[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Ecryptfs vs encfs

On Mon, Mar 21, 2011 at 08:51:27PM -0700, Todd A. Jacobs wrote:
> Generally, my advice is to use dm-crypt for block devices (like
> encrypting an entire /home partition that root plans to mount at
> bootup), and encfs for encrypting individual directories other than

I've been using the dm-crypt approach for a while, but the limitations of it
have encouraged me to plan a migration to ecryptfs.

 * If you mount via root/boot time, you must supply the passphrase at boot,
   which stops unattended/automated restarts or boot-ups.
 * as a user, you must supply at least two passphrases (dm-crypt, and login).

You can solve the latter by moving to login-time mounting via libpam-mount.
This generally works very well, but

 * fsck is totally invisible if you log in via an X display manager, so the
   occasional login will take 5-10 minutes longer than expected for a large
 * mounting is done serially, so if you have more than one encrypted
   filesystem (I have nearly a dozen, which is a mistake) login takes a long
   time very time

With ecryptfs,  I can have a file-level backup solution work on the backing
files, not require an active login or mounted FS, and do replication to other
nodes/sites without privacy concerns.

Jon Dowland

Reply to: