
\begin{DoxyItemize}
\item infos = Information about fcrypt plugin is in keys below
\item infos/author = Peter Nirschl \href{mailto:peter.nirschl@gmail.com}{\texttt{ peter.\+nirschl@gmail.\+com}}
\item infos/licence = B\+SD
\item infos/provides = sync filefilter crypto
\item infos/needs =
\item infos/recommends =
\item infos/placements = pregetstorage postgetstorage precommit
\item infos/ordering = sync
\item infos/status = unittest nodep configurable
\item infos/metadata =
\item infos/description = File Encryption
\end{DoxyItemize}\hypertarget{md_src_plugins_fcrypt_README_src_plugins_fcrypt_README_md}{}\doxysection{fcrypt Plugin}\label{md_src_plugins_fcrypt_README_src_plugins_fcrypt_README_md}
\hypertarget{md_src_plugins_fcrypt_README_autotoc_md203}{}\doxysubsection{Introduction}\label{md_src_plugins_fcrypt_README_autotoc_md203}
This plugin enables file based encryption and decryption using G\+PG. Also an option for signing and verifying files using G\+PG is provided.

This plugin encrypts backend files before the commit is executed (thus {\ttfamily precommit}). The plugin decrypts the backend files before the getstorage opens it (thus {\ttfamily pregetstorage}). After the getstorage plugin has read the backend file, the plugin decrypts the backend file again (thus {\ttfamily postgetstorage}).\hypertarget{md_src_plugins_fcrypt_README_autotoc_md204}{}\doxysubsection{Security Considerations}\label{md_src_plugins_fcrypt_README_autotoc_md204}
There are two things to consider when using the {\ttfamily fcrypt} plugin\+:


\begin{DoxyEnumerate}
\item Decrypted data is visible on the file system for a short period of time.
\item Decrypted data might end up on a hard disk or some other persistent storage.
\end{DoxyEnumerate}

The plugin directs G\+PG to write its (decrypted) output to a temporary directory. From there on the data can be processed by other plugins. After the {\ttfamily get} phase is over, {\ttfamily fcrypt} overwrites the temporary file and unlinks it afterwards. However, if the application crashes during {\ttfamily get} the decrypted data may remain in the temporary directory.

If the temporary directory is mounted on a hard disk, G\+PG writes the decrypted data on that disk. Thus we recommend to either mount {\ttfamily /tmp} to a R\+AM disk or specify another path as temporary directory within the plugin configuration (see Configuration below).\hypertarget{md_src_plugins_fcrypt_README_autotoc_md205}{}\doxysubsection{Known Issues}\label{md_src_plugins_fcrypt_README_autotoc_md205}
If you encounter the following error at {\ttfamily kdb mount}\+:


\begin{DoxyCode}{0}
\DoxyCodeLine{The command kdb mount terminated unsuccessfully with the info:}
\DoxyCodeLine{Too many plugins!}
\DoxyCodeLine{The plugin sync can't be positioned at position precommit anymore.}
\DoxyCodeLine{Try to reduce the number of plugins!}
\DoxyCodeLine{}
\DoxyCodeLine{Failed because precommit with 7 is larger than 6}
\DoxyCodeLine{Please report the issue at https://issues.libelektra.org/}
\end{DoxyCode}


you might want to consider disabling the sync plugin by entering\+:


\begin{DoxyCode}{0}
\DoxyCodeLine{kdb set /sw/elektra/kdb/\#0/current/plugins ""}
\DoxyCodeLine{kdb set system/sw/elektra/kdb/\#0/current/plugins ""}
\end{DoxyCode}


Please note that this is a workaround until a more sustainable solution is found.\hypertarget{md_src_plugins_fcrypt_README_autotoc_md206}{}\doxysubsection{Dependencies}\label{md_src_plugins_fcrypt_README_autotoc_md206}
\hypertarget{md_src_plugins_fcrypt_README_autotoc_md207}{}\doxysubsubsection{Crypto Plugin}\label{md_src_plugins_fcrypt_README_autotoc_md207}
This plugin uses parts of the {\ttfamily crypto} plugin.\hypertarget{md_src_plugins_fcrypt_README_autotoc_md208}{}\doxysubsubsection{Gnu\+P\+G (\+G\+P\+G)}\label{md_src_plugins_fcrypt_README_autotoc_md208}
Please refer to \mbox{\hyperlink{md_src_plugins_crypto_README_src_plugins_crypto_README_md}{crypto}}.\hypertarget{md_src_plugins_fcrypt_README_autotoc_md209}{}\doxysubsection{Restrictions}\label{md_src_plugins_fcrypt_README_autotoc_md209}
Please refer to \mbox{\hyperlink{md_src_plugins_crypto_README_src_plugins_crypto_README_md}{crypto}}.\hypertarget{md_src_plugins_fcrypt_README_autotoc_md210}{}\doxysubsection{Examples}\label{md_src_plugins_fcrypt_README_autotoc_md210}
You can mount the plugin with encryption enabled like this\+:


\begin{DoxyCode}{0}
\DoxyCodeLine{kdb mount test.ecf /t fcrypt "encrypt/key=DDEBEF9EE2DC931701338212DAF635B17F230E8D"}
\end{DoxyCode}


If you only want to sign the configuration file, you can mount the plugin like this\+:


\begin{DoxyCode}{0}
\DoxyCodeLine{kdb mount test.ecf /t fcrypt "sign/key=DDEBEF9EE2DC931701338212DAF635B17F230E8D"}
\end{DoxyCode}


Both options {\ttfamily encrypt/key} and {\ttfamily sign/key} can be combined\+:


\begin{DoxyCode}{0}
\DoxyCodeLine{kdb mount test.ecf /t fcrypt \(\backslash\)}
\DoxyCodeLine{  "encrypt/key=DDEBEF9EE2DC931701338212DAF635B17F230E8D,sign/key=DDEBEF9EE2DC931701338212DAF635B17F230E8D"}
\end{DoxyCode}


If you create a key under {\ttfamily /t}


\begin{DoxyCode}{0}
\DoxyCodeLine{kdb set /t/a "hello world"}
\end{DoxyCode}


you will notice that you can not read the plain text of {\ttfamily test.\+ecf} because it has been encrypted by G\+PG.

But you can still access {\ttfamily /t/a} with {\ttfamily kdb get}\+:


\begin{DoxyCode}{0}
\DoxyCodeLine{kdb get /t/a}
\end{DoxyCode}


If you are looking for a more interactive example, have a look at the following A\+S\+C\+I\+Icast at\+:

\href{https://asciinema.org/a/153014}{\texttt{ https\+://asciinema.\+org/a/153014}}\hypertarget{md_src_plugins_fcrypt_README_autotoc_md211}{}\doxysubsection{Configuration}\label{md_src_plugins_fcrypt_README_autotoc_md211}
\hypertarget{md_src_plugins_fcrypt_README_autotoc_md212}{}\doxysubsubsection{Signatures}\label{md_src_plugins_fcrypt_README_autotoc_md212}
The G\+PG signature keys can be specified as {\ttfamily sign/key} directly. If you want to use more than one key for signing, just enumerate like\+:


\begin{DoxyCode}{0}
\DoxyCodeLine{sign/key/\#0}
\DoxyCodeLine{sign/key/\#1}
\end{DoxyCode}


If more than one key is defined, every private key is used to sign the file of the backend.

If a signature is attached to a file, {\ttfamily fcrypt} automatically verifies its content whenever the file is being read.

Note that the signed file is stored in the internal format of G\+PG. So you only see binary data when opening the signed configuration file directly. However, you can simply display the plain text content of the file by using G\+PG\+:


\begin{DoxyCode}{0}
\DoxyCodeLine{gpg2 -\/d signed.ecf}
\end{DoxyCode}
\hypertarget{md_src_plugins_fcrypt_README_autotoc_md213}{}\doxysubsubsection{G\+P\+G Configuration}\label{md_src_plugins_fcrypt_README_autotoc_md213}
The G\+PG Configuration is described in \mbox{\hyperlink{md_src_plugins_crypto_README_src_plugins_crypto_README_md}{crypto}}.\hypertarget{md_src_plugins_fcrypt_README_autotoc_md214}{}\doxysubsubsection{Textmode}\label{md_src_plugins_fcrypt_README_autotoc_md214}
{\ttfamily fcrypt} operates in textmode per default. In textmode {\ttfamily fcrypt} uses the {\ttfamily -\/-\/armor} option of G\+PG, thus the output of {\ttfamily fcrypt} is A\+S\+C\+II armored. If no encryption key is provided (i.\+e. only signature is requested) {\ttfamily fcrypt} uses the {\ttfamily -\/-\/clearsign} option of G\+PG.

Textmode can be disabled by setting {\ttfamily fcrypt/textmode} to {\ttfamily 0} in the plugin configuration.\hypertarget{md_src_plugins_fcrypt_README_autotoc_md215}{}\doxysubsubsection{Temporary Directory}\label{md_src_plugins_fcrypt_README_autotoc_md215}
{\ttfamily fcrypt} uses the configuration option {\ttfamily fcrypt/tmpdir} to generate paths for temporary files during encryption and decryption. If no such configuration option is provided, {\ttfamily fcrypt} will try to use the environment variable {\ttfamily T\+M\+P\+D\+IR}. If {\ttfamily T\+M\+P\+D\+IR} is not set in the environment, {\ttfamily /tmp} is used as default directory.

The path of the temporary directory is forwarded to G\+PG via the {\ttfamily -\/o} option, so G\+PG will output to this path. The directory must be readable and writable by the user.

We recommend to specify a path that is mounted to a R\+AM disk. It is advisable to set restrictive access rules to this path, so that other users on the system can not access it. 