Re: Unison and Gocryptfs on FreeBSD

Hi all,

I just want to follow up with my issue and after a few weeks of research 
I've finally found a suitable solution. It's not the ideal, that would 
be being able to use Gocryptfs.

The only solution I've been able to find is to use EncFS which is 
available for FreeBSD. At the end since I'm always using two computers, 
is to keep the current Gocryptfs installation on my M1 mac and use EncFS 
on my PC with FreeBSD.

Instead of synchronizing the PC (FreeBSD) with my server, what I'm doing 
is first synchronize the decrypted files between the PC and the MAC, and 
only send the chiper text files between the M1 mac and the server.

So, this way my data on FreeBSD is also encrypted using EncFS and 
Gocryptfs on my mac.

It's not 100% ideal but it does the job.

Thanks for your help!

I'm really enjoying my new adventure using FreeBSD :), I still have a 
long way before I'm totally comfortable with it.. but I'm learning new 
features every day, ZFS is really amazing :)

On 5/21/23 19:08, Lluc Pallejà wrote:
> Hi Greg,
> 
> See my answers below.
> 
> On 21/5/23 18:04, Greg Troxel wrote:
>> Lluc Pallejà <[email protected]> writes:
>>
>>> This is not strictly a Unison "issue" but rather finding an
>>> alternative of my current setup to use Unison and some sort of Fuse
>>> alternative with FreeBSD. Let me explain.
>>
>> Very interesting and IMHO totally appropriate for this list.
> 
> OK, good I wasn't sure. Thanks.
> 
>>
>>> My current setup is, one PC with Debian Bookworm, a Mac mini and a
>>> Macbook Pro. All three computers I have installed Unison (latest
>>> version) and Gocryptfs, which I use to have an encrypted folder with
>>> the option of -plaintextnames so everything is encrypted except the
>>> filenames, that way I can see what files will be synchronized and what
>>> direction. Then I synchronized my files with Unison to a private
>>> server which acts as a central point.
>>>
>>> So no matter which computer I use, I have a copy of all my files on
>>> every computer including the server. I've been using this setup for
>>> the last 6 years and it's been working really great.
>>
>> Just to be clear, you are synchronizing the ciphertext files with
>> Unison.
>>
> 
> Yes, I only synchronize the chipertext files. So they remain encrypted 
> on my server since, and only the folders with the plain text files are 
> mounted on my computers.
> 
>>> A few weeks ago I gave a FreeBSD a try and I liked it very much, all
>>> my software is also available on FreeBSD with the exception of
>>> Gocryptfs which is not supported or available on FreeBSD
>>>
>>> Since I totally rely on Gocryptfs I looked for other options such as
>>> CryFS or encryptFS but they neither of them have the option to NOT
>>> encrypt the file names, so that's a no go.
>>>
>>> I don't think there is a solution to my particular setup.. I have
>>> looked very hard and even try to use Gocryptfs with the Linux binary
>>> support on FreeBSD, but since Gocryptfs relies on
>>> https://urldefense.com/v3/__https://github.com/hanwen/go-fuse__;!!IBzWLUs!W8EAF-mQvO-FM8_YUxa_mZcNFiOdcq5a3KNAyoAXxIw_ZEitmk9M1wZ1GXJf9YXFnpWxYCHhfw1UzfvBRzv8MCOlnOQzjwYJZw$
>>> library it doesn't really work.
>>
>> I wonder if gocryptfs is fundamentally nonportable, or if there is just
>> a missing piece.   encfs seems to have some awkwardness with it.
>>
> 
> I already posted this question to 
> https://urldefense.com/v3/__https://github.com/rfjakob/gocryptfs/discussions/741__;!!IBzWLUs!WbsKyZIgjAJRg-g0y1IbiNkVLcC9z6nGyzaKF0YM8o4NSFbgRHRSe7rfdqY4i09At95GAFM_QYK4LIWMOyaPkuCcKaPcC2bAkw$  and the with an alternative to use https://urldefense.com/v3/__https://github.com/winfsp/cgofuse__;!!IBzWLUs!WbsKyZIgjAJRg-g0y1IbiNkVLcC9z6nGyzaKF0YM8o4NSFbgRHRSe7rfdqY4i09At95GAFM_QYK4LIWMOyaPkuCcKaOuQaO8rA$  instead of https://urldefense.com/v3/__https://github.com/hanwen/go-fuse__;!!IBzWLUs!WbsKyZIgjAJRg-g0y1IbiNkVLcC9z6nGyzaKF0YM8o4NSFbgRHRSe7rfdqY4i09At95GAFM_QYK4LIWMOyaPkuCcKaO4cb8PDA$ . But according to him the API is totally different.
> 
> To be clear I think the main bottleneck here is the go-fuse library more 
> than gocryptfs.
> 
> Encfs seems to be the only option with FreeBSD, Linux and macOS but it 
> fails to compile on macOS and no disrespect amb it seems a bit 
> "abandoned" and not very active.
> 
>   >> So, since some of you I think are using BSDs with Unison I just wonder
>>> if anyone has an idea or solution to my problem. I used gocryptfs
>>> because has support for macos and Linux, but I would love to use
>>> FreeBSD.
>>
>> My suggestions are:
>>
>>    port gocryptfs
> 
> Unfortunately that's beyond my knowledge :)
> 
>>
>>    find some other encryption tool, and instead of synchronizing
>>    ciphertext, synchronize the plaintext mounts
> 
> The main reason of synchronizing the chipertext is the server is out of 
> my control, (rsync.net) they are very good, I've had 0 issues with them 
> and I find them extremely professional. But I don't want to upload my 
> files unencrypted.
> 
>>
>>    find some other tool, and just synchronize the ciphertext, deciding
>>    not to worry
>>
>> I hope you choose option 1 so I can use gocryptfs on NetBSD.
> 
> Yes the option of gocryptfs would be ideal, but again the main issue is 
> to go-fuse library and the maintainer although not against it, doesn't 
> seem interested to support FreeBSD 
> https://urldefense.com/v3/__https://github.com/hanwen/go-fuse/issues/366__;!!IBzWLUs!WbsKyZIgjAJRg-g0y1IbiNkVLcC9z6nGyzaKF0YM8o4NSFbgRHRSe7rfdqY4i09At95GAFM_QYK4LIWMOyaPkuCcKaM8ffqO0A$
>>
>> Also, a caution that if you store bits encrypted, you need a 20-year
>> plan to be able to build the software to decrypt and get at them.
>> Migration is hard and I've been dealing with encrypted bits for 30
>> years.
> 
> Sorry I don't think I understand what you mean here.
> 
> It seems there is no an easy solution for this.. unless succeed 
> compiling EncFS on macos.. although to tell you the truth, the Gocryptfs 
> projects is way more active and it seems the has addressed some of the 
> security concerns about EncFS 
> https://urldefense.com/v3/__https://askubuntu.com/questions/813290/encfs-insecure-what-to-use-now__;!!IBzWLUs!WbsKyZIgjAJRg-g0y1IbiNkVLcC9z6nGyzaKF0YM8o4NSFbgRHRSe7rfdqY4i09At95GAFM_QYK4LIWMOyaPkuCcKaNeMP572A$
> Thanks Greg.
> 
> Lluc Pallejà
> 

Lluc Pallejà

-- 
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].