encrypting a single directory?

[Spanik]

I have a couple of directories that I'd like to encrypt. Just some very personal stuff that I'd like to keep (and sometimes look through) for sentimental reasons. But things that I prefer not to be seen and read after I pop off.

Now most of the methods I find are for encryption of whole disks that then automatically decrypt when you log on. Which is not exactly what I want. I'd prefer something that needs a key whenever I want to access the directory (even to list the content). I prefer to encrypt single directories so I can keep my organisation scheme of documents: texts, photos, recordings... Also there is lots of materials on this pc that I want to be available to those after me. There are lots of family related documents and photos that I would like them to find.

If there are good ways to do this but only with a complete partition or disk then ok, so be it. Certainly if it is easier to set up and using software available in Gentoo.
_________________
Expert in non-working solutions

[pingtoo]

Spanik,

I don't know if such tool exist, but I have an idea that may help, If you create a single file then loop mount to where you usually access (possible setup automount too).

This way you only need to do one encryption. And it is possible to follow those that do whole disk encryption and possible to use some kind of file manager/browser tool to automate the viewing pleasure.

[pietinger]

Spanik,

I am using fscrypt ... it is encryption for directories and not for blocklevel ... this works not with every filesystem (look into the help in "make menuconfig" for fscrypt) ... I even made a german installation guide:
https://forums.gentoo.org/viewtopic-p-8629644.html#8629644

If you want directories other than your /home it is even easier, because you dont need the whole pam directions ... and of course you choose 2 instead 1 when you where asked:

[sMueggli]

There is the tool VeraCrypt where you can encrypt specific folders.

[eeckwrk99]

Tomb

[Goverp]

[Spanik]

Thanks for all the replies. Getting some feedback from experience is great. I'm going to read about those and if needed I'll come back with more questions.
_________________
Expert in non-working solutions

[Spanik]

Ok, so I read a bit about all the provided solutions and so far fscrypt came out the most in line with my wants/needs. Form what I understood, it just encrypts that what is needed, isn't an "hidden disk within a fixed size file", no other files needed, encryption moves with the file and is reasonably well integrated into the whole system. It might not be the most secure but then I'm not encrypting state secrets or illegal things. Just some embarasing writings and photos from my youth.

Only problem it doesn't work with xfs which is what I use throughout my pc (except /boot). So I'll have to put in another disk and move everything around a bit. I'm not looking forward having to go to ext for that. My previous experiences with ext3 (twice data loss) is what made me make switch to xfs which has been flawless for years now. So I'll loose the first safety net of raid as well as I'll move to a single disk and have another disk to back up.

You gain some, you loose some.
_________________
Expert in non-working solutions

[Zucca]

Isn't fscrypt just a fuse mount?
I mean you mount X directory to Y directory.
You put non-ecrypted files into Y directory and those same file appear encrypted on X directory.
That's all user-space. It shouldn't matter what's the fs type is under X directory.
What am I missing here? I too use XFS quite a lot and would like to use fscrypt too.

EDIT: fscrypt wasn't what I thought it was.
I was probably remembering EncFS.
_________________
..: Zucca :..

[Hu]

Considering Spanik's inability to use fscrypt due to lack of filesystem support, I will suggest use of a filesystem inside a LUKS container stored in a file on the host filesystem. It lacks the convenience of fscrypt, but it should be compatible with all host filesystems that can do loopback files.

[saturnalia0]

I've used two alternatives:

app-crypt/gnupg:

[szatox]

Saving a file on disk, then encrypting it, it's fine when mailing that file or something, but not for storing it securely, which looks like OP's objective, so gpg and similar tools are an inferior option.

I'd just use LUKS for that. If reorganizing the disk is not an option, backing it with a file instead of a device is. It is not the most convenient thing on Earth, but it's not too bad either, and it does actually work.
Once your directory of choice is protected, you only have to worry about leaking data via unencrypted $HOME, /tmp, SWAP, and other locations which may be used by programs operating on your sensitive files. Man, it's just easier to encrypt everything instead. But a luks vault in a file certainly is an option when FDE can't be used.
_________________
Make Computing Fun Again

[pietinger]

[pietinger]

[saturnalia0]

[szatox]

saturnalia0, creating and accessing individually encrypted files also takes additional work. Certainly much more than opening a container.
And editing individually encrypted files would deserve its own circle of hell.

That's aside of having plain-text copies of sensitive files, which must be deleted (and this is work too, which means user might suffer from fatigue / forget / get distracted / run out of time / fail for any other reason), and even deleted files still leave imprints on the underlying device which can be recovered until overwritten.
_________________
Make Computing Fun Again

[saturnalia0]

Well it can be done at the directory level, which is OP's scenario I think. ccrypt is in place and shred can be used otherwise.

[Spanik]

[szatox]

[Spanik]

[sabayonino]

Consider EncFS also.

I have my EncFS directory in ~/Vaults

and two aliases in my ~/.bashrc to lock/unlock it
The code check if Vaults folder is (already)-mounted or not.
Something like this :

[pietinger]

[sabayonino]

I used Vaults as example.

I wrote for EncFS . This differs from Vaults-KDE-encrypting tool
but it is very similar
_________________
LRS i586 on G.Drive
LRS x86-64 EFI on MEGA