From ArchWiki
Revision as of 02:07, 9 December 2008 by Warriant (talk | contribs)
Jump to navigation Jump to search


In a lot of circumstances it makes sense to secure data on your computer using cryptographic tools. EncFS is a userspace cryptographic filesystem, and aims to secure your data with the minimum of hassle. It uses FUSE to mount an encrypted directory onto another directory specified by the user. It does not use a loopback system like some other comparable systems such as TrueCrypt and DM-Crypt.

This has a number of advantages, and some disadvantages compared to these systems. Firstly it does not require any root privileges to implement, any user can create a repository of encrypted files, and use them. Secondly you do not need to create a single file and create a filesystem within that, it works on your existing filesystem, with no modifications.

This does create a few disadvantages though, because the encrypted files are not stored in their own file, someone who obtains access to the machine can still see the underlying directory structure, the number of files, their sizes and when they were modified. They cannot see the contents though.

This particular method of securing your data is obviously not perfect, but it does have situations in which it is useful.


To install EncFS, as root, do:

# pacman -Sy encfs

You will need the community repository enabled to do this.


To create a secured repository, type:

$ encfs ~/.crypt ~/crypt

You will be prompted whether you want to go with the default (paranoid options) or expert configuration. The latter allows you to specify algorithms and other options. The former is a fairly good default though. You will also be prompted to set a key for encryption. Once this has been done you will have your encoded filesystem created and mounted. The encoded files are stored in ~/.crypt, and their unencrypted versions in ~/crypt.

To unmount the filesystem, type:

$ fusermount -u ~/crypt

And all will be done.

When you want to remount the filesystem, you simply retype the first command, and you will be asked for the key you used to encode with, once this has been entered, then the filesystem will be mounted again.