I want to host my own file share on a VPS, mounting it remotely from my mac and Linux desktop computers. I want the data to be encrypted on the server, and decrypted by the clients. I know SpiderOak does this, but I'm looking for something I can run myself, on my own server. Anything?
1
-
1What OS runs on the VPS (where the file system must be made available for your clients)? Any price margin if it comes to paid solutions? Would using "encrypted containers" on an unencrypted FS be an option (in which case encryption/decryption would be done client-side on the container)?– IzzyCommented Nov 24, 2016 at 10:52
Add a comment
|
1 Answer
A simple option is EncFS, a mature "fuse" (filesystem in user-space) package available in Linux. For MacOSX there is a version about which I know nothing but seems to be well-received.
It encrypts each file's contents and the filename, but keeps the same directory structure. To play with it on Linux it is as simple as installing package fuse-encfs or encfs, depending on your system, then you no longer need to be root and can run for example:
$ encfs ~/remotedir ~/localdir
You will be asked for a password then you can go right ahead and create files on ~/localdir, and they will appear encrypted in ~/remotedir, eg:
$ echo hi > ~/localdir/testfile
$ ls ~/remotedir/ -ltr
total 8
-rw-r--r-- 1 1078 Nov 24 14:45 .encfs6.xml
-rw-r--r-- 1 11 Nov 24 14:45 GTnypd2XouQmt2dwl8QMy6Pz
Obviously, in your case you would want to mount ~/remotedir via nfs or cifs or whatever on your remote server.
Here's the full simple default setup interaction:
$ encfs ~/remotedir ~/localdir
The directory "~/remotedir/" does not exist. Should it be created? (y,n) y
The directory "~/localdir" does not exist. Should it be created? (y,n) y
Creating new encrypted volume.
Please choose from one of the following options:
enter "x" for expert configuration mode,
enter "p" for pre-configured paranoia mode,
anything else, or an empty line will select standard mode.
?> (type return)
Standard configuration selected.
Configuration finished. The filesystem to be created has
the following properties:
Filesystem cipher: "ssl/aes", version 3:0:2
Filename encoding: "nameio/block", version 4:0:2
Key Size: 192 bits
Block Size: 1024 bytes
Each file contains 8 byte header with unique IV data.
Filenames encoded using IV chaining mode.
File holes passed through to ciphertext.
Now you will need to enter a password for your filesystem.
You will need to remember this password, as there is absolutely
no recovery mechanism. However, the password can be changed
later using encfsctl.
New Encfs Password: (some password)
Verify Encfs Password: (some password)
