u049e\u0799n)-]}C\n...<\/code><\/pre>\n\n\n\n
This is all meaningless.<\/p>\n\n\n\n
To access the data, you need to remount the directory.<\/p>\n\n\n\n
When prompted for the passphrase, use the one you set while mounting the directory for the first time.<\/p>\n\n\n\n
sudo mount -t ecryptfs ~\/mydocuments\/ ~\/mydocuments\/<\/code><\/pre>\n\n\n\n
Passphrase: ENTER THE PASSPHRASE\nSelect cipher: \n 1) aes: blocksize = 16; min keysize = 16; max keysize = 32\n 2) blowfish: blocksize = 8; min keysize = 16; max keysize = 56\n 3) des3_ede: blocksize = 8; min keysize = 24; max keysize = 24\n 4) twofish: blocksize = 16; min keysize = 16; max keysize = 32\n 5) cast6: blocksize = 16; min keysize = 16; max keysize = 32\n 6) cast5: blocksize = 8; min keysize = 5; max keysize = 16\nSelection [aes]: \nSelect key bytes: \n 1) 16\n 2) 32\n 3) 24\nSelection [16]: \nEnable plaintext passthrough (y\/n) [n]: \nEnable filename encryption (y\/n) [n]: \nAttempting to mount with the following options:\n  ecryptfs_unlink_sigs\n  ecryptfs_key_bytes=16\n  ecryptfs_cipher=aes\n  ecryptfs_sig=96b6fac91e0a01b8\nMounted eCryptfs<\/code><\/pre>\n\n\n\n
You can now be able to view your data in the encrypted directory.<\/p>\n\n\n\n
The process of remounting the directory is so manual and a bit taunting. Therefore, to automate this process, you can create a bash script or use a USB with a passphrase key to automate this process.<\/p>\n\n\n\n
See our next tutorial on how to automate this mounting process<\/a>. Cheers.<\/p>\n\n\n\n
Other Tutorials<\/h3>\n\n\n\n
How to Use VeraCrypt on Command Line to Encrypt Drives on Ubuntu 18.04<\/a><\/p>\n\n\n\n
Install and Setup VeraCrypt on Ubuntu 20.04<\/a><\/p>\n\n\n\n
Encrypt Drives with LUKS in Linux<\/a><\/p>\n\n\n\n
Automount LUKS Encrypted Device in Linux<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"
In this tutorial, you will learn how to encrypt files and directories with eCryptFS on Ubuntu 20.04. Encryption is the process in which a plain<\/p>\n","protected":false},"author":3,"featured_media":8535,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"rank_math_lock_modified_date":false,"footnotes":""},"categories":[159,121,34],"tags":[161,3389,3391,3386,3387,3388,3390,1200],"class_list":["post-8534","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-encryption","category-howtos","category-security","tag-ecryptfs","tag-encrypt-files-and-directories-with-ecryptfs-on-ubuntu-20-04","tag-file-encryption","tag-how-to-encrypt-directories-with-ecryptfs","tag-how-to-encrypt-files-with-ecryptfs","tag-how-to-use-ecryptfs-on-linux","tag-install-ecryptfs-ubuntu-20-04","tag-ubuntu-20-04","generate-columns","tablet-grid-50","mobile-grid-100","grid-parent","grid-50","resize-featured-image"],"_links":{"self":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/8534"}],"collection":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/comments?post=8534"}],"version-history":[{"count":2,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/8534\/revisions"}],"predecessor-version":[{"id":21859,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/8534\/revisions\/21859"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/media\/8535"}],"wp:attachment":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/media?parent=8534"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/categories?post=8534"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/tags?post=8534"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}