1

I am currently looking for a way to synchronize confidential files between two PCs (and possibly an always running raspberry pi - would serve as a host and backup).

On each PC I have an LUKS-encrypted partition. I want to synchronize the files in those partitions with the rpi, but I don't want to store them on rpi in clear text.
I think the only reliable way is to encrypt the files while still on the PC (in every other way the files could be obtained as long as there is physical access to the rpi). One possible way is storing the files also in a encrypted partition of the rpi and sending the pass-phrase to the rpi every time I want to sync, but I did not find an extremely simple way to do this (e.g. Unison doesn't over such a feature) + the pass-phrase could be obtained by simple manipulations.
The second way I thought of was storing the files in an encrypted container an synchronizing the container, but with every little change the whole file would have to be uploaded to the rpi.

So, is there a fast way to encrypt single files (esp. only the changed ones and possibly combine it with synchronization right away)?

I read openssl is one way of encrypting single files.

I don't know much about encryption or synchronization, but I want to find a way that is reasonably safe and not more than reasonably complex and doesn't use any external services...

Thank you very much for reading and considering my question, Max

  1. Edit: One part that might solve my problem right away:
    If I use a container (luks) and change some files, will the changes in the container file be proportional to the changes I made in the files AND will rsync only transmit the changed parts of the big container file?

  2. Edit: After editing my question the first time I continued researching and found this article: Off Site Encrypted Backups using Rsync and AES
    This article covers backing up files to a remote machine and encrypting them before transmitting them. The next step will be to compare files and use the more recent one. I can probably use a local sync mechanism (which rsync offers) if there not an option for that already.

  3. Edit: I finally found this discussion debating whether a truecrypt container could be synced via rsync. The discussion concluded that it in fact is possible. This might be the perfect solution for me then. I would still be interested whether it is possible with luks-containers as well (I might try that out), but I will probably simply use truecrypt.

Community
  • 1
  • 1
Max
  • 66
  • 1
  • 9

1 Answers1

0

This discussion presents a solution.

If a truecrypt container is synced by rsync only the affected blocks of the container will be updated.

I tried out the procedure explained in the article using an LUKS-container (aes-xts-plain) and it worked, too. So, this answers my question.

Community
  • 1
  • 1
Max
  • 66
  • 1
  • 9