Theses days, I've been looking for a way to have
crypto-containers in Debian. I wanted something easy to use,
easy to move but still quite secure, which wouldn't require root
access to the box, and as an option could use my gpg key.
I looked closely at two projects:
*
cryptsetup/luks
The nice thing is that you only have one file containing all your
crypted filesystem, it uses the Linux unified key management system
(luks), and you are able to use a gpg key to crypt the data. I
didn't tried it yet, because there are some drawbacks which I find
really important. It uses multiple commands for every operations
(creating the container, mounting and unmounting it).
For creating the crypto container you need to:
- create the file
- use it as a loop device (root access)
- initialize the container
- open the container
- create a filesystem on it
- mount it
Each time you want to mount it, you need to:
- create the loop device from the file
- open the container
- mount it
It surely can be wrapped, but that may be difficult to deploy. And
you need root access for all operations (you can mount/umount
without it using fstab, pmount or things like that, but still it's
using privilegied access). And the major drawback, I think, is that
the container size is fixed. You choose it when you create the
initial file which you'll mount as a loop device. I don't know if
there's a way to extend it after creating crypto-container, but
anyway it'll need to be manual.
*
encfs
encfs is fuse-based, so it doesn't require anything, beside fuse
support in the kernel and your user belonging to fuse group. No
need to root access nor anything. You create the container with
only one command, then mount or umount it with only one command
too. You can add and remove files from the container without asking
yourself about disk usage or something, because the container is
"expanded" (see after) when you add files, automatically.
There are two drawbacks in encfs, for me:
- crypto-container isn't a file, but a folder, with files and
folders using crypted filenames but real size. (more or less,
because you can use options to modify it but you won't hide a 20MB
file for example). It's less secure than a one-file
crypto-container where you can't determine how many files there are
in it (and with crypsetup/luks, you won't be able to determine how
much space is used in the container as the size is fixed anyway).
It's less easy to move around, put on an usb key or transmit. You
can tar it, yes, but you lose the comfort.
- you can't use a gpg key
In the end, I guess I'd like something like .dmg OSX Disk Images,
which can be encrypted. They are really easy to use, as far as I
could have seen. Maybe
not so
secure, but this is a bruteforce attack against master password
(1024 bits RSA key), not against 128bits aes key of the
container.
Anyway, I've setup an encfs folder here, but am still looking for
something wich would improve the situation.
Congratulations to Yves-Alexis Perez (Corsac), Nicolas Fran ois (Nekral) and Sune Vuorela (Pusling) too \o/
Finally, some accounts (~30 ?) were created and i’m in.
Thanks to all people involved in Debian and Kubuntu. In particular (no order) my co-maintainers, sponsors, helpers and application manager:
But you won't have it in your favorite distro. Not yet.
Not yet even if the packages are ready since more than a week
(thanks to unofficial release by Xfce team to have it tested by
packagers), and they only need the last checks before upload.
No, you won't have it today because this week, like the
previous, and the previous, and the previous:
0 applicants became maintainers.
Just. too. bad.
if you like to monitor the number of RC bugs, you are probably annoyed by the graph on 
Also, if you like graphs, Yves-Alexis Perez (aka Corsac) generates cool graphs about Debian:
