Encrypting files and folders with EncFS
Protected
![© Lead Images © Steve Byland & Mark Dietrich, 123RF.com © Lead Images © Steve Byland & Mark Dietrich, 123RF.com](/var/linux_magazin/storage/images/issues/2014/161/encfs/po-21607-123rf-steve_byland_123rf-schloss_resized.png/611416-1-eng-US/PO-21607-123RF-Steve_Byland_123RF-Schloss_resized.png_medium.png)
The EncFS virtual filesystem reduces the configuration overhead for data encryption on Linux.
Encryption is an important precaution that is nonetheless neglected by many users. EncFS offers a simple yet secure method for protecting data against unauthorized access with minimal configuration overhead.
Encryption is like backup: Everyone knows it is important, but any excuse will do not to set it up (yet). EncFS puts an end to excuses: With just one command, a non-root user can set up a directory that stores transparently encrypted data.
EncFS, which is released under the GPL, has been around for 10 years, and it is available for download from the repositories of all the popular distributions. As the name suggests, EncFS [1] is a filesystem – but not in the traditional sense that ext4 or XFS, are filesystems.
To be more precise, EncFS is a virtual encrypted filesystem that protects files and folders from unauthorized access. As a virtual filesystem, EncFS resides on an existing filesystem and relies on the FUSE (Filesystem in Userspace) kernel module [2] as a user process. These properties offer a number of advantages over other filesystems but also entail some disadvantages.
Benefits
Because EncFS relies on other filesystems to store data, it simply uses whatever you have in place, with no need to configure a particular partition or container for encrypted data [3]. As a result, no space is wasted. EncFS requires only a few bytes for metadata and encryption purposes.
EncFS does not care where data resides. Supported filesystems include ext3/4, NFS, and Samba, so you can also use EncFS in connection with cloud services such as Dropbox, if you wish. And, a backup of EncFS-encrypted data works without additional configuration or special backup software. Because the encrypted data is just a file or a directory on the system, it can be treated just like its unencrypted counterpart in your backup. At the same time, the backed up data is protected against unauthorized access.
From the developer's perspective, a filesystem in userspace is also interesting, in that it is easier to set up than a kernel module, for example.
Additionally, if errors occur in the software, a crash does not take down the whole system. (See the "eCryptfs Alternative" box for a kernel space implementation.)
eCryptfs Alternative
eCryptfs [4] provides a very similar method to EncFS for encrypting data. The main difference is its implementation in kernel space: eCryptfs thus does not rely on FUSE and potentially works a little faster. Of course, this impairs portability; whereas EncFS is available for Mac OS X and Windows, eCryptfs is currently mainly limited to Linux.
Setting up eCryptfs is just as easy as setting up EncFS on most distributions. Make sure the ecryptfs
kernel module is loaded and the ecryptfs-utils
package is installed. To set up an encrypted folder, use the command-line program ecryptfs-setup-private
. You can also encrypt your complete home directory if needed with eCryptfs.
Additional utilities that convert existing unencrypted directories make it easy to get started with eCryptfs. Users of Ubuntu can stipulate during the install whether to encrypt their home directories fully with eCryptfs.
Drawbacks
The many benefits of EncFS are offset by some disadvantages, however. For one thing, a filesystem in userspace is usually slower than a kernel module.
Additionally, EncFS does not encrypt the file metadata, so everyone who has access can see the metadata. The corresponding data includes, for example, the number of encrypted files and directories, the associated file permissions, the size of the files, and the approximate length of the file or directory name.
Encrypted Folders
To create a folder named Data-Safe
in your home directory, in which you can save arbitrary files and directories, just type the command:
$ encfs ~/.Data-Safe ~/Data-Safe
Any data you store in ~/Data-Safe
is encrypted transparently by the software and deposited in a hidden directory named .Data-Safe
,
EncFS runs in interactive mode when creating the encrypted directory (Figure 1). Depending on your personal security needs, you can choose at this point between standard mode, paranoia mode, or expert configuration mode.
![](/var/linux_magazin/storage/images/issues/2014/161/encfs/figure-1/611419-1-eng-US/Figure-1_large.png)
In expert mode, you can configure many additional settings, such as the algorithm to be used or the key and block length. If you select the default configuration, EncFS outputs the selected settings and prompts you for a password for the newly created directory (see Figure 2).
![](/var/linux_magazin/storage/images/issues/2014/161/encfs/figure-2/611422-1-eng-US/Figure-2_large.png)
Caution: Choosing paranoia mode or enabling certain settings in expert configuration mode means you can no longer use hard links. As a result, applications that use hard links might not work properly. One example of this is the console-based mail client, Mutt.
EncFS does not just encrypt the data but also renames files and directories so that the resulting cryptic names allow no conclusions on the content of the files:
$ ls ~/.Data-Safe/ iyZS5h8HEbjyUjRGJqTHxBOrsAoE9,o8nOKSayDFyagPoEBl
To mount the data safe, you use the same command as for setting it up initially. To unmount it again, type:
$ fusermount -u ~/Data-Safe/
The encfsctl
command-line program lets you handle administrative tasks. Among other things, you can output information about an EncFS-encrypted folder or change the password. Such a password change does not mean EncFS encrypts all the data again in a resource-intensive process: EncFS does not use the password as the key during the initial setup. Instead, it generates a volume key. You only encrypt the volume key by entering your password. EncFS encrypts all the other data with the volume key, which does not change even with a new password.
Buy this article as PDF
(incl. VAT)
Buy Linux Magazine
Subscribe to our Linux Newsletters
Find Linux and Open Source Jobs
Subscribe to our ADMIN Newsletters
Support Our Work
Linux Magazine content is made possible with support from readers like you. Please consider contributing when you’ve found an article to be beneficial.
![Learn More](https://www.linux-magazine.com/var/linux_magazin/storage/images/media/linux-magazine-eng-us/images/misc/learn-more/834592-1-eng-US/Learn-More_medium.png)
News
-
NVIDIA Released Driver for Upcoming NVIDIA 560 GPU for Linux
Not only has NVIDIA released the driver for its upcoming CPU series, it's the first release that defaults to using open-source GPU kernel modules.
-
OpenMandriva Lx 24.07 Released
If you’re into rolling release Linux distributions, OpenMandriva ROME has a new snapshot with a new kernel.
-
Kernel 6.10 Available for General Usage
Linus Torvalds has released the 6.10 kernel and it includes significant performance increases for Intel Core hybrid systems and more.
-
TUXEDO Computers Releases InfinityBook Pro 14 Gen9 Laptop
Sporting either AMD or Intel CPUs, the TUXEDO InfinityBook Pro 14 is an extremely compact, lightweight, sturdy powerhouse.
-
Google Extends Support for Linux Kernels Used for Android
Because the LTS Linux kernel releases are so important to Android, Google has decided to extend the support period beyond that offered by the kernel development team.
-
Linux Mint 22 Stable Delayed
If you're anxious about getting your hands on the stable release of Linux Mint 22, it looks as if you're going to have to wait a bit longer.
-
Nitrux 3.5.1 Available for Install
The latest version of the immutable, systemd-free distribution includes an updated kernel and NVIDIA driver.
-
Debian 12.6 Released with Plenty of Bug Fixes and Updates
The sixth update to Debian "Bookworm" is all about security mitigations and making adjustments for some "serious problems."
-
Canonical Offers 12-Year LTS for Open Source Docker Images
Canonical is expanding its LTS offering to reach beyond the DEB packages with a new distro-less Docker image.
-
Plasma Desktop 6.1 Released with Several Enhancements
If you're a fan of Plasma Desktop, you should be excited about this new point release.