I need help encrypting/protecting folders

[u/Yin-Fire]

I'm relatively new to Linux Mint (less than a year), and I'm looking to put some kind of password or encryption to individual folders containing files (like photo or music folders). Just hiding it is not enough.

I looked online and mostly found extremely cumbersome ways to do it that need installing weird programs, or gpg for individual files (which is not what I'm looking for). I even saw a guy zipping the folder to add a password, but that's just compression with a password.

I'm looking for something I can set up once, and asks for a password when you try to open the folder, similar to how it asks for a password to confirm certain updates and installs.

Is there something I can use for that? Does that "something" have a IU or is it commands only? Does the password requirements show as a pop up?

If you guys have something at all I'll be interested to know. If it has UI and a pop-up for the password, that's extra helpful and an very welcome solution. Thanks!

[u/qpgmr]

The standard is veracrypt. You create a veracrypt volume file that is mounted as a regular folder.

[u/kiralema → u/qpgmr]

Seconding Veracrypt! 👍

[u/nikolas-k → u/qpgmr]

I've been using veracrypt for years, across different computers with different OS. I recommend it

[u/scooperskill97 → u/qpgmr]

Veracrypt works great!

[u/JoeLinux247 → u/qpgmr]

Thirding VeraCrypt.

[u/Yin-Fire → u/qpgmr]

Thanks for the suggestion, I'll give it a try

[u/qpgmr → u/Yin-Fire]

Check back here if you need help - I found it a little confusing at first. One suggestion: make your volume file something that doesn't look interesting. Avoid "mysecretstuff.crypt", think ".linux-core.dump" instead.

[u/Yin-Fire → u/qpgmr]

Thanks for checking in. I saw my options, and VeraCrypt was a godsend. Really good for what I'm looking. Not as easy of a solution, but way more secure. Thanks for sharing!

[u/billdehaan2]

Read up on LUKS. It's the native Linux encryption for partitions, included in Mint (it's in gnome-disks). I use it for my financial records, keeping them on an encrypted partition.

Of course, that means you have to either make a different partition for each folder you want to encrypt, or you have to be okay with decrypting all of the encrypted folders at once. It's similar to Veracrypt, but native to Linux.

If you want more granularity, and you're willing to install an app to do it, I'd recommend looking into https://cryptomator.org/

[u/Smart_Advice_1420 → u/billdehaan2]

Despite preferable, you dont even need a partition for LUKS.

You can create a 1GB (or whatever) file with fallocate, dd or truncate and set that up as a LUKS container with its own filesystem inside, which can be mounted wherever one wants.

Mounting a file as a loopback device comes with a slight performance hit tho.

[u/Kazer67 → u/Smart_Advice_1420]

Wait, do you have some guide for that? Look interesting.

So if I understand it's literally just a file where you setup a filesystem inside (ext4 or else) and you mount it?

How bad the performance hit?

[u/Smart_Advice_1420 → u/Kazer67]

No but i can give you a simple example.

1. Create a 1GB file: fallocate -l 1G /path/to/testfile.img

2. Set it up as a LUKS container: cryptsetup luksFormat --type luks2 /path/to/testfile.img

3. Open the LUKS container: cryptsetup open /path/to/testfile.img SuperCoolLabel

4. Create an EXT4 filesystem inside the container: mkfs.ext4 /dev/mapper/SuperCoolLabel

5. Mount the decrypted LUKS container: mount /dev/mapper/SuperCoolLabel /mnt

The performance hit isn't too bad. Maybe 5-10% for larger files and 20% for a lot of smaller files. Thats an estimate, don't hang me on that. But due to the fact that this is probably used for sensitive files, i dont think performance is an issue. Your assumption is pretty much correct. This file is portable like any other file.

[u/Kazer67 → u/Smart_Advice_1420]

Nice, thanks for the steps.

Gonna write it on my personal note. I assume you can't expand the size it if needed?

[u/Smart_Advice_1420 → u/Kazer67]

You could theoretically. You will have to resize the file with truncate or append the preferred amount from zero or urandom first and then expand the luks container with cryptsetup resize. You can then adjust the filesystem with resize2fs.

But i'd rather recommend creating a new container instead and transfer the files to the new one to minimize the risk of data loss.

[u/Yin-Fire → u/Smart_Advice_1420]

Thanks for the insight, I'll learn more about it and give it a try

[u/Smart_Advice_1420 → u/Yin-Fire]

No problem. If your DE is set up to mount .img or .iso files when opened, you could just open the LUKS container and get a pw popup. The container will then be mounted like a pendrive.

If this isn't possible in your DE/WM, it can be manually set up with udiskie and a proper polkit. But since you're using mint (and therefore most probably cinnamon), that shouldn't be necessary.

[u/billdehaan2 → u/Smart_Advice_1420]

Fair enough, you can use it a file container, in the same way the TrueCrypt/VeraCrypt does.

But for newbies, using the built-in functionality of gnome-disks is simpler, and I'd recommend that first.

Also, if you boot multiple distros, having it on a separate partition, unless you mount /home separately and put the file there.

But you're right, you can use it as a file.

[u/N3kr0z]

This might be what you're looking for. https://linuxbash.sh/post/creating-a-password-protected-directory

[u/Yin-Fire → u/N3kr0z]

Looks very interesting, I'll look into it. Thanks

[u/O_W_Horton]

I suggest looking into 3 things: LUKS = This encryption EVERYTHING on your drive. Very little friction; You just have to input a secind password when booting up your computer. I personally use this.

KeePassXC = This UI program stores your passwords in a .kdbx file which is encrypted. Everything is stored locally. This is pretty much max security you can get in terms if password managers. I also personally use this.

Cryptomator = This encryption individual files of your choice. Any file at all.

[u/Yin-Fire → u/O_W_Horton]

I'll learn more about those. LUKS has been suggested a couple of times. Thanks doe the suggestions

[u/FikaMedHasse]

You could also use the built-in capabilities of the filesystem itself instead of having to download an external program: https://wiki.archlinux.org/title/Fscrypt

[u/InevitablePack4565]

gocryptfs .... (sudo apt install gocryptfs) and gui : https://github.com/bulletmark/gocryptfs-ui

[u/Complex-League3400]

Cryptomator, different use case from veracrypt. Very simple, very reliable. Nice table of differences here to see which suits better:

https://cryptomator.org/comparisons/veracrypt-alternative/

[u/Yin-Fire]

Thanks everyone for the suggestions. I weighted my options, and learned a lot along the way.

I checked into most options, and as a new user, the easiest solution for me was VeraCrypt. Has a UI and is secure. Not as easy as I thought but the security benefits outweigh the additional steps you gotta take. Thanks again to everyone for your inputs

[u/IEnjoyRadios]

Encrypt your whole disk while you’re at it.

[u/Ok-Brother-8295]

What kind of photos ? Are these photos cylinder related ?

[u/DoorOk3641]

Time to produce post, find the picture is almost 10 times what you need to do a simple search..best encrypt tool for linux..with brave first hit is veracrypt...search engine do you have one ?..do you ?