[ale] Encrypting FS by a normal user? to protect from root?

[Greg Freemyer]

Jeremy,

Are you suggesting:

On my local machine mount the file via loopback.
Do my backup to that mounted FS.
unmount the loopback FS
rsync the file to the remote site

That seems to make a lot of sense.  What happens if my disaster
happens while rsync is running?  <reading man page...>

Okay, by default it builds a new file, then replaces it once the
transfer is complete.  So I would be safe, but now I would need to be
able to store 2 copies of my full backup.  I'm looking at a couple
hundred GB so that it not too feasible.

The good news is you also made me think about using EncFS to expose an
encrypted and non-encrypted FS on my local machine.  I could backup to
the non-encrypted version, then rsync the encrypted version to the
remote site. That is sounding fairly safe and I don't think any
individual files are over the size of a DVD ISO so I don't need too
much extra space.

Anybody have anything bad to say about the EncFS / rsync approach?
Maybe there is a safer choice than EncFS.  (I'm not to worried abut
the encryption, more worried if I can easily recreate the environment
and do a restore.)

Thanks
Greg

On 3/16/07, Jeremy T. Bouse <Jeremy.Bouse at undergrid.net> wrote:
>         Have you thought about using LUKS to create an encrypted file that
> could be mounted through loopback? You could generate it locally as root
> and then copy it off-site. Even if they were root off-site they still
> would not be able to get to the data held within unless they had the
> proper key to decrypt the FS.
>
>         I use this for my USB key fob that holds my GPG and SSH keys. I have 2
> identical drives both with separate decryption keys, one holds my GPG
> primary keys and is stored in my safe the other holds my GPG sub-keys
> and SSH identity keys that I keep with me. I particularly like that LUKS
> allows for multiple decryption keys so when I'm accessing the drive I'm
> not always using the same key to access it.
>
>         Regards,
>         Jeremy
>
> Greg Freemyer wrote:
> > All,
> >
> > I want to start sending data offsite as a backup (3rd copy for DR,
> > already have live and onsite nightly copy).
> >
> > I'm considering the Dreamhost because they seem by far cheapest I've
> > seen.  The trouble is I would have SSH access, but not root access.
> >
> > I would really like to create an encrypted FS that I could access but
> > that root would not be able to access.  I'm hoping that their is a
> > FUSE FS that might allow this.
> >
> > The next issue is keeping root from doing a su and becoming me to access the FS.
> >
> > Anyone know any solutions?
> >
> > Greg
>
>
>
> _______________________________________________
> Ale mailing list
> Ale at ale.org
> http://www.ale.org/mailman/listinfo/ale
>
>


-- 
Greg Freemyer
The Norcross Group
Forensics for the 21st Century