Differences between revisions 22 and 23
Revision 22 as of 2017-08-18 01:19:50
Size: 25032
Editor: ?Felix Lechner
Comment: Add caution box about Gocryptfs, which is a much better option nowadays.
Revision 23 as of 2017-12-11 22:14:35
Size: 1385
Editor: AriPollak
Comment: Remove obsolete EncFS section
Deletions are marked like this. Additions are marked like this.
Line 5: Line 5:
= Transparent Encryption For the User's Home Folder =

{{{#!wiki caution
'''Check out a new alternative'''

Before you proceed, please check out DebianPkg:gocryptfs.
It is comparable to DebianPkg:encfs, but
offers better encryption at similar speeds. (It also works great
over NFSv4.) You can use regular
DebianPkg:libpam-mount to make your home folder available at login.
}}}
= Transparent Encryption For a User's Home Folder =
Line 19: Line 9:
== Assisted configuration ==

=
== Requirements ===
== Requirements ==
Line 34: Line 22:
=== Assisted  Encrypted Home Directory === == Assisted Encrypted Home Directory ==
Line 51: Line 39:
=== Assisted Encrypted Swap Partition === == Assisted Encrypted Swap Partition ==
Line 58: Line 46:
== Manual configuration ==

=== Introduction ===
The following steps have been completed on a fresh Debian Squeeze install to allow users on a desktop to encrypt their Home directory.
Many organisations are requesting users to encrypt their laptop to protect confidential information (customer names, internal contact details, etc.). On many Windows systems this is problematic and intrusive. This page is meant to help Debian users in configuring their systems to encrypt/decrypt their Home folder auto-magically using [[WikiPedia:EncFS|EncFS]].


=== Install Debian Squeeze ===
The steps described in this page are based on a "Debian Live CD GNOME Desktop", but any installation media should do. For more details on installing Debian, go to the [[http://www.debian.org/releases/stable/installmanual|Debian website]].

==== Dummy User Account ====
When setting up the first user (during the installation process), I suggest you create a dummy account (e.g. "Dummy User"). This will allow the configuration to be completed for the 'real' user.

==== Disk Setup ====
For the disk setup, choose "Guided - use entire disk" or "Guided - use entire disk and setup LVM". We are NOT setting up encryption using the Debian installer method.

The recommendation is to select "All files in one partition" and accept the defaults.

When the installation is complete, log in with the dummy user created during the installation. This user will be able to get root privileges for the rest of the process.

After installing Debian always make sure your system is up to date so run the following:{{{
aptitude update ; aptitude safe-upgrade
}}}

==== Encrypted swap and /tmp ====

While encryption of the home directory using this method will stop a random casual snooper from reading your files, a slightly more determined person might look in the swap space or for random files of interest in /tmp. For this reason, you may wish to set up the swap partition and/or the /tmp directory as encrypted filesystems. To do this, you will want to assign /tmp to its own partition and set up encryption for both. See the installation guide for more details.

=== Setup Encrypted Home Directories ===

Move the dummy user to a directory which is not managed by encfs (i.e. not under /home)
{{{
mkdir -p /home.original/
cp -a /home/<username> /home.original/
}}}
Edit `/etc/passwd` so the dummy user's home directory path is setup correctly (e.g. /home.original/<username>)

Then logout and login. Remove the dummy user's old home directory:
{{{
rm -rf /home/<username>
}}}

On an up to date Debian system, install the DebianPkg:encfs, DebianPkg:libpam-encfs, and DebianPkg:libpam-mount packages:
{{{
aptitude install encfs libpam-encfs libpam-mount
}}}

==== Edit the Configuration Files ====
I have pasted the contents of my configuration files as the order of the various entries inside the files is important and, when I set this up, the articles I referred to only had the file additions.

===== /etc/security/pam_encfs.conf =====
##TAG:PAM_ENCFS_START
{{{
#Note that I dont support spaces in params
#So if your for example gonna specify idle time use --idle=X not -i X.

#If this is specified, program will attempt to drop permissions before running encfs.
# (will not work with --public for example)
drop_permissions

#This specifies the default encfs options
#encfs_default --idle=1
encfs_default

#Same for fuse, note that allow_root (or allow_other, or --public in encfs) is needed to run gdm/X.
fuse_default allow_root,nonempty

#- means match all, put any overrides over it.
#if - is in username it will take source path + "/$USER", and mount to $HOME

#USERNAME SOURCE TARGET PATH ENCFS Options FUSE Options
#user /home/.enc/user /home/user -v,--idle=1,-test,-test2 allow_root
#- /home/.enc - -v allow_other
#- /home/.enc - -v allow_root
- /home/.encfs - -v -
}}}
##TAG:PAM_ENCFS_END

===== /etc/security/pam_env.conf =====
This change is required to remove the annoying message "Cannot update ICEauthority /home/(user)/.ICEauthority. The last line of this example contains the change.
##TAG:PAM_ENV_START
{{{
#
# This is the configuration file for pam_env, a PAM module to load in
# a configurable list of environment variables for a
#
# The original idea for this came from Andrew G. Morgan ...
#<quote>
# Mmm. Perhaps you might like to write a pam_env module that reads a
# default environment from a file? I can see that as REALLY
# useful... Note it would be an "auth" module that returns PAM_IGNORE
# for the auth part and sets the environment returning PAM_SUCCESS in
# the setcred function...
#</quote>
#
# What I wanted was the REMOTEHOST variable set, purely for selfish
# reasons, and AGM didn't want it added to the SimpleApps login
# program (which is where I added the patch). So, my first concern is
# that variable, from there there are numerous others that might/would
# be useful to be set: NNTPSERVER, LESS, PATH, PAGER, MANPAGER .....
#
# Of course, these are a different kind of variable than REMOTEHOST in
# that they are things that are likely to be configured by
# administrators rather than set by logging in, how to treat them both
# in the same config file?
#
# Here is my idea:
#
# Each line starts with the variable name, there are then two possible
# options for each variable DEFAULT and OVERRIDE.
# DEFAULT allows and administrator to set the value of the
# variable to some default value, if none is supplied then the empty
# string is assumed. The OVERRIDE option tells pam_env that it should
# enter in its value (overriding the default value) if there is one
# to use. OVERRIDE is not used, "" is assumed and no override will be
# done.
#
# VARIABLE [DEFAULT=[value]] [OVERRIDE=[value]]
#
# (Possibly non-existent) environment variables may be used in values
# using the ${string} syntax and (possibly non-existent) PAM_ITEMs may
# be used in values using the @{string} syntax. Both the $ and @
# characters can be backslash escaped to be used as literal values
# values can be delimited with "", escaped " not supported.
# Note that many environment variables that you would like to use
# may not be set by the time the module is called.
# For example, HOME is used below several times, but
# many PAM applications don't make it available by the time you need it.
#
#
# First, some special variables
#
# Set the REMOTEHOST variable for any hosts that are remote, default
# to "localhost" rather than not being set at all
#REMOTEHOST DEFAULT=localhost OVERRIDE=@{PAM_RHOST}
#
# Set the DISPLAY variable if it seems reasonable
#DISPLAY DEFAULT=${REMOTEHOST}:0.0 OVERRIDE=${DISPLAY}
#
#
# Now some simple variables
#
#PAGER DEFAULT=less
#MANPAGER DEFAULT=less
#LESS DEFAULT="M q e h15 z23 b80"
#NNTPSERVER DEFAULT=localhost
#PATH DEFAULT=${HOME}/bin:/usr/local/bin:/bin\
#:/usr/bin:/usr/local/bin/X11:/usr/bin/X11
#
# silly examples of escaped variables, just to show how they work.
#
#DOLLAR DEFAULT=\$
#DOLLARDOLLAR DEFAULT= OVERRIDE=\$${DOLLAR}
#DOLLARPLUS DEFAULT=\${REMOTEHOST}${REMOTEHOST}
#ATSIGN DEFAULT="" OVERRIDE=\@
#
# set the ICEAUTHORITY file location to allow GNOME to start on encfs $HOME
ICEAUTHORITY DEFAULT=/tmp/.ICEauthority_@{PAM_USER}
}}}
##TAG:PAM_ENV_END

===== /etc/fuse.conf =====
##TAG:FUSE_START
{{{
# Set the maximum number of FUSE mounts allowed to non-root users.
# The default is 1000.
#
#mount_max = 1000

# Allow non-root users to specify the 'allow_other' or 'allow_root'
# mount options.
#
#user_allow_other
user_allow_other
}}}
##TAG:FUSE_END

===== /etc/pam.d/common-session =====
##TAG:PAM_COMMONSESSION_START
{{{
#
# /etc/pam.d/common-session - session-related modules common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of modules that define tasks to be performed
# at the start and end of sessions of *any* kind (both interactive and
# non-interactive).
#
# As of pam 1.0.1-6, this file is managed by pam-auth-update by default.
# To take advantage of this, it is recommended that you configure any
# local modules either before or after the default block, and use
# pam-auth-update to manage selection of other modules. See
# pam-auth-update(8) for details.

# here are the per-package modules (the "Primary" block)
session [default=1] pam_permit.so
# here's the fallback if no module succeeds
session requisite pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
session required pam_permit.so
# and here are more per-package modules (the "Additional" block)
session required pam_encfs.so
session required pam_unix.so
session optional pam_mount.so
session optional pam_ck_connector.so nox11
# end of pam-auth-update config
}}}
##TAG:PAM_COMMONSESSION_END

===== /etc/pam.d/common-auth =====
##TAG:PAM_COMMONAUTH_START
{{{
#
# /etc/pam.d/common-auth - authentication settings common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of the authentication modules that define
# the central authentication scheme for use on the system
# (e.g., /etc/shadow, LDAP, Kerberos, etc.). The default is to use the
# traditional Unix authentication mechanisms.
#
# As of pam 1.0.1-6, this file is managed by pam-auth-update by default.
# To take advantage of this, it is recommended that you configure any
# local modules either before or after the default block, and use
# pam-auth-update to manage selection of other modules. See
# pam-auth-update(8) for details.

auth sufficient pam_encfs.so
auth [success=1 default=ignore] pam_unix.so use_first_pass nullok_secure
#auth required pam_unix.so use_first_pass nullok_secure
#auth required pam_unix.so nullok_secure use_first_pass
# here are the per-package modules (the "Primary" block)
#auth [success=1 default=ignore] pam_unix.so nullok_secure
# here's the fallback if no module succeeds
auth requisite pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
auth required pam_permit.so
# and here are more per-package modules (the "Additional" block)
auth optional pam_mount.so
# end of pam-auth-update config
}}}
##TAG:PAM_COMMONAUTH_END

==== Create the Encrypted Home Directory ====

The configuration will setup encfs for a new "real" user.

Now create your "real" user and ensure they're added to the fuse group.
{{{
adduser <username>
usermod -aG fuse <username>
}}}

Move their home directory/files out of the way:
{{{
mv /home/<username> /var/backups/<username_home>
mkdir -p /home/.encfs/<username> /home/<username>
chown <username>:<username> /home/.encfs/<username> /home/<username>
}}}

Create the encrypted directory (If you encounter problems with permissions, see the [[#permissions|Section on permissions]]):
{{{
encfs -v /home/.encfs/<username> /home/<username>
}}}

Accept the default options, or tinker with the encryption settings. Paranoia mode works, but won't support hard links. The author has used paranoia mode successfully.

{i} SET THE PASSWORD TO BE THE SAME AS YOUR LOGIN PASSWORD

Check that encrypted filesystem is mounted correctly:
{{{
mount
}}}
This should output something like the following:
{{{
encfs on /home/<username> type fuse.encfs (rw,nosuid,nodev,default_permissions)
}}}

Move the home directory/files back:
{{{
mv /var/backups/<username_home>/* /home/<username>/
mv /var/backups/<username_home>/.[A-Za-z0-9]* /home/<username>/
rmdir /var/backups/<username_home>
}}}

If there are any files which have been overlooked, the final `rmdir` will complain that the directory is non-empty. In such a case, `ls -a /var/backups/<username_home>` will identify these files.

==== Reboot ====
You will need to reboot to reload all the PAM libraries, etc.

Now you can test if it all works with your 'real' user. If you have a problem, then you may need to login as the dummy user to resolve any issues. If everything works as expected, then simply comment out the dummy user from the password file and the shadow password file.

To prove you are encrypting writes to your home directory, create a junk file in your home directory and see if there is a corresponding file in the encrypted home directory. Get the time stamp for the file, and check for files/directories created in the encrypted home directory (e.g. `/home/.encfs/<username>`).
{{{
cp /etc/passwd $HOME/.
ls -l /home/<username>/passwd
ls -ltra /home/.encfs/<username>
}}}

===== Potential issues =====

If things go wrong here you can be stuck with a system you cannot log in. You must test it before doing anything else. First, check you can run `encfs /home/.encfs/<username> /home/<username>` as a normal user (not sudo), as well as `/bin/fusermount -u /home/<username>`. If you can, use Ctrl-Alt-F2 to change to another virtual terminal and see if you can log in without any problems (make sure you're in the encrypted home directory!). Use Ctrl-Alt-F7 to go back to Gnome and test it from there.

If you're extra-paranoid, consider adding another user and make a test with that user first (you'll have to manually add him/her to the admin and fuse groups).

OK, now, if you're sure it all works, you can reboot. If it does, log in and delete your <username>.original directory.

==== Backup the encfs header data ====

It is very worthwhile backing up the encfs header data, which is found in `/home/.encfs/<username>/.encfs6.xml`; if this is lost or corrupted, you will not be able to access any of your data. Likewise, if you backup the encrypted files, this header file will allow you to decrypt them if necessary (along with the passphrase).

<<Anchor(permissions)>>
=== Permissions ===

If you get problems with permission, you might want to check these things:
   * Can you read /etc/fuse.conf without sudo? If not, then run "sudo chgrp fuse /etc/fuse.conf"
   * Can you run fusermount (or /bin/fusermount) as a normal user? You should test this before logging off by running encfs to mount your encrypted home directory manually. If not, run `sudo chgrp fuse /bin/fusermount` and `sudo chmod 4750 /bin/fusermount`

ref: http://wiki.geteasypeasy.com/Transparent_Encryption_for_home_folder

=== Changing the User's Password ===
The encrypted filesystems password and the user's password are synchronised. Therefore to change the user's password, it's necessary to change their personal password with the `passwd` command:
{{{
passwd
}}}
And change the encrypted volume's password to match:
{{{
encfsctl passwd /home/.encfs/<username>
}}}

==== Password Utility ====
There are some significant challenges in automating this process as the user must be able to change their own password, this requires the passwd utility to be used (as it's the only suid binary). However, it's possible to overcome this issue with the use of an expect script. Therefore install the DebianPkg:expect package:
{{{
aptitude install expect
}}}

Then copy the following code to `/usr/local/bin/passwd`. The normal Debian user's PATH is set to execute this passwd utility before the system one in `/usr/bin`.
##TAG:PASSWD_UTILITY_START
{{{#!highlight text
#!/usr/bin/expect -f
#
# What: /usr/local/bin/passwd
# When: 6/Mar/2012
# Who: Philip Jensen (partially generated by autoexpect - refer expect-dev)
# Why: To keep a user's password in sync with their encfs password
# which needs to be unlocked when the user logs in.

set force_conservative 0 ;# set to 1 to force conservative mode even if
                          ;# script wasn't run conservatively originally
if {$force_conservative} {
        set send_slow {1 .1}
        proc send {ignore arg} {
                sleep .1
                exp_send -s -- $arg
        }
}

# Tell the user they aren't using the real passwd utility.
puts "###############################################################"
puts "# #"
puts "# This 'passwd' utility overrides the original. #"
puts "# #"
puts "# It is used to change the user's UNIX password #"
puts "# as well as their encrypted file system password. #"
puts "# #"
puts "# The original password changing utility is /usr/bin/passwd #"
puts "# #"
puts "###############################################################"

# Who is the user we are changing the password for.
# (actually this is needed for encfsctl - see below)
set user [exec whoami]
puts "\nChanging password for $user. If this is incorrect press Ctrl + C\r"

# Get the user's current password.
send_user "\nCurrent password: "
stty -echo
expect_user -re "(.*)\n"
set curr_password $expect_out(1,string)
stty echo

# Get their new password
send_user "\nNew password: "
stty -echo
expect_user -re "(.*)\n"
set new_password_one $expect_out(1,string)
stty echo
send_user "\nRe-enter new password: "
stty -echo
expect_user -re "(.*)\n"
set new_password_two $expect_out(1,string)
stty echo
puts "\n"

# Do the *NEW* passwords match?
if {$new_password_one!=$new_password_two} {
        puts "Passwords don't match, exiting!\n"
        exit 2
} else {
        set new_password "$new_password_one"
}

# Debug output
#puts "Changing password from: $curr_password\nto: $new_password\n"

# Hide output from the screen (operate in silent mode).
# Of course this may not hide any potential output from the command line.
# Beware of background process watchers.
log_user 0

set timeout -1
spawn /bin/sh
match_max 100000

# begin changing passwords
puts "\nChanging user's password."

send -- "/usr/bin/passwd\r"
expect -exact "/usr/bin/passwd\r
Changing password for $user.\r
(current) UNIX password: "
send -- "$curr_password\r"
# we need to handle the user entering an incorrect current password.
expect {
        "Authentication token manipulation error" {puts "Current User password incorrect!" ; exit }
        "Enter new UNIX password: " { send -- "$new_password\r" }
}

expect -exact "Retype new UNIX password: " { send -- "$new_password\r" }
expect -exact "\r
passwd: password updated successfully\r"
send_user "User password changed successfully."

# If we get this far, changing the user's password succeeded,
# therefore we can proceed to change the encfs password.
puts "\nChanging encfs password."
expect -exact "\$ "
send -- "/usr/bin/encfsctl passwd /home/.encfs/$user\r"
expect -exact "\r
Enter current Encfs password\r
EncFS Password: "
send -- "$curr_password\r"

# what if the current encfs password didn't match the current user's password
# Of course now we have a very BIG problem as the transparent login won't work.
# But if they've used this utility, then they should be fine. ;-)
expect {
        "Invalid password\r" { puts "Current encfs password incorrect!" ; exit }
        "New Encfs Password: " { send -- "$new_password\r" }
}
expect -exact "\r
Verify Encfs Password: "
send -- "$new_password\r"
expect -exact "\r
Volume Key successfully updated.\r
\$ "
puts "Password change complete!"
send -- "exit\r"
expect eof
}}}
##TAG:PASSWD_UTILITY_END

=== An alternative setup: mounting home directories at boot time ===

On my system (jdg), I wanted a system where the home directories would be unencrypted at boot time rather than login time; in this way, the normal UNIX permissions would apply to the home directories from shortly after boot. This method of encryption means that the data is encrypted on disk and accessible to anyone who has access to the running machine.

To do this, I created the encfs in the same way as above, but now the encryption password can be entirely different from the login password, as the two are not connected. (Do remember to backup the encfs header data, of course!) In fact, the system administrator does not even need to know the user's password. Do not edit any of the configuration files listed above, as we will not be using PAM to decrypt the home directory, and the two methods are incompatible.

Instead, create the following script, and save it as `/etc/init.d/mountencfs.sh`:
##TAG:MOUNTENCFS_SH_START
{{{
#! /bin/sh
### BEGIN INIT INFO
# Provides: mountencfs
# Required-Start: mountall
# Required-Stop:
# Default-Start: S
# Default-Stop:
# X-Interactive: true
# Short-Description: Mount encfs filesystems.
# Description:
### END INIT INFO

# Based on mountall.sh

PATH=/usr/sbin:/usr/bin:/sbin:/bin

. /lib/lsb/init-functions

# to get messages in correct locale
if [ -r /etc/default/locale ]; then
 . /etc/default/locale
 export LANG
fi

mount_encfs() {
 edir="$1"
 pdir="$2"
 count=1

 # Occasionally, there is some junk left over, even though
 # there shouldn't be. We need to zap any existing content.
 if [ -d "$pdir" ]
 then
  if ! rmdir "$pdir" 2>/dev/null
  then
   echo "Directory $pdir not empty; first 20 lines of directory listing:"
   ls -alR "$pdir" | head -20
   echo -n "Shall I wipe the directory to mount the encfs? [THIS ACTION CANNOT BE UNDONE] (y/n) "
   read response
   case "$response" in
       [yY]*)
    rm -rf "$pdir"
    ;;
       *) return 1
    ;;
   esac
  fi
 fi

 mkdir "$pdir"

 while [ $count -le 3 ]
 do
  if ! encfs --public "$edir" "$pdir"
  then
      count=$(($count + 1))
  else
      return 0
  fi
 done
 return 1
}

do_start() {
 #
 # Look for encrypted home directories
 #
 for encdir in /home/.encfs/*
 do
  dir="/home/${encdir#/home/.encfs/}"
  if [ "$VERBOSE" = no ]
  then
   log_action_begin_msg "Mounting encrypted local filesystem: $dir"
   if mount_encfs "$encdir" "$dir"
   then
    log_action_end_msg 0
   else
    log_failure_msg "Could not successfully mount encrypted local filesystem: $dir"
   fi
  else
   log_daemon_msg "Will now mount encrypted local filesystem: $dir"
   if mount_encfs "$encdir" "$dir"
   then
    log_end_msg 0
   else
    log_failure_msg "Could not successfully mount encrypted local filesystem: $dir"
   fi
  fi
 done
}

case "$1" in
  start|"")
 do_start
 ;;
  restart|reload|force-reload)
 echo "Error: argument '$1' not supported" >&2
 exit 3
 ;;
  stop)
 # No-op
 ;;
  *)
 echo "Usage: mountencfs.sh [start|stop]" >&2
 exit 3
 ;;
esac

:
}}}
##TAG:MOUNTENCFS_SH_END
Activate the script by running
{{{
update-rc.d mountencfs.sh defaults
}}}
Then the encfs password will be requested during the boot sequence.

Translation(s): English - Italiano


Transparent Encryption For a User's Home Folder

Requirements

First install the package ecryptfs-utils:

sudo apt-get install ecryptfs-utils

Then load the ecryptfs kernel module:

sudo modprobe ecryptfs

And make it permanent in /etc/modules-load.d/modules.conf.

Assisted Encrypted Home Directory

The user whose home directory you want to encrypt MUST NOT be logged in. For example, you can be logged as root in a tty.

Then run as root:

ecryptfs-migrate-home -u <username>

When this is done the user must login BEFORE rebooting the computer.

If the user can access the files in the users home directory you can remove the backup folder in /home/<username>.<random characters>

The user should also run this command to get the random encryption key and store it in a secure location (outside the encrypted home directory and not on the same machine) in case a recovery is needed:

ecryptfs-unwrap-passphrase

Assisted Encrypted Swap Partition

To encrypt the swap partition too:

sudo apt-get install cryptsetup
sudo ecryptfs-setup-swap


CategoryDesktop CategoryQuickIntroduction