#gocryptfs — Public Fediverse posts

Как я при помощи фрагментации решал одни проблемы и создавал другие

Некоторые подходы к хранению данных, при которых одному исходному файлу соответствует один зашифрованный, защищают сами данные, но оставляют открытой часть метаданных. Расскажу, как я столкнулся с такой проблемой, какие ошибки совершил при этом столкновении, и при чем тут фрагментация.

https://habr.com/ru/articles/1058222/

#информационная_безопасность #базы_данных #криптография #фрагментация #gocryptfs #хранение_данных

I just got this question from a friend:
What are people using as a replacement for encfs nowadays?

Use case would be encrypting files in a cloud storage (think: Nextcloud, OpenCloud). So you have a directory with the "plain text" files and directories" outside the Cloud storage and a directory with the encrypted files inside, synced to the cloud.

Linux laptop seems to be the main case, but being able to use the decrypted files on Android/iOS would be a plus.

AFAIK encfs was no longer maintained, the maintainer has started a port to Rust (but that is still considered alpha).
The encfs README recommends gocryptfs.

Any recommendation? Experiences?

#Linux #encfs #gocryptfs #encryption #cloud #Nextcloud #openCloud

💥💥💥I give up‼️ 🫷🫷🫷
Adding #Gocryptfs support to @backintime codebase is torture. 😭😭😭

🚀I decided to rewrite the whole mounting logic.

👉https://github.com/bit-team/backintime/issues/2391

#foss #opensource #backup

@Sigma I understand. Without any real documented alternatives and migration paths, changes like this can be expected to trip up people though 🙃

- #fscrypt only supports some filesystems, setup and migration seem very manual and tedious, no #nixos wiki page or writeups
- #gocryptfs is FUSE, but also seems tedious, nothing for nixos either
- #CryFS is totally not designed for homedir encryption (though someome tried but stopped).

🚀 gocryptfs support merged into Back In Time

Local backup profiles can now use gocryptfs for encryption instead of the deprecated EncFS.

Will be included in the upcoming 1.6.0 release within in the next weeks.

🔗 PR: https://github.com/bit-team/backintime/pull/1897
🔗 Issue: https://github.com/bit-team/backintime/issues/1735

#backup #foss #opensource #debian #ubuntu #gocryptfs #encfs

Wow. All the big packages updating on my #Gentoo #Linux box. Been about 20 hours, 165 of 201 completed.

That's what I get for not updating for about 10 days.

Oh, and encfs is depreciated and going bye-bye. Luckily I have next weekend off and will have some time to switch all my local backups to #GoCryptFS.

I need to submit my workbook to the print shop for next #AdultESOL term.

#CyberSecurity class starts tomorrow.

International dinner at school in two weeks.

I'll sleep when I'm dead.

Just published a blog post about how I use gocryptfs to encrypt some sensitive files. https://gyorban.net/blog/how-to-encrypt-your-sensitive-files-with-gocryptfs/

#gocryptfs #encription #privacy #linux

#linuxhint - automatic opening of kde vaults on login
first step is to make your vault with #gocryptfs for example for ~/Documents. then create an entry in #kwallet by creating a password in your "Passwords"-group (create it too if not present) named "vaultpass" and enter the password you used for ~/Documents. then create a bash script and let it autostart:
gocryptfs --extpass="kwallet-query -f Passwords -r vaultpass kdewallet" [.enc folder] ~/Documents

have fun :)

https://github.com/rfjakob/gocryptfs/wiki/Mounting-on-login-with-KDE-Wallet

(24/N) There are some best practices that will make it easier to answer threat modeling question #3, "What are you going to do about it?". These will help you protect a wide range of assets by taking care of your devices, so let's look at them first:

1. Encrypt data at rest
2. Bootstrap your workplace
3. Actively maintain your devices
4. Secure your devices
5. Prepare for repair

1. Encrypt data at rest

What can you achieve with intermediate knowledge, without fully descending into the rat hole?

⚠️ Caveat: this is best done when setting up #Linux on a new device. Modifying an existing installation on your own IMHO isn't advisable if you're not a seasoned user. If you still decide to venture into it, make SURE you have backed up all your assets, before following "howtos on the internet". You have been warned.

Likening your device to a medieval city:

1) Full-Disk Encryption (FDE) is like locking the "city gate". Most popular Linux distributions offer FDE during the installation process. FDE is also your last line of defense when your device gets stolen, or your disk fails and cannot be safely wiped before disposing of it. Use FDE. (Yes, technically, "Full" is not absolutely accurate. We'll leave it at that.)

2) Within your "city", there will likely be at least two "houses": the home of the admin account, and your personal home. Using FDE alone, the "doors" of these homes won't have any locks of their own. Possibly not a big deal with respect to the administrative account, but admins being able to access any of your non-public assets, even when you're not logged in, is probably not what you want.

While the specific steps depend on your preferred Linux distro, a "portable" solution is to create a separate, encrypted disk partition, and have it mounted as your user home directory, when you log in. That solution is based on cryptsetup and the pam_mount module, a nice tutorial example is:

• Linux Mint: https://cobertos.com/blog/post/linux-mint-luks-encrypted-user-home-directory

3) Within your "house", you may wish to have a locked "chest", e.g. for your #FYEO assets. There's essentially two options: a) a single, encrypted container file that acts as a "#vault" for your asset files; or b) an encrypted overlay file system that maintains an openly visible directory hosting your encrypted assets, including directory structures, in the background; and allows you to mount a decrypted counterpart, for working on your assets.

a) A "vault", being a single file, is easy to copy and carry around, on arbitrary storage media, e.g. USB sticks. It doesn't reveal too much about its contents, but resizing it takes a little effort. Also, you can't "incrementally backup" content changes, just copy the whole, changed vault.

A nice tutorial for creating and using a vault using plain, standard cryptsetup is https://opensource.com/article/21/4/linux-encryption by @seth . If you must have a GUI for creating and mounting vaults, look at #zuluCrypt https://mhogomchungu.github.io/zuluCrypt/ – IMHO the app is still in need of a little polish, though.

b) An encrypted overlay file system allows for incrementally backing up changed assets, but exposes considerable metadata (rough file sizes, directory structures, modification dates).

The most widely used package for this is probably #gocryptfs. Its "HowTo" is literally a one-pager: https://nuetzlich.net/gocryptfs/quickstart/

Start of this thread:
https://mastodon.de/@tuxwise/113503228291818865

#ThreatModeling #4D

Do someone know how to open a Vault in #kde #plasma on login using the users login password?

#encrypt #gocryptfs

🔄 Back In Time seeking help to test its new #gocryptfs feature

🔗 https://github.com/bit-team/backintime/pull/1897

#floss #foss #OpenSource

Шифрование для облака: разные подходы

Облачные сервисы по-разному подходят к шифрованию данных на своём хостинге. В некоторых случаях это шифрование не удовлетворяет требованиям безопасности, поэтому приходится брать задачу в свои руки и шифровать файлы самостоятельно.

https://habr.com/ru/companies/ruvds/articles/846478/

#бэкапы #шифрование #Encryption_SDK #Database_Encryption_SDK #Secrets_Manager #Clean_Rooms #C3R #CloudHSM #KMS #HSM #DEK #KEK #multikeyring #restic #rsync #gocryptfs #cppcryptfs #DroidFS #gocryptfsinspect #Cryptomator #ruvds_статьи

#shufflecake est définitivement un des meilleurs logiciels du monde.

J'adorerais que #droidfs puisse le supporter pour le rendre disponible sur Android. Mais ça semble un peu compliqué à faire sans accès root étant donné qu'il fonctionne au niveau block-device et non au niveau file-system comme #gocryptfs ou #cryfs.

Neuer Artikel: Heute möchte ich euch mal das Verschlüsselungs-Tool #gocryptfs vorstellen. Damit können Verzeichnisse, welche z.B. per #Samba gemountet wurden, transparent verschlüsselt werden.
Ein praktisches Beispiel ist die Erweiterung einer #Nextcloud mit einem externen Speicher, der über gocryptfs verschlüsselt wird. Der Artikel beschreibt das Vorgehen in Verbindung mit einer #Hetzner #StorageBox: https://decatec.de/home-server/gocryptfs-verschluesselung-von-dateien-auf-einem-samba-cifs-share-am-beispiel-nextcloud-externer-speicher/

Verzeichnis verschlüsseln mit GoCryptFS

Ein einzelnes Verzeichnis mit GoCryptFS verschlüsseln, um private Daten zu verstecken.

#Verzeichnis #verschlüssen #Sicherheit #gocryptfs

https://gnulinux.ch/verzeichnis-verschluesseln-mit-gocryptfs

@macst3r Schöne Anleitung! Wer Java-Software vermeiden möchte, findet in #gocryptfs eine schlanke Alternative.

as final step to move all my data from 5-eyes servers, I need to keep encrypted data on #encfs, ou choose an alternative

it seems #gocryptfs is a spiritual successor of encfs, but also there is #cryfs

any thoughts on this matter?

my use is access encrypted data mainly on pc/laptop, but if it can been decrypted on smartphone (android) it could be cool (using #nextcloud to sync things)