eCryptfs is a POSIX-compliant enterprise-class stacked cryptographic filesystem for Linux. Layering on top of the filesystem layer eCryptfs protects files no matter the underlying filesystem, partition type, etc.
During installation there is an option to encrypt the /home partition. This will automatically configure everything needed to encrypt and mount the partition.
As an example, this section will cover configuring /srv to be encrypted using eCryptfs.
First, install the necessary packages. From a terminal prompt enter:
sudo apt install ecryptfs-utils
Now mount the partition to be encrypted:
sudo mount -t ecryptfs /srv /srv
You will then be prompted for some details on how ecryptfs should encrypt the data.
To test that files placed in /srv are indeed encrypted copy the /etc/default folder to /srv:
sudo cp -r /etc/default /srv
Now unmount /srv, and try to view a file:
sudo umount /srv cat /srv/default/cron
Remounting /srv using ecryptfs will make the data viewable once again.
Automatically Mounting Encrypted Partitions
There are a couple of ways to automatically mount an ecryptfs encrypted filesystem at boot. This example will use a /root/.ecryptfsrc file containing mount options, along with a passphrase file residing on a USB key.
First, create /root/.ecryptfsrc containing:
key=passphrase:passphrase_passwd_file=/mnt/usb/passwd_file.txt ecryptfs_sig=5826dd62cf81c615 ecryptfs_cipher=aes ecryptfs_key_bytes=16 ecryptfs_passthrough=n ecryptfs_enable_filename_crypto=n
Adjust the ecryptfs_sig to the signature in /root/.ecryptfs/sig-cache.txt.
Next, create the /mnt/usb/passwd_file.txt passphrase file:
Now add the necessary lines to /etc/fstab:
/dev/sdb1 /mnt/usb ext3 ro 0 0 /srv /srv ecryptfs defaults 0 0
Make sure the USB drive is mounted before the encrypted partition.
Finally, reboot and the /srv should be mounted using eCryptfs.
The ecryptfs-utils package includes several other useful utilities:
ecryptfs-setup-private: creates a ~/Private directory to contain encrypted information. This utility can be run by unprivileged users to keep data private from other users on the system.
ecryptfs-mount-private and ecryptfs-umount-private will mount and unmount a user's ~/Private directory.
ecryptfs-add-passphrase: adds a new passphrase to the kernel keyring.
ecryptfs-manager: manages eCryptfs objects such as keys.
ecryptfs-stat: allows you to view the ecryptfs meta information for a file.