Encrypt your disks on Linux
GocryptFS
Another state-of-art tool for encrypted disks on Linux is GocryptFS [3]. GocryptFS also owes its existence to an earlier system that lost its shine for the FOSS community: EncFS.
EncFS came under fire when something happened to it during an audit that should never happen to an encryption solution. The testers detected a vulnerability in the source code that, in the worst case, allowed the key used for encryption to be computed. This danger existed with EncFS especially when attackers got their hands on several versions of the encrypted container. The actual key could then be found out by simple matching and an exclusion procedure. Basically, since this incident, EncFS has been under fire from everyone concerned with security and encryption (Figure 4).
![](/var/linux_magazin/storage/images/issues/2022/257/disk-encryption/figure-4/801494-1-eng-US/Figure-4_large.png)
However, Austrian Jakob Unterwurzacher found the idea behind EncFS so convincing that he set about creating a new implementation. In doing so, he worked with the Go programming language, which not only explains the program's name, but also translates to considerable speed advantages in practice compared to the previously used C++. The use of FUSE remains unchanged, so GocryptFS (Figure 5) can be used on any Linux system with an activated FUSE environment.
![](/var/linux_magazin/storage/images/issues/2022/257/disk-encryption/figure-5/801497-1-eng-US/Figure-5_large.png)
Because FUSE is also available for Windows, GocryptFS also works on Windows systems. With its own wrapper, however, the solution goes by the name of CppcryptFS, and, as the name suggests, the Windows version of GocryptFS is written in C++ instead of Go. MacOS users are less fortunate: macFUSE does exist, but it is not available under a free license. The FOSS community therefore tends to avoid the tool. In the meantime, however, an alternative has been devised that takes GocryptFS to macOS, too, although some special functions have been dropped.
If you don't want to use GocryptFS on the command line, you can turn to SiriKali, which offers a graphical user interface for GocryptFS and its predecessor EncFS.
What GocryptFS Offers
As described, GocryptFS always creates complete, encrypted containers in a file or on a disk. Basically, GocryptFS is designed as an overlay file system. In normal operating mode, you enable a GocryptFS container, write something to it, disable the container again, and then the encrypted content appears as such on the underlying file system. Creating a GocryptFS overlay is quick and easy with the help of the documentation.
GocryptFS offers a second option, known as reverse mode, for storage targets that are implicitly insecure. If you want to store your backups in the cloud, for example, you can activate reverse mode in GocryptFS. Reverse mode exposes the encrypted data directly so that you can copy it to another location.
GocryptFS is about as simple as Veracrypt, however, GocryptFS offers a clear speed advantage. At least subjectively, there are considerable differences when encrypting, and these differences are despite the fact that Veracrypt and GocryptFS support acceleration for the various crypto algorithms in the same way. If you want to manage encrypted data, you will definitely want to take a look at GocryptFS.
Universal GUI: Zulucrypt
The final candidate in this encryptors showcase is a program that does not actually do the encryption work itself. Zulucrypt [4], together with Zulumount, which is included with it, is more concerned with organizing the proliferation of encryption methods available under Linux.
Zulucrypt (Figure 6) promises to unify classic crypt setups with LUKS, Veracrypt, and GocryptFS in a single interface. First and foremost, it is a GUI that integrates and calls the other tools in the background.
![](/var/linux_magazin/storage/images/issues/2022/257/disk-encryption/figure-6/801500-1-eng-US/Figure-6_large.png)
Zulucrypt is extremely user-friendly. The tool is included with most of the popular Linux distributions and can otherwise easily be installed via the provider's website. Immediately after that, the main window of Zulucrypt reveals how powerful the tool actually is.
In Zulucrypt, you can either create or open LUKS devices with Cryptsetup, create Veracrypt volumes or use existing ones, and mount file systems via FUSE with GocryptFS. Unmounting works in the same way. Zulucrypt relieves the user of the need to deal with the details of the CLI or GUI applications of the individual solutions. Nevertheless, it does not hurt to at least be familiar with the basic features of the individual programs, in case something goes wrong in Zulucrypt that the program itself cannot fix. In everyday operations, however, this kind of incident is likely to be an exception.
All in all, Zulucrypt is a powerful little helper that saves admins a part of the learning curve and efficiently reconciles different encryptors under Linux. Zulucrypt is especially beneficial for people who use, or have to use, more than one encryption solution.
« Previous 1 2 3 4 Next »
Buy this article as PDF
(incl. VAT)
Buy Linux Magazine
Subscribe to our Linux Newsletters
Find Linux and Open Source Jobs
Subscribe to our ADMIN Newsletters
Support Our Work
Linux Magazine content is made possible with support from readers like you. Please consider contributing when you’ve found an article to be beneficial.
![Learn More](https://www.linux-magazine.com/var/linux_magazin/storage/images/media/linux-magazine-eng-us/images/misc/learn-more/834592-1-eng-US/Learn-More_medium.png)
News
-
NVIDIA Released Driver for Upcoming NVIDIA 560 GPU for Linux
Not only has NVIDIA released the driver for its upcoming CPU series, it's the first release that defaults to using open-source GPU kernel modules.
-
OpenMandriva Lx 24.07 Released
If you’re into rolling release Linux distributions, OpenMandriva ROME has a new snapshot with a new kernel.
-
Kernel 6.10 Available for General Usage
Linus Torvalds has released the 6.10 kernel and it includes significant performance increases for Intel Core hybrid systems and more.
-
TUXEDO Computers Releases InfinityBook Pro 14 Gen9 Laptop
Sporting either AMD or Intel CPUs, the TUXEDO InfinityBook Pro 14 is an extremely compact, lightweight, sturdy powerhouse.
-
Google Extends Support for Linux Kernels Used for Android
Because the LTS Linux kernel releases are so important to Android, Google has decided to extend the support period beyond that offered by the kernel development team.
-
Linux Mint 22 Stable Delayed
If you're anxious about getting your hands on the stable release of Linux Mint 22, it looks as if you're going to have to wait a bit longer.
-
Nitrux 3.5.1 Available for Install
The latest version of the immutable, systemd-free distribution includes an updated kernel and NVIDIA driver.
-
Debian 12.6 Released with Plenty of Bug Fixes and Updates
The sixth update to Debian "Bookworm" is all about security mitigations and making adjustments for some "serious problems."
-
Canonical Offers 12-Year LTS for Open Source Docker Images
Canonical is expanding its LTS offering to reach beyond the DEB packages with a new distro-less Docker image.
-
Plasma Desktop 6.1 Released with Several Enhancements
If you're a fan of Plasma Desktop, you should be excited about this new point release.