Re: Unison and Gocryptfs on FreeBSD

Hi Greg,

See my answers below.

On 21/5/23 18:04, Greg Troxel wrote:
> Lluc Pallejà <[email protected]> writes:
> 
>> This is not strictly a Unison "issue" but rather finding an
>> alternative of my current setup to use Unison and some sort of Fuse
>> alternative with FreeBSD. Let me explain.
> 
> Very interesting and IMHO totally appropriate for this list.

OK, good I wasn't sure. Thanks.

> 
>> My current setup is, one PC with Debian Bookworm, a Mac mini and a
>> Macbook Pro. All three computers I have installed Unison (latest
>> version) and Gocryptfs, which I use to have an encrypted folder with
>> the option of -plaintextnames so everything is encrypted except the
>> filenames, that way I can see what files will be synchronized and what
>> direction. Then I synchronized my files with Unison to a private
>> server which acts as a central point.
>>
>> So no matter which computer I use, I have a copy of all my files on
>> every computer including the server. I've been using this setup for
>> the last 6 years and it's been working really great.
> 
> Just to be clear, you are synchronizing the ciphertext files with
> Unison.
> 

Yes, I only synchronize the chipertext files. So they remain encrypted 
on my server since, and only the folders with the plain text files are 
mounted on my computers.

>> A few weeks ago I gave a FreeBSD a try and I liked it very much, all
>> my software is also available on FreeBSD with the exception of
>> Gocryptfs which is not supported or available on FreeBSD
>>
>> Since I totally rely on Gocryptfs I looked for other options such as
>> CryFS or encryptFS but they neither of them have the option to NOT
>> encrypt the file names, so that's a no go.
>>
>> I don't think there is a solution to my particular setup.. I have
>> looked very hard and even try to use Gocryptfs with the Linux binary
>> support on FreeBSD, but since Gocryptfs relies on
>> https://urldefense.com/v3/__https://github.com/hanwen/go-fuse__;!!IBzWLUs!W8EAF-mQvO-FM8_YUxa_mZcNFiOdcq5a3KNAyoAXxIw_ZEitmk9M1wZ1GXJf9YXFnpWxYCHhfw1UzfvBRzv8MCOlnOQzjwYJZw$
>> library it doesn't really work.
> 
> I wonder if gocryptfs is fundamentally nonportable, or if there is just
> a missing piece.   encfs seems to have some awkwardness with it.
>

I already posted this question to 
https://urldefense.com/v3/__https://github.com/rfjakob/gocryptfs/discussions/741__;!!IBzWLUs!WbsKyZIgjAJRg-g0y1IbiNkVLcC9z6nGyzaKF0YM8o4NSFbgRHRSe7rfdqY4i09At95GAFM_QYK4LIWMOyaPkuCcKaPcC2bAkw$  and the with an 
alternative to use https://urldefense.com/v3/__https://github.com/winfsp/cgofuse__;!!IBzWLUs!WbsKyZIgjAJRg-g0y1IbiNkVLcC9z6nGyzaKF0YM8o4NSFbgRHRSe7rfdqY4i09At95GAFM_QYK4LIWMOyaPkuCcKaOuQaO8rA$  instead of 
https://urldefense.com/v3/__https://github.com/hanwen/go-fuse__;!!IBzWLUs!WbsKyZIgjAJRg-g0y1IbiNkVLcC9z6nGyzaKF0YM8o4NSFbgRHRSe7rfdqY4i09At95GAFM_QYK4LIWMOyaPkuCcKaO4cb8PDA$ . But according to him the API is 
totally different.

To be clear I think the main bottleneck here is the go-fuse library more 
than gocryptfs.

Encfs seems to be the only option with FreeBSD, Linux and macOS but it 
fails to compile on macOS and no disrespect amb it seems a bit 
"abandoned" and not very active.

  >> So, since some of you I think are using BSDs with Unison I just wonder
>> if anyone has an idea or solution to my problem. I used gocryptfs
>> because has support for macos and Linux, but I would love to use
>> FreeBSD.
> 
> My suggestions are:
> 
>    port gocryptfs

Unfortunately that's beyond my knowledge :)

> 
>    find some other encryption tool, and instead of synchronizing
>    ciphertext, synchronize the plaintext mounts

The main reason of synchronizing the chipertext is the server is out of 
my control, (rsync.net) they are very good, I've had 0 issues with them 
and I find them extremely professional. But I don't want to upload my 
files unencrypted.

> 
>    find some other tool, and just synchronize the ciphertext, deciding
>    not to worry
> 
> I hope you choose option 1 so I can use gocryptfs on NetBSD.

Yes the option of gocryptfs would be ideal, but again the main issue is 
to go-fuse library and the maintainer although not against it, doesn't 
seem interested to support FreeBSD 
https://urldefense.com/v3/__https://github.com/hanwen/go-fuse/issues/366__;!!IBzWLUs!WbsKyZIgjAJRg-g0y1IbiNkVLcC9z6nGyzaKF0YM8o4NSFbgRHRSe7rfdqY4i09At95GAFM_QYK4LIWMOyaPkuCcKaM8ffqO0A$ 

> 
> Also, a caution that if you store bits encrypted, you need a 20-year
> plan to be able to build the software to decrypt and get at them.
> Migration is hard and I've been dealing with encrypted bits for 30
> years.

Sorry I don't think I understand what you mean here.

It seems there is no an easy solution for this.. unless succeed 
compiling EncFS on macos.. although to tell you the truth, the Gocryptfs 
projects is way more active and it seems the has addressed some of the 
security concerns about EncFS 
https://urldefense.com/v3/__https://askubuntu.com/questions/813290/encfs-insecure-what-to-use-now__;!!IBzWLUs!WbsKyZIgjAJRg-g0y1IbiNkVLcC9z6nGyzaKF0YM8o4NSFbgRHRSe7rfdqY4i09At95GAFM_QYK4LIWMOyaPkuCcKaNeMP572A$ 

Thanks Greg.

Lluc Pallejà

-- 
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].