
\begin{DoxyItemize}
\item infos = Information about fcrypt plugin is in keys below
\item infos/author = Peter Nirschl \href{mailto:peter.nirschl@gmail.com}{\texttt{ peter.\+nirschl@gmail.\+com}}
\item infos/licence = BSD
\item infos/provides = sync filefilter crypto
\item infos/needs =
\item infos/recommends =
\item infos/placements = pregetstorage postgetstorage precommit
\item infos/ordering = sync
\item infos/status = unittest nodep configurable
\item infos/metadata =
\item infos/description = File Encryption
\end{DoxyItemize}\hypertarget{md_src_plugins_fcrypt_README_src_plugins_fcrypt_README_md}{}\doxysection{fcrypt Plugin}\label{md_src_plugins_fcrypt_README_src_plugins_fcrypt_README_md}
\hypertarget{md_src_plugins_fcrypt_README_autotoc_md188}{}\doxysubsection{Introduction}\label{md_src_plugins_fcrypt_README_autotoc_md188}
This plugin enables file based encryption and decryption using GPG. Also an option for signing and verifying files using GPG is provided.

This plugin encrypts backend files before the commit is executed (thus {\ttfamily precommit}). The plugin decrypts the backend files before the getstorage opens it (thus {\ttfamily pregetstorage}). After the getstorage plugin has read the backend file, the plugin decrypts the backend file again (thus {\ttfamily postgetstorage}).\hypertarget{md_src_plugins_fcrypt_README_autotoc_md189}{}\doxysubsection{Installation}\label{md_src_plugins_fcrypt_README_autotoc_md189}
See \mbox{\hyperlink{doc_INSTALL_md}{installation}}. The package is called {\ttfamily libelektra5-\/experimental}.\hypertarget{md_src_plugins_fcrypt_README_autotoc_md190}{}\doxysubsection{Security Considerations}\label{md_src_plugins_fcrypt_README_autotoc_md190}
There are two things to consider when using the {\ttfamily fcrypt} plugin\+:


\begin{DoxyEnumerate}
\item Decrypted data is visible on the file system for a short period of time.
\item Decrypted data might end up on a hard disk or some other persistent storage.
\end{DoxyEnumerate}

The plugin directs GPG to write its (decrypted) output to a temporary directory. From there on the data can be processed by other plugins. After the {\ttfamily get} phase is over, {\ttfamily fcrypt} overwrites the temporary file and unlinks it afterwards. However, if the application crashes during {\ttfamily get} the decrypted data may remain in the temporary directory.

If the temporary directory is mounted on a hard disk, GPG writes the decrypted data on that disk. Thus we recommend to either mount {\ttfamily /tmp} to a RAM disk or specify another path as temporary directory within the plugin configuration (see Configuration below).\hypertarget{md_src_plugins_fcrypt_README_autotoc_md191}{}\doxysubsection{Known Issues}\label{md_src_plugins_fcrypt_README_autotoc_md191}
If you encounter the following error at {\ttfamily kdb mount}\+:


\begin{DoxyCode}{0}
\DoxyCodeLine{The command kdb mount terminated unsuccessfully with the info:}
\DoxyCodeLine{Too many plugins!}
\DoxyCodeLine{The plugin sync can't be positioned at position precommit anymore.}
\DoxyCodeLine{Try to reduce the number of plugins!}
\DoxyCodeLine{}
\DoxyCodeLine{Failed because precommit with 7 is larger than 6}
\DoxyCodeLine{Please report the issue at https://issues.libelektra.org/}

\end{DoxyCode}


you might want to consider disabling the sync plugin by entering\+:


\begin{DoxyCode}{0}
\DoxyCodeLine{kdb set /sw/elektra/kdb/\#0/current/plugins "{}"{}}
\DoxyCodeLine{kdb set system:/sw/elektra/kdb/\#0/current/plugins "{}"{}}

\end{DoxyCode}


Please note that this is a workaround until a more sustainable solution is found.\hypertarget{md_src_plugins_fcrypt_README_autotoc_md192}{}\doxysubsection{Dependencies}\label{md_src_plugins_fcrypt_README_autotoc_md192}
\hypertarget{md_src_plugins_fcrypt_README_autotoc_md193}{}\doxysubsubsection{Crypto Plugin}\label{md_src_plugins_fcrypt_README_autotoc_md193}
This plugin uses parts of the {\ttfamily crypto} plugin.\hypertarget{md_src_plugins_fcrypt_README_autotoc_md194}{}\doxysubsubsection{Gnu\+PG (\+GPG)}\label{md_src_plugins_fcrypt_README_autotoc_md194}
Please refer to \mbox{\hyperlink{md_src_plugins_crypto_README_src_plugins_crypto_README_md}{crypto}}.\hypertarget{md_src_plugins_fcrypt_README_autotoc_md195}{}\doxysubsection{Restrictions}\label{md_src_plugins_fcrypt_README_autotoc_md195}
Please refer to \mbox{\hyperlink{md_src_plugins_crypto_README_src_plugins_crypto_README_md}{crypto}}.\hypertarget{md_src_plugins_fcrypt_README_autotoc_md196}{}\doxysubsection{Examples}\label{md_src_plugins_fcrypt_README_autotoc_md196}
You can mount the plugin with encryption enabled like this\+:


\begin{DoxyCode}{0}
\DoxyCodeLine{kdb mount test.ecf /t fcrypt "{}encrypt/key=DDEBEF9EE2DC931701338212DAF635B17F230E8D"{}}

\end{DoxyCode}


If you only want to sign the configuration file, you can mount the plugin like this\+:


\begin{DoxyCode}{0}
\DoxyCodeLine{kdb mount test.ecf /t fcrypt "{}sign/key=DDEBEF9EE2DC931701338212DAF635B17F230E8D"{}}

\end{DoxyCode}


Both options {\ttfamily encrypt/key} and {\ttfamily sign/key} can be combined\+:


\begin{DoxyCode}{0}
\DoxyCodeLine{kdb mount test.ecf /t fcrypt \(\backslash\)}
\DoxyCodeLine{  "{}encrypt/key=DDEBEF9EE2DC931701338212DAF635B17F230E8D,sign/key=DDEBEF9EE2DC931701338212DAF635B17F230E8D"{}}

\end{DoxyCode}


If you create a key under {\ttfamily /t}


\begin{DoxyCode}{0}
\DoxyCodeLine{kdb set /t/a "{}hello world"{}}

\end{DoxyCode}


you will notice that you can not read the plain text of {\ttfamily test.\+ecf} because it has been encrypted by GPG.

But you can still access {\ttfamily /t/a} with {\ttfamily kdb get}\+:


\begin{DoxyCode}{0}
\DoxyCodeLine{kdb get /t/a}

\end{DoxyCode}


If you are looking for a more interactive example, have a look at the following ASCIIcast at\+:

\href{https://asciinema.org/a/153014}{\texttt{ https\+://asciinema.\+org/a/153014}}\hypertarget{md_src_plugins_fcrypt_README_autotoc_md197}{}\doxysubsection{Configuration}\label{md_src_plugins_fcrypt_README_autotoc_md197}
\hypertarget{md_src_plugins_fcrypt_README_autotoc_md198}{}\doxysubsubsection{Signatures}\label{md_src_plugins_fcrypt_README_autotoc_md198}
The GPG signature keys can be specified as {\ttfamily sign/key} directly. If you want to use more than one key for signing, just enumerate like\+:


\begin{DoxyCode}{0}
\DoxyCodeLine{sign/key/\#0}
\DoxyCodeLine{sign/key/\#1}

\end{DoxyCode}


If more than one key is defined, every private key is used to sign the file of the backend.

If a signature is attached to a file, {\ttfamily fcrypt} automatically verifies its content whenever the file is being read.

Note that the signed file is stored in the internal format of GPG. So you only see binary data when opening the signed configuration file directly. However, you can simply display the plain text content of the file by using GPG\+:


\begin{DoxyCode}{0}
\DoxyCodeLine{gpg2 -\/d signed.ecf}

\end{DoxyCode}
\hypertarget{md_src_plugins_fcrypt_README_autotoc_md199}{}\doxysubsubsection{GPG Configuration}\label{md_src_plugins_fcrypt_README_autotoc_md199}
The GPG Configuration is described in \mbox{\hyperlink{md_src_plugins_crypto_README_src_plugins_crypto_README_md}{crypto}}.\hypertarget{md_src_plugins_fcrypt_README_autotoc_md200}{}\doxysubsubsection{Textmode}\label{md_src_plugins_fcrypt_README_autotoc_md200}
{\ttfamily fcrypt} operates in textmode per default. In textmode {\ttfamily fcrypt} uses the {\ttfamily -\/-\/armor} option of GPG, thus the output of {\ttfamily fcrypt} is ASCII armored. If no encryption key is provided (i.\+e. only signature is requested) {\ttfamily fcrypt} uses the {\ttfamily -\/-\/clearsign} option of GPG.

Textmode can be disabled by setting {\ttfamily fcrypt/textmode} to {\ttfamily 0} in the plugin configuration.\hypertarget{md_src_plugins_fcrypt_README_autotoc_md201}{}\doxysubsubsection{Temporary Directory}\label{md_src_plugins_fcrypt_README_autotoc_md201}
{\ttfamily fcrypt} uses the configuration option {\ttfamily fcrypt/tmpdir} to generate paths for temporary files during encryption and decryption. If no such configuration option is provided, {\ttfamily fcrypt} will try to use the environment variable {\ttfamily TMPDIR}. If {\ttfamily TMPDIR} is not set in the environment, {\ttfamily /tmp} is used as default directory.

The path of the temporary directory is forwarded to GPG via the {\ttfamily -\/o} option, so GPG will output to this path. The directory must be readable and writable by the user.

We recommend to specify a path that is mounted to a RAM disk. It is advisable to set restrictive access rules to this path, so that other users on the system can not access it. 