Remote file system that's encrypted on the client side

Question

I want to host my own file share on a VPS, mounting it remotely from my mac and Linux desktop computers. I want the data to be encrypted on the server, and decrypted by the clients. I know SpiderOak does this, but I'm looking for something I can run myself, on my own server. Anything?

Answer 1

A simple option is EncFS, a mature "fuse" (filesystem in user-space) package available in Linux. For MacOSX there is a version about which I know nothing but seems to be well-received.

It encrypts each file's contents and the filename, but keeps the same directory structure. To play with it on Linux it is as simple as installing package fuse-encfs or encfs, depending on your system, then you no longer need to be root and can run for example:

$ encfs ~/remotedir ~/localdir

You will be asked for a password then you can go right ahead and create files on ~/localdir, and they will appear encrypted in ~/remotedir, eg:

$ echo hi > ~/localdir/testfile
$ ls ~/remotedir/ -ltr
total 8
-rw-r--r-- 1  1078 Nov 24 14:45 .encfs6.xml
-rw-r--r-- 1    11 Nov 24 14:45 GTnypd2XouQmt2dwl8QMy6Pz

Obviously, in your case you would want to mount ~/remotedir via nfs or cifs or whatever on your remote server.

Here's the full simple default setup interaction:

$ encfs ~/remotedir ~/localdir
The directory "~/remotedir/" does not exist. Should it be created? (y,n) y
The directory "~/localdir" does not exist. Should it be created? (y,n) y
Creating new encrypted volume.
Please choose from one of the following options:
 enter "x" for expert configuration mode,
 enter "p" for pre-configured paranoia mode,
 anything else, or an empty line will select standard mode.
?> (type return)
Standard configuration selected.
Configuration finished.  The filesystem to be created has
the following properties:
Filesystem cipher: "ssl/aes", version 3:0:2
Filename encoding: "nameio/block", version 4:0:2
Key Size: 192 bits
Block Size: 1024 bytes
Each file contains 8 byte header with unique IV data.
Filenames encoded using IV chaining mode.
File holes passed through to ciphertext.

Now you will need to enter a password for your filesystem.
You will need to remember this password, as there is absolutely
no recovery mechanism.  However, the password can be changed
later using encfsctl.

New Encfs Password: (some password)
Verify Encfs Password:  (some password)