Re: [gentoo-user] Encryption questions

[Neil Bothwick]

On Sun, 9 Dec 2018 23:15:21 -0600, Dale wrote:

> Well, I thought it may be simpler.  Since I've never tried encryption
> before, I don't know first hand how it works or what it takes to use the
> files.  I've read where people password protect their mobo, bootloader
> and their entire storage system.  Basically, without the proper
> passwords, you can't boot the system or access it from another system
> either.  That is overkill for me for sure.  If anything, I'm on the
> other end of the scale.  I just want a directory, which could be a mount
> point, that is encrypted.  Knowing what tool is best may help be figure
> out whether it is a mount point, a regular directory or what.  I've read
> where some whole file systems can be encrypted or it can be done on a
> directory level.  I'm not sure what works the best tho. 

It sounds like ecryptfs would suit your needs best. As it works on
directories, you don't need separate mount points for each encrypted
directory. ISTR there is a PAM module to unlock your ecryptfs directories
when you log into your desktop (it needs a password login not
auto-login).

As already mentioned you can backup the encrypted files so your backups
are automatically secure. One point about ecryptfs is increases the size
of each file by a fixed amount. This doesn't matter with larger files but
if you have a directory full of smaller files, like a mail client cache,
there may be a noticeable increase in disk usage.

Encrypting the whole filesystem may be more convenient as it means you
don't have to worry about what is encrypted and what is not, but you
would need to back up to an encrypted drive.

Neither method will protect you from remote access while you are logged
in as the encrypted files will be unlocked.


-- 
Neil Bothwick

If a man is standing in the middle of the forest speaking and there is
no woman around to hear him - Is he still wrong?