Video summary
This video tutorial demonstrates how to create and manage an encrypted folder on a Linux system using the gocryptfs application. The presenter introduces gocryptfs as a reliable tool written in Go that allows users to encrypt directories without needing to be an encryption expert. The process begins by installing the software via the system's package manager, such as aptitude on Debian-based systems, and setting up two distinct directories: one to hold the encrypted data and another to serve as the mount point for decrypted access. Once installed, the user initializes the encryption by pointing the tool at these folders and establishing a password, which generates a unique master key essential for recovery if the password is forgotten.
The core functionality involves mounting the encrypted directory to make its contents accessible in plain text within the designated decrypted folder. The presenter illustrates this by creating test files inside the mounted view, showing that while the files appear normal to the user, they are actually stored as binary data with encrypted filenames in the source directory. To safely stop access, the video explains how to unmount the drive using standard Linux commands like `fusermount -u`, which ensures the decrypted files disappear from the mount point and revert to their unreadable, encrypted state. This cycle of mounting and unmounting highlights the practical utility of keeping sensitive data secure when not in active use.
A significant portion of the guide is dedicated to security best practices and recovery scenarios, specifically focusing on the master key. The presenter emphasizes that this key should be saved securely outside of terminal history to prevent unauthorized access if someone gains shell access. If a user forgets their password, they can still decrypt their data by providing the saved master key directly via standard input using the `-m` flag, ensuring the key never appears in command history. Additionally, the tutorial covers how to change the encryption password while retaining access to the old data; this is done by providing the master key and setting a new password, which automatically creates a backup of the old configuration file for emergency restoration if the new password is lost or incorrect.
In conclusion, the video provides a straightforward method for securing personal files on Linux using gocryptfs, balancing ease of use with robust security features. The presenter notes that while a graphical user interface exists for this tool, the command-line approach offers sufficient control for most users and avoids unnecessary complexity. Viewers are encouraged to explore further resources on the project's GitHub page for performance benchmarks and additional documentation. By following these steps, users can effectively encrypt their folders, manage access through mounting, recover data with a master key, and update passwords without losing their encrypted information.
Read the full video transcript
Hello and welcome to a video from
filmsbychris.com. That's Chris with a K,
I'm Chris with a K. Today we're going to
be looking at creating a encrypted
directory or folder on your system. Uh
so we're going to use an anytime I do
anything on encryption everyone's like,
oh you should use this instead of that
and that. I'm I'm not an encryption
expert, but this application seems to
work fairly well. So it's called called
gocryptfs. So I'm on a Debian based
system, if I was to use aptitude I can
do aptitude show and say gocryptfs. When
I run that it gives me information on it
and I can click on the home page right
here which will bring us to their GitHub
page. If we were to scroll down here, I
haven't messed with this it looks like
there's a GUI application for this, but
we're going to be looking at the shell
today. Uh basically this is um using the
Go language.
And it's just going to we're going to
create two folders, one where it's
encrypted and then we can mount it to
unencrypt it
decrypt it.
>> [laughter]
>> Uh we are on a Debian based system, but
does give you different options here for
installation. So let's go ahead go back
here. So I have my terminal split here.
I have top here with my notes which
they'll be linked to in the description
of the video. In the bottom we'll run
our commands. Down here I'm in a folder
called uh it's in my temp directory
called files. There's nothing in it. So
first we would need to install gocrypt,
so just use your package manager to do
that. Then we're going to create two
directories. I'm going to call one my
files_encrypted and my files_decrypted.
So I'm going to create both of those.
Now if I list that out I have two empty
directories.
Now I'm going to use the gocryptfs. I'm
going to initiate and I'm going to point
it to my gocryptfs uh files_decrypted.
I'm going to create a password.
So I type in my password, type it in a
second time to make sure we typed it
properly. Now it's going to give us this
master key.
For sake of this tutorial I'm just going
to copy that and paste it into here cuz
I'm going to need that a little bit
later. So I'm going to save it into
there.
So this master key will allow us to do
is if we forgot our password we can use
this to decrypt the the folder. So
you're going to want to save that
somewhere and not paste it into your
terminal here like this cuz now it's in
our history, but again, this is just so
I can reference it back later.
So, we've created our encrypted and
decrypted folders. Now, we can just
run the gocryptfs and we can point it to
our encrypted directory and our
decrypted directory. Again, you can call
these anything you like.
And now,
type in my password, and now we have our
files mounted in our decrypted
directory. So, if we were to go into our
encrypted
uh it's going to have some config files
for the encryption. If I was to go into
our
decrypted directory,
there's nothing in here. So, I'm going
to create some files real quick. I'll
just put the date into a file called
test, and then I'll echo hello and put
that into a file called test.txt.
So, I have two files here. I can cat
them out. Both You can put whatever type
of files you want in here. Now, I'll
move out of this directory cuz now we're
going to unmount it. Uh so, when we do
that, we're going to run we're going to
use fuser mount -u, and we're going to
say the decrypt directory. If you're
still in it, it will tell you that it's
busy, so you have to make sure you exit
out of it. So, now it's it's unmounted.
If we were to list out what's in that
directory,
it's going to show nothing. But, if we
were to list out what's in our encrypted
directory, it now only not only has the
config files, but it has encrypted
files. It's encrypted the names and it's
encrypted them. If we were to uh cat out
one of those files uh like this one
right here, it's just it's a binary
information. It's encrypted. Great. So,
now let's go down and uh well, let's
mount it again. So, we'll go back go
back up and we'll use the gocryptfs
command
right here again, and I'm giving it uh
the relative directories. We can give it
full path names. Do that, type in the
password, and now if I was to go back
into my files decrypted,
the files are there. I can cat them out.
That one and that one.
Back back out, and we will use the fuse
command again to decrypt it or to
unmount it. So, now again,
there's nothing in that directory cuz
it's not mounted. Now, let's say you
forgot your password.
Hopefully, you saved it somewhere, and
not just in your history here. You don't
want that in your history. Uh but, you
printed it up and saved it somewhere.
And so, let's go ahead and look at using
that to decrypt. So, we have two options
here. Again, they're both in the notes
here. I can say gocryptfs {dash}
masterkey equals stdin for standard
input. That will allow me to type it.
So, we will do that, and that's probably
the preferred option cuz now your
password's not going to be in your
history. I'll paste that, and now it's
been mounted. I can look at what's
inside our decrypted directory, and I
can also cat out Oops. what's in that
directory, like so.
Let's go ahead and use uh fuse again to
decrypt that or sorry, unmount that. So,
it's now encrypted again, so there
should be nothing in our decrypted
folder.
Again, uh you could do the same thing if
we were to
take our master key again, we could run
this Oops.
We could run this command here.
And in here, I can put that master key.
Again, doing this will put it in the
history of your shell, so you don't
really want to do this. But, it's
mounted, and if we were to um look
what's in there, you can see it's
decrypted. Let's go ahead and unmount
that again. Uh so, if you were to do
that, make sure you go in your history
and undo it. But, standard in would be a
better option. Now, you have your master
key, and you forgot your password
though. You were able to un uh decrypt
them. Let's change the password. So,
again, we're going to use uh gocryptfs.
We're going to say {dash} uh passwd for
password. And then we're going to give
it that directory.
And we're going to say standard in. So,
now we're going to paste our master key,
which I have
to bring up again. There it is. So, now
let's go ahead and paste that in there.
And now it will ask for a password. So,
I'll type in a new password. And now I
can use that to
go through here back into our history.
It's just this command without that. So,
again, go crypt FS encrypted directory,
decrypted directory, type in the new
password. Perfect. Now, you do notice it
did save a temporary backup of the old
config file. So, in case you did
something wrong, you can copy this back
over the new one and use your old
password. Uh but yeah, that's pretty
much it on the basics of how this works.
If we were to go back to their website,
their GitHub page here, they do have a a
lot of information here that you could
go through running benchmarks, speed
tests, and whatnot. And again, I didn't
realize I started recording this right
before I started recording this, I went
to their website and saw this little
image here of some sort of GUI
interface, if that's your style. Don't
really see the need of it. Um but you
can always check that out. Anyway, I
hope you found this useful if you want
to encrypt a directory.
And if you use something else, let me
know in the comments below and I'll have
a look at that. Thanks for watching. And
as always, please visit
filmsbychris.com. That's Chris with a K.
As always, I hope that you have a great
day.