encfs / recursion into itself

encfs / recursion into itself

  • Written by Walter Doekes

  • Published on: 2015-11-12

We wanted to use EncFS to be able to store encrypted backups.

The requirements for that are:

  • The backup server initiates the backup. That’s where we configure which hours are safe (resource wise) and which files need backing up (etc, home, root, srv, …). And it means the backup server can safely be placed behind a gateway disallowing all incoming connections.
  • The backup server cannot know the passwords of files. This means that the file providing server will have to do the encrypting.

As I wrote earlier EncFS is willing to encrypt files on the fly. So, with a bit of sshd_config chroot hackery, and a --reverse encrypted mount of / onto /.encbackup/data we have an rsync entrypoint to get daily backups. The backup server only ever has access to encrypted files, so privacy is guaranteed.

Just one problem!

/.encbackup/data now contains encrypted versions of /etc, /home and so on…
… but also of /.encbackup and it’s subdirectories!

And you guessed what’s in there; that’s right, an infinitely recursing loop of /.encbackup/data/.encbackup/data/.encbackup/data... which will cause any find /, ncdu / or locate updatedb to break. (Actually, it’s worse, because file accesses would hang, crippling the mount point completely.)

EncFS could be patched rather quickly and for our Debian/Wheezy machines (and others who use 1.7.4), we got upstream_pull125-inf_recursion_check.patch (view) with this changelog:

encfs (1.7.4-2.4.osso0) unstable; urgency=low

  * Added upstream_pull125-inf_recursion_check.patch to fix infinite recursion.

 -- Walter Doekes <wjdoekes[AT]osso.nl>  Thu, 12 Nov 2015 14:11:23 +0100

The lazy can get the deb-archive here: encfs_1.7.4-2.4.osso0_amd64.deb

md5sum of encfs_1.7.4-2.4.osso0_amd64.deb:
sha256sum of encfs_1.7.4-2.4.osso0_amd64.deb:
tthsum of encfs_1.7.4-2.4.osso0_amd64.deb:

Back to overview Newer post: Planned maintenance virtual servers TCN (01:00-06:00 27 NOV 2015) Older post: encfs / configure / libboost