12,922 views
EncFSGui – GUI Wrapper around encfs for OSX
Introduction
3 weeks ago, I posted a rant about my frustration/concern related with crypto tools, more specifically the lack of tools to implement crypto-based protection for files on OSX, in a point-&-click user-friendly way. I listed my personal functional and technical criteria for such tools and came to the conclusion that the industry seem to think otherwise about those criteria. In fact, the only tool that met all of my criteria in the past (BoxCryptor Classic) is no longer supported on current OS versions, and was replaced by a tool that is based on different technology, removing most of the features that I found were important enough to justify paying for their application in the first place.
I tweeted about my rant a couple of times, but unfortunately I have not received any solutions. At least, nobody pointed out that my list of criteria doesn’t make any sense either… but given the lack of feedback overall, I’m not sure if that means anything.
Anyway, as I decided to start learning C++ again back in december 2015, I figured it would be an interesting challenge to write something myself that would be easy enough to use, implements the required functionality and works on the systems that I use (mainly OSX Yosemite and El Capitan).
Today, I’m ready to present the EncFSGui project. You can find the project repository on https://github.com/corelan/EncFSGui. The repository contains the source code, Makefile and compiled binary. It is open-source, but not free. (At least, it wasn’t free for me. I spent quite some time writing the app, which required me to make choices between work, family, and doing other fun things). Anyways. there is no free lunch. Donations are always welcome. (I could have sold the app on the App Store too… probably same effort for me)
What is it ?
EncFSGui is an OSX application, written in C++. It relies on the wxWidgets framework for its GUI aspect. EncFSGui relies on the presence of certain binaries/tools on your system and simply launches those tools with the necessary arguments, captures and processes the output. In other words, it is a wrapper. It doesn’t implement crypto itself, and it doesn’t implement the creation of a filesystem either, but it merely relies on 2 tools (that are not present on OSX by default): encfs and OSXFuse. Additionally, it uses standard tools such as ‘mount’, ‘umount’ and ‘expect’. To limit the number of dependencies you have to install yourself, EncFSGui is statically linked with wxWidgets and libcurl.
For those of you that are not familiar with encfs and osxfuse:
encfs is a free encryption filesystem based on Fuse. It is file-based, which means it will transparently encrypt/decrypt individual files. In other words, if a change is made to a single file, only that file will be changed. If this encfs-encrypted folder is synchronised to the cloud, only the changed file needs to be updated. It uses an arbitrary folder that is configured as being the “encfs” encrypted source folder and uses osxfuse to be mounted into a plaintext version that you can use. This plaintext version behaves like a volume on your system, making it very easy to use. When encfs and osxfuse are installed, you can
- create a new encfs encrypted folder using “encfs”
- decrypt the encfs encrypted folder, by mounting it as a plaintext volume
- interact with the plaintext version, allowing encfs to encrypt/decrypt on the fly in the background
- unmount the plaintext volume again when you no longer need access to the decrypted/plaintext version
osxfuse is the OSX implementation of “Filesystem in Userspace”. It allows non-privileged users to create their own filesystems, and it is used by encfs to provide the actual filesystem inside the decrypted version of an encfs-encrypted folder. osxfuse is the successor to MacFUSE, which is no longer maintained. You can get more information about osxfuse on https://osxfuse.github.io/
Since EncFSGui doesn’t provide the actual encryption or filesystem functionality, you can start & stop the tool, without changing the mount state of your encrypted folders. Although I agree that a wrapper is not the most exciting hardcore way of building things (as its functionality relies on the arguments and output of the tools it uses), it does have an important advantage over tools such as BoxCryptor Classic and EncFSMP, because you don’t need to keep the app running to keep your volumes mounted. At least, I found that to be quite useful in certain cases.
Installing EncFSGui
Getting EncFSGui to run on your OSX system is a 4 step process. I will try to find a way to change this into a one-step process, without taking away the advantage of not having to keep the tool running to have access to your mounted encfs folders. Anyway, for now, you need to run the 4 steps listed below.
For the record, I have only tried these steps on OSX Yosemite and El Capitan. I don’t know if/how the procedure would be different on older versions of OSX.
1. Install homebrew
I decided to use Homebrew as the package manager. Before you can install packages, you’ll have to install Homebrew itself. If you already did, you can skip this step. (Just make sure homebrew is up-to-date).
In order to be able to use Homebrew and install packages, you’ll need the gcc compiler. On recent versions of OSX, you’ll be prompted to install the xcode command line tools as soon as you try to run ‘gcc’. If that is not the case, you can also install Xcode via the App Store, and then install the command line tools yourself.
So, start by opening a Terminal (command prompt) and run ‘gcc’. If you get the message “clang: error: no input files”, then gcc is installed correctly. If you are prompted to install the Xcode command line tools, please do so. If you don’t have gcc installed and are not getting the prompt, you’ll have to install Xcode first, and then install the command line tools with ‘xcode-select –install’
With gcc installed, you can proceed and install Homebrew. From a Terminal command prompt, run the following commands:
ruby -e "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)" sudo chown -R $(whoami) /usr/local/lib brew doctor
2. Install osxfuse
Installing osxfuse is a lot less complicated. Go to https://sourceforge.net/projects/osxfuse/files/ and download the latest version. At the time of writing, the latest version of the 2.x branch is 2.8.3. I don’t expect major issues if you decide to run the 3.x version instead, but I have not tested it myself.
Anyway, download the latest version (.dmg image file). Open the dmg file and double-click the “Install OSXFUSE 2.8.pkg” icon. Click through the installation process and you’re done.
3. Install encfs
With Homebrew installed, this step is as easy as running the following commands. Run only one command at a time, to make sure you can enter your password when asked.
brew update sudo chown -R $USER:admin /usr/local/include sudo chown -R $USER:admin /usr/local/lib/pkgconfig brew link xz libtool boost rlog brew doctor brew install homebrew/fuse/encfs
To check if encfs works, run ‘encfs –version’. You should get something like this:
corelanc0d3r@~: # encfs --version encfs version 1.8.1
4. Install EncFSGui
To get the latest copy of EncFSGui, download the image file from https://github.com/corelan/EncFSGui/raw/master/release/EncFSGUI.dmg
Open the dmg file and simply drag the “encfsgui.app” icon to the “Applications” icon. This will copy the .app bundle to your local /Applications folder. Wait for the copy to complete and you’re all set.
If you open Launchpad (or look at the list of installed Applications), you should see the EncFSGui app.
As I am not a registered Apple developer, the application will need your permission to run. When trying to launch EncFSGui, you’ll (most likely) get a warning that looks like this:
If you decide to trust my pre-compiled binary away (i.e. if you don’t feel like compiling the source yourself), and want to overrule the restriction, launch the “System Preferences” utility and open “Security & Privacy” panel
In the “General” pane, you’ll see a section called “Allow apps downloaded from”. In that section, you should see a reference to encfsgui.app, and a button “open anyway”.
Click the button. You’ll get another dialog that asks for confirmation.
Click “open”. That’s it. From this point forward, you will be able to run this application without prompts or warnings. Please remember to do this each time you update the EncFSGui app.
Note: if you don’t trust my binary, by all means, check the github repository page. It contains all detailed steps on how to set up the development environment. I even provided the Makefile, so you can compile the source code yourself. Reproducible builds FTW.
EncFSGui technicalities
EncFSGui is a standalone binary. It stores its configuration inside ~/Library/Preferences, in a file called “encfsgui Preferences”. This file gets created by the app, and contains a plain-text “ini-file” like structure. Despite the fact that it is very easy to read and manipulate the file, it’s highly recommended to never change this file yourself.
In addition to this permanent configuration file, EncFSGui might create a temporary file called Tcreateencfs.exp (stored under /var/folders/ If the expect script doesn’t contain the right contents (because your encfs binary looks different than mine in terms of output (questions, etc); it might cause the app to hang. This is one of the arguments against the use of a wrapper. On the other hand, as I am using EncFSGui myself (and since I plan on keeping encfs up-to-date as much as possible), I might detect issues myself and will try to fix them. (And yes, I accept pull requests too). EncFSGui doesn’t like passwords with quotes or double quotes. (It won’t filter them out from the password fields and I will try to find solutions for this). Additionally, EncFSGui will reject spaces, quotes and double quotes from Volume names as well. In fact, EncFSGui will remove those characters from the volume name field before saving the new name. At startup, EncFSGui will monitor the output of the ‘mount’ command to capture already mounted volumes. If one of the volumes matches with one of the volumes configured in the app, it will mark them as “already mounted”. When running, EncFSGui remembers the mount state of all configured volumes inside an array of objects. Although it would be fairly easy to compile EncFSGui for Linux variants, it does contain some hardcoded paths (such as references to ~/Library/Preferences and ~/Library/LaunchAgents, and default paths for encfs, mount and umount binaries (which can be overruled by editing the settings). In any case, it should be doable to update the source and to build in OS checks to determine locations in a more generic way). Finally, in order to allow EncFSGui to launch at startup (this is a global option that is disabled by default), a file called “org.corelan.encfsgui.LaunchAtLogin.plist” will be created under ~/Library/LaunchAgents. This only happens when you enable the option. The file will be removed again when you disable the option again. Upon launching EncFSGui the first time, you’ll see 2 things: The GUI itself, and a taskbar icon. The GUI will appear quite empty, with only 4 buttons active: “Create”, “Open Existing”, “Settings” and “Quit”. In the statusbar at the bottom of the window, you’ll see the number of volumes that are configured within EncFSGui. On the right hand side, you’ll get encfs specific information. If EncFSGUI was not able to find encfs as /usr/local/bin/encfs (which is the default value in the app), all GUI buttons will be disabled, except for “Settings” and “Quit”. You can change the encfs path via Settings. When you click on the taskbar icon, you’ll get a popup menu that contains the following items: Let’s take a look at the settings first. The current version, at the time of writing, contains the following options: Most of these options are self-explanatory. You can basically set/change the absolute path to some important binaries. To be honest, I will probably keep the one for encfs, but remove the ones for mount and umount, as those are standard binaries (and I could tell EncFSGui to find them by itself). This would be in-line with the fact that you can’t set the full path to the “expect” binary at this time. Anyway, things will be updated in this area quite soon. Next, you can set some startup & exit options: Clicking “Cancel” will ignore any changes you made. Clicking “Apply” will save the changes and close the dialog as well. This brings us to the main purpose of the application: managing encrypted folders. Creating a new encfs folder involves 2 empty folders: Additionally, you will need to specify a “Volume” name. This is just a logical name, but it’s a quite important one: Fortunately, you can change the name of this volume (as long as it’s not mounted). Don’t use spaces, quotes or double quotes in this name. Keep things simple and relevant. In addition to specifying a volume name, and the 2 folder locations, you have to select an EncFS profile. This profile determines the strength of the crypto that will be used for this folder, and thus the performance as well. I tried to take balanced decision around the 3 presets, but if you disagree with my choices, you can always use the “custom” profile to set your own preferences. Keep in mind that you cannot change these settings afterwards. You can find more details about some of these settings (and their impact on security vs performance) in the encfs man page. The first time you open the “Create” feature, EncFSGui will populate the supported Filename encoding mechanisms for your device. The most common ones are “Stream”, “Block” and “Null”. On some devices, you might see “Block32” as well. If you plan on sharing the encfs folder on multiple systems (e.g. via Dropbox/SugarSync/or other cloud sync platforms), make sure to check if the filename encoding mechanism is supported on all systems. Next, you’ll need to enter a password for the encfs encrypted folder. This password is used to access the key that is used to encrypt/decrypt the encfs folder. In other words, you can change the password later (using the ‘encfsctl’ tool), without having to decrypt and re-encrypt all files. I have not implemented the ability to change the password of the encfs folder yet, but I will. As you can see in the screenshot above, you have the option to store the password into the Keychain. EncFSGui uses the login.keychain to do so, and stores the password under “EncFSGUI_ Finally, you can set 2 mount-related options. You can tell EncFSGui to automatically mount the volume when EncFSGui starts (unless the volume is already mounted). You can also prevent this volume from being unmounted automatically when you close the app. This could be helpful if you have set the global option to automatically unmount volumes when you close the app, and if you want to overrule that setting for this specific volume. When you click “Apply”, EncFSGui will construct an “expect” script and launch the script, feeding it the password as an argument. It will wait for “expect” to complete, and will check if a file called .encfs6.xml was created in the encfs encrypted folder. This file contains the encfs configuration for that folder. Never change this file yourself, as you will most likely break things. Make sure to keep a copy somewhere, as you will not be able to mount the encfs folder anymore if the file is gone or corrupt. If all went well, the new encfs folder is created, and added into EncFSGui. It will not be mounted at this time. If you select a line in the table, some of the other buttons will become visible: Browse, Remove, Info and Edit. If you click “Info”, you can see the output of running “encfsctl” against the encrypted folder: To mount an encfs folder as a plaintext volume, simply select the corresponding line in the table, and click the “Mount & expose” button. Unless you have configured EncFSGui to store the password in Keychain, you will be prompted to enter the password. EncFSGui will then craft an encfs command, feeding it the password, in an attempt to mount the selected folder. When the volume is mounted (confirmed by checking the output of the “mount” command), the table will indicate that the folder is mounted. The “Mounted” column will indicate “YES” and the color of the line will turn red instead of blue. EncFSGui will prompt for a password up to 5 times before giving up. There’s no point in adding more “bruteforce” protection, as things can be easily scripted via encfs as well. Why bother closing a gate if there is no fence. To unmount, simply select the line of a mounted volume, and use the “Unmount & lock” button. Make sure to close any open files first, to avoid data loss. Note: you can mount and unmount volumes directly from the taskbar icon popup-menu. Again, as explained, unless you have configured EncFSGui to automatically unmount folders when you close the app, closing the app won’t have any effect on the mount status of your encfs folders. If you open the app again, it should automatically pick up the mount status by looking at the output of the “mount” command. In addition to creating a brand new encfs folder, you can also add already existing encfs folders to EncFSGui. This would, for example, allow you to open BoxCryptor Classic folders with EncFSGui. The current version of EncFSGui will check if the specified encfs folder contains the .encfs6.xml file to determine if this is a valid encfs folder before adding it into EncFSGui. (Of course, the presence of the file doesn’t guarantee that the file is valid). The “Open Existing” dialog looks like this: As you can see, it looks quite similar to the “Create a new encfs folder” dialog, with the exception of the ability to set the crypto settings. After all, we cannot change any of those settings after an encfs folder was created already. The other options should be self-explanatory (as they are the same as the ones in the “create a new encfs folder” dialog). Clicking “Apply” won’t change anything to the mount status. EncFSGui allows you to change some settings related with the encfs volume (but not with the encfs configuration itself). The ability to change certain things is defined by the mount status of the volume at the time of edit. For an already mounted volume, you can only update the Keychain password (in case you have changed the underlying encfs password yourself). You can remove the keychain password if one was set, or add the password to Keychain if it was not set yet. Additionally, you can change the mount options. For non-mounted volumes, you can also change the volume name (but it has to be unique within EncFSGui), and change the mount location (i.e. the location where the plaintext version of the encfs encrypted folder will be mounted at). You can edit a folder via the “Edit” button. For non-mounted volumes, you can also double-click the entry in the table, which will show the “Edit” dialog. If you don’t know where to look for the mounted (plaintext) volume, you can browse/open it via the “Browse” button. Double-clicking a mounted volume in the table will trigger the same thing. Well, I don’t know. EncFSGui is not saving the password, but it is processing it, and will use it as an argument to the “expect” script in case you are creating a new encfs folder, and it will also echo it to encfs when mounting a volume. If you believe this is not safe enough for you, mount your folders manually with the encfs command line tool. Since EncFSGui is a wrapper, it relies on tools such as umount and mount. As you can see in https://github.com/osxfuse/osxfuse/wiki/Mount-options (look for “kill_on_unmount”), there are known cases where a volume is still mounted, despite the umount command. In any case, EncFSGui will show the correct mount state (as it simply translates whatever it sees in the ‘mount’ output) Probably, yes Cool. I guess you don’t wanna help, right? If you do want to help out, please check the Github repository. It contains all instructions on how to set up your development environment. Please create new branches (don’t submit PRs against the master branch), and please do not submit the dmg file in your PR. (in other words, don’t run “make release”). © 2016 – 2021, Peter Van Eeckhoutte (corelanc0d3r). All rights reserved. Using EncFSGui
GUI
Settings
Creating a new encfs encrypted folder
Mounting and unmounting folders
Adding an already existing encfs folder to EncFSGui
Editing a volume
Browsing a volume
FAQ
1. Is the password of my encfs folder safe?
2. Sometimes, EncFSGui doesn’t seem to be able to unmount my volume
3. Some of the osxfuse mount options look interesting. Will you implement some of them?
4. I think your C++ sucks. The GUI sucks. The concept of running a wrapper sucks. encfs sucks. My life sucks. You suck.
Wanna help?
Donate
Your donation will help funding server hosting.
