Managing Secrets with EncFS

EncFS is described by its project director as

EncFS provides an encrypted filesystem in user-space. It runs without any special permissions and uses the FUSE library and Linux kernel module to provide the filesystem interface.

Advantages

There are several advantages to the EncFS way of encrypting secrets, in my mind.

1. As a FUSE filesystem, it does not require root privileges to mount/unmount filesystems, it is all done in userspace.
2. FUSE filesystems, because they exist in memory, are not accessible even to root. (Of course, is your root account is compromised, you have bigger issues.)
3. It's an open-source project for Linux.

To elaborate on the last point: the value of open-source is clear, but why specify Linux? Here's my feeling: When I want to save secrets, I don't want to use a system available on 99% of personal computing devices. If I wanted to communicate in private, then I would obviously make another choice.

Installation

In a Debian-based Linux system, you can install EncFS by

sudo (apt-get update && apt-get install encfs)

Examples

Create a new Vault

We can create a new vault as follows

cd
mkdir --mode=0700 vault
mkdir --mode=0700 .vault
encfs ~/.vault ~/vault

At this point you will be prompted for some configuration information (I choose paranoid—we are talking about keeping secrets) and a passphrase. Remember that without this passphrase, the contents of your vault are gibberish; and if it is too weak, the contents are not secure.

The hidden directory .vault will contain the encrypted contents of the un-encrypted directory vault.

Add contents to Vault

This is as simple as copying a file to vault:

cp my-secrets.txt vault/.

Unmounting the Vault

To unmount your vault, use the fusermount command:

fusermount -u ~/vault

If you check, you will see that vault is empty now, and .vault is full of files with gibberish names—containing your secret data.

Mounting the Vault

Hold your breath: do you remember your passphrase? Ok, then do

encfs ~/.vault ~/vault

to remount your vault. Easy peasy.

Why are these icons here?