I tweeted about my rant a couple of times, but unfortunately I have not received any solutions. \u00a0At least, nobody pointed out that my list of criteria doesn\u2019t make any sense either... but given the lack of feedback overall, I\u2019m not sure if that means anything.<\/p>\n
Anyway, as I decided to start learning C++ again back in december 2015, I figured it would be an interesting challenge to write something myself that would be easy enough to use, implements the required functionality and works on the systems that I use (mainly OSX Yosemite and El Capitan).<\/p>\n
Today, I\u2019m ready to present the EncFSGui project. \u00a0You can find the project repository on https:\/\/github.com\/corelan\/EncFSGui<\/a>. \u00a0The repository contains the source code, Makefile and compiled binary. \u00a0It is open-source, but not free. (At least, it wasn\u2019t free for me. \u00a0I spent quite some time writing the app, which required me to make choices between work, family, and doing other fun things). \u00a0 Anyways. there is no free lunch. \u00a0Donations are always welcome. \u00a0(I could have sold the app on the App Store too\u2026 probably same effort for me)<\/p>\n \u00a0<\/p>\n EncFSGui is an OSX application, written in C++. \u00a0It relies on the wxWidgets framework for its GUI aspect. \u00a0EncFSGui relies on the presence of certain binaries\/tools on your system and simply launches those tools with the necessary arguments, captures and processes the output. \u00a0In other words, it is a wrapper. It doesn\u2019t implement crypto itself, and it doesn\u2019t implement the creation of a filesystem either, but it merely relies on 2 tools (that are not present on OSX by default): \u00a0encfs and OSXFuse. \u00a0Additionally, it uses standard tools such as \u2018mount\u2019, \u2018umount\u2019 and \u2018expect\u2019. \u00a0To limit the number of dependencies you have to install yourself, EncFSGui is statically linked with wxWidgets and libcurl.<\/p>\n For those of you that are not familiar with encfs and osxfuse:<\/p>\n encfs<\/a> is a free encryption filesystem based on Fuse. \u00a0It is file-based, which means it will transparently encrypt\/decrypt individual files. \u00a0In other words, if a change is made to a single file, only that file will be changed. \u00a0If this encfs-encrypted folder is synchronised to the cloud, only the changed file needs to be updated. \u00a0It uses an arbitrary folder that is configured as being the \u201cencfs\u201d encrypted source folder and uses osxfuse to be mounted into a plaintext version that you can use. This plaintext version behaves like a volume on your system, making it very easy to use. \u00a0 When encfs and osxfuse are installed, you can<\/p>\n osxfuse is the OSX implementation of \u201cFilesystem in Userspace<\/a>\u201d. \u00a0It allows non-privileged users to create their own filesystems, and it is used by encfs to provide the actual filesystem inside the decrypted version of an encfs-encrypted folder. osxfuse is the successor to MacFUSE, which is no longer maintained. \u00a0You can get more information about osxfuse on\u00a0https:\/\/osxfuse.github.io\/<\/a><\/p>\n Since EncFSGui doesn\u2019t provide the actual encryption or filesystem functionality, you can start & stop the tool, without changing the mount state of your encrypted folders. \u00a0Although I agree that a wrapper is not the most exciting hardcore way of building things (as its functionality relies on the arguments and output of the tools it uses), it does have an important advantage over tools such as BoxCryptor Classic and EncFSMP, because you don\u2019t need to keep the app running to keep your volumes mounted. \u00a0At least, I found that to be quite useful in certain cases.<\/p>\n \u00a0<\/p>\n Getting EncFSGui to run on your OSX system is a 4 step process. \u00a0I will try to find a way to change this into a one-step process, without taking away the advantage of not having to keep the tool running to have access to your mounted encfs folders. \u00a0 Anyway, for now, you need to run the 4 steps listed below.<\/p>\n For the record, I have only tried these steps on OSX Yosemite and El Capitan. I don\u2019t know if\/how the procedure would be different on older versions of OSX.<\/p>\n I decided to use Homebrew as the package manager. Before you can install packages, you\u2019ll have to install Homebrew itself. \u00a0If you already did, you can skip this step. (Just make sure homebrew is up-to-date).<\/p>\n In order to be able to use Homebrew and install packages, you\u2019ll need the gcc compiler. On recent versions of OSX, you\u2019ll be prompted to install the xcode command line tools as soon as you try to run \u2018gcc\u2019. \u00a0If that is not the case, you can also install Xcode via the App Store, and then install the command line tools yourself.<\/p>\n So, start by opening a Terminal (command prompt) and run \u2018gcc\u2019. \u00a0 If you get the message \u201cclang: error: no input files\u201d, then gcc is installed correctly. \u00a0 If you are prompted to install the Xcode command line tools, please do so. \u00a0If you don\u2019t have gcc installed and are not getting the prompt, you\u2019ll have to install Xcode first, and then install the command line tools with 'xcode-select --install'<\/p>\n With gcc installed, you can proceed and install Homebrew. \u00a0From a Terminal command prompt, run the following commands:<\/p>\n \u00a0<\/p>\n Installing osxfuse is a lot less complicated. Go to https:\/\/sourceforge.net\/projects\/osxfuse\/files\/ and download the latest version. At the time of writing, the latest version of the 2.x branch is 2.8.3. I don't expect major issues if you decide to run the 3.x version instead, but I have not tested it myself.\u00a0<\/p>\n Anyway, download the latest version (.dmg image file). Open the dmg file and double-click the \"Install OSXFUSE 2.8.pkg\" icon. \u00a0Click through the installation process and you\u2019re done.<\/p>\n With Homebrew installed, this step is as easy as running the following commands. Run only one command at a time, to make sure you can enter your password when asked.<\/p>\n To check if encfs works, run 'encfs --version'. You should get something like this:<\/p>\n \u00a0<\/p>\n To get the latest copy of EncFSGui, download the image file from https:\/\/github.com\/corelan\/EncFSGui\/raw\/master\/release\/EncFSGUI.dmg\u00a0<\/p>\n Open the dmg file and simply drag the \"encfsgui.app\" icon to the \"Applications\" icon. This will copy the .app bundle to your local \/Applications folder. \u00a0Wait for the copy to complete and you\u2019re all set.<\/p>\n If you open Launchpad (or look at the list of installed Applications), you should see the EncFSGui app.<\/p>\n As I am not a registered Apple developer, the application will need your permission to run. When trying to launch EncFSGui, you\u2019ll (most likely) get a warning that looks like this:<\/p>\n If you decide to trust my pre-compiled binary away (i.e. if you don\u2019t feel like compiling the source yourself), and want to overrule the restriction, launch the \u201cSystem Preferences\u201d utility and open \u201cSecurity & Privacy\u201d panel<\/p>\n In the \u201cGeneral\u201d pane, you\u2019ll see a section called \u201cAllow apps downloaded from\u201d. \u00a0In that section, you should see a reference to encfsgui.app, and a button \u201copen anyway\u201d.<\/p>\n Click the button. \u00a0 You\u2019ll get another dialog that asks for confirmation.<\/p>\n Click \u201copen\u201d. \u00a0That\u2019s it. From this point forward, you will be able to run this application without prompts or warnings. \u00a0Please remember to do this each time you update the EncFSGui app.<\/p>\n Note: if you don\u2019t trust my binary, by all means, check the github repository page. It contains all detailed steps on how to set up the development environment. I even provided the Makefile, so you can compile the source code yourself. \u00a0Reproducible builds FTW.<\/p>\n \u00a0<\/p>\n EncFSGui is a standalone binary. \u00a0It stores its configuration inside\u00a0~\/Library\/Preferences, in a file called \u201cencfsgui Preferences\u201d. \u00a0This file gets created by the app, and contains a plain-text \u201cini-file\u201d like structure. \u00a0Despite the fact that it is very easy to read and manipulate the file, it\u2019s highly recommended to never change this file yourself.\u00a0<\/p>\n In addition to this permanent configuration file, EncFSGui might create a temporary file called Tcreateencfs.exp (stored under \/var\/folders\/<random>\/<random\/). This file would be created by EncFSGui when you tell it to create a new encfs encrypted folder. \u00a0It contains an \u201cexpect\u201d based script that will interact with the encfs interactive mode, allow you to specify the required settings for the new encrypted folder. \u00a0The file doesn\u2019t contain the password for the folder. The password is provided as an argument to the script at runtime. \u00a0As the expect script contains folder specific settings, a new file gets created every time you create a new encfs folder in the application.<\/p>\n If the expect script doesn\u2019t contain the right contents (because your encfs binary looks different than mine in terms of output (questions, etc); it might cause the app to hang. \u00a0This is one of the arguments against the use of a wrapper. \u00a0On the other hand, as I am using EncFSGui myself (and since I plan on keeping encfs up-to-date as much as possible), I might detect issues myself and will try to fix them. \u00a0(And yes, I accept pull requests too).<\/p>\n EncFSGui doesn\u2019t like passwords with quotes or double quotes. (It won\u2019t filter them out from the password fields and I will try to find solutions for this). \u00a0 Additionally, EncFSGui will reject spaces, quotes and double quotes from Volume names as well. In fact, EncFSGui will remove those characters from the volume name field before saving the new name.<\/p>\n At startup, EncFSGui will monitor the output of the \u2018mount\u2019 command to capture already mounted volumes. \u00a0If one of the volumes matches with one of the volumes configured in the app, it will mark them as \u201calready mounted\u201d. \u00a0When running, EncFSGui remembers the mount state of all configured volumes inside an array of objects.<\/p>\n Although it would be fairly easy to compile EncFSGui for Linux variants, it does contain some hardcoded paths (such as references to\u00a0~\/Library\/Preferences and\u00a0~\/Library\/LaunchAgents, and default paths for encfs, mount and umount binaries (which can be overruled by editing the settings). \u00a0In any case, it should be doable to update the source and to build in OS checks to determine locations in a more generic way).<\/p>\n Finally, in order to allow EncFSGui to launch at startup (this is a global option that is disabled by default), a file called \u201corg.corelan.encfsgui.LaunchAtLogin.plist\"\u00a0will be created under\u00a0~\/Library\/LaunchAgents. \u00a0This only happens when you enable the option. The file will be removed again when you disable the option again.<\/p>\n \u00a0<\/p>\n Upon launching EncFSGui the first time, you\u2019ll see 2 things: \u00a0The GUI itself, and a taskbar icon. \u00a0The GUI will appear quite empty, with only 4 buttons active: \u201cCreate\u201d, \u201cOpen Existing\u201d, \u201cSettings\u201d and \u201cQuit\u201d.<\/p>\n In the statusbar at the bottom of the window, you\u2019ll see the number of volumes that are configured within EncFSGui. \u00a0On the right hand side, you\u2019ll get encfs specific information. \u00a0If EncFSGUI was not able to find encfs as \/usr\/local\/bin\/encfs (which is the default value in the app), all GUI buttons will be disabled, except for \u201cSettings\u201d and \u201cQuit\u201d. \u00a0You can change the encfs path via Settings.<\/p>\n When you click on the taskbar icon, you\u2019ll get a popup menu that contains the following items:<\/p>\n \u00a0<\/p>\n \u00a0<\/p>\n Let\u2019s take a look at the settings first. \u00a0The current version, at the time of writing, contains the following options:<\/p>\n \u00a0<\/p>\n Most of these options are self-explanatory. \u00a0You can basically set\/change the absolute path to some important binaries. \u00a0To be honest, I will probably keep the one for encfs, but remove the ones for mount and umount, as those are standard binaries (and I could tell EncFSGui to find them by itself). \u00a0This would be in-line with the fact that you can\u2019t set the full path to the \u201cexpect\u201d binary at this time. \u00a0Anyway, things will be updated in this area quite soon.<\/p>\n Next, you can set some startup & exit options:<\/p>\n Clicking \u201cCancel\u201d will ignore any changes you made. \u00a0Clicking \u201cApply\u201d will save the changes and close the dialog as well.<\/p>\n This brings us to the main purpose of the application: managing encrypted folders.<\/p>\n Creating a new encfs folder involves 2 empty folders:<\/p>\n Additionally, you will need to specify a \u201cVolume\u201d name. \u00a0This is just a logical name, but it\u2019s a quite important one:<\/p>\n Fortunately, you can change the name of this volume (as long as it\u2019s not mounted). \u00a0 Don\u2019t use spaces, quotes or double quotes in this name. \u00a0Keep things simple and relevant.<\/p>\n In addition to specifying a volume name, and the 2 folder locations, you have to select an EncFS profile. \u00a0This profile determines the strength of the crypto that will be used for this folder, and thus the performance as well. \u00a0I tried to take balanced decision around the 3 presets, but if you disagree with my choices, you can always use the \u201ccustom\u201d profile to set your own preferences. \u00a0Keep in mind that you cannot change these settings afterwards. You can find more details about some of these settings (and their impact on security vs performance) in the encfs man page.<\/p>\n The first time you open the \u201cCreate\u201d feature, EncFSGui will populate the supported Filename encoding mechanisms for your device. \u00a0The most common ones are \u201cStream\u201d, \u201cBlock\u201d and \u201cNull\u201d. \u00a0On some devices, you might see \u201cBlock32\u201d as well. \u00a0 If you plan on sharing the encfs folder on multiple systems (e.g. via Dropbox\/SugarSync\/or other cloud sync platforms), make sure to check if the filename encoding mechanism is supported on all systems.<\/p>\n Next, you\u2019ll need to enter a password for the encfs encrypted folder. \u00a0This password is used to access the key that is used to encrypt\/decrypt the encfs folder. \u00a0In other words, you can change the password later (using the \u2018encfsctl\u2019 tool), without having to decrypt and re-encrypt all files. \u00a0I have not implemented the ability to change the password of the encfs folder yet, but I will. \u00a0As you can see in the screenshot above, you have the option to store the password into the Keychain. \u00a0EncFSGui uses the login.keychain to do so, and stores the password under \u201cEncFSGUI_<volumename>\u201d. \u00a0If you have changed the password of the encfs folder with encfsctl, you can update the password in keychain using the \u201cEdit\u201d functionality in EncFSGui.<\/p>\n Finally, you can set 2 mount-related options. \u00a0You can tell EncFSGui to automatically mount the volume when EncFSGui starts (unless the volume is already mounted). \u00a0 You can also prevent this volume from being unmounted automatically when you close the app. \u00a0This could be helpful if you have set the global option to automatically unmount volumes when you close the app, and if you want to overrule that setting for this specific volume.<\/p>\n When you click \u201cApply\u201d, EncFSGui will construct an \u201cexpect\u201d script and launch the script, feeding it the password as an argument. \u00a0It will wait for \u201cexpect\u201d to complete, and will check if a file called .encfs6.xml was created in the encfs encrypted folder. \u00a0This file contains the encfs configuration for that folder. \u00a0Never change this file yourself, as you will most likely break things. \u00a0 Make sure to keep a copy somewhere, as you will not be able to mount the encfs folder anymore if the file is gone or corrupt.<\/p>\n If all went well, the new encfs folder is created, and added into EncFSGui. \u00a0 It will not be mounted at this time.<\/p>\n If you select a line in the table, some of the other buttons will become visible: Browse, Remove, Info and Edit.<\/p>\n If you click \u201cInfo\u201d, you can see the output of running \u201cencfsctl\u201d against the encrypted folder:<\/p>\n \u00a0<\/p>\n \u00a0<\/p>\n To mount an encfs folder as a plaintext volume, simply select the corresponding line in the table, and click the \u201cMount & expose\u201d button. \u00a0Unless you have configured EncFSGui to store the password in Keychain, you will be prompted to enter the password. \u00a0EncFSGui will then craft an encfs command, feeding it the password, in an attempt to mount the selected folder. \u00a0<\/p>\n When the volume is mounted (confirmed by checking the output of the \u201cmount\u201d command), the table will indicate that the folder is mounted. \u00a0The \u201cMounted\u201d column will indicate \u201cYES\u201d and the color of the line will turn red instead of blue.<\/p>\n EncFSGui will prompt for a password up to 5 times before giving up. \u00a0There\u2019s no point in adding more \u201cbruteforce\u201d protection, as things can be easily scripted via encfs as well. \u00a0Why bother closing a gate if there is no fence.<\/p>\n \u00a0<\/p>\n To unmount, simply select the line of a mounted volume, and use the \u201cUnmount & lock\u201d button. \u00a0Make sure to close any open files first, to avoid data loss.<\/p>\n Note: you can mount and unmount volumes directly from the taskbar icon popup-menu.\u00a0<\/p>\n Again, as explained, unless you have configured EncFSGui to automatically unmount folders when you close the app, closing the app won\u2019t have any effect on the mount status of your encfs folders. \u00a0If you open the app again, it should automatically pick up the mount status by looking at the output of the \u201cmount\u201d command.<\/p>\n In addition to creating a brand new encfs folder, you can also add already existing encfs folders to EncFSGui. \u00a0This would, for example, allow you to open BoxCryptor Classic folders with EncFSGui. \u00a0 The current version of EncFSGui will check if the specified encfs folder contains the .encfs6.xml file to determine if this is a valid encfs folder before adding it into EncFSGui. \u00a0(Of course, the presence of the file doesn\u2019t guarantee that the file is valid).<\/p>\n The \u201cOpen Existing\u201d dialog looks like this:<\/p>\n As you can see, it looks quite similar to the \u201cCreate a new encfs folder\u201d dialog, with the exception of the ability to set the crypto settings. \u00a0After all, we cannot change any of those settings after an encfs folder was created already. \u00a0The other options should be self-explanatory (as they are the same as the ones in the \u201ccreate a new encfs folder\u201d dialog).<\/p>\n Clicking \u201cApply\u201d won\u2019t change anything to the mount status.<\/p>\n \u00a0<\/p>\n EncFSGui allows you to change some settings related with the encfs volume (but not with the encfs configuration itself). \u00a0The ability to change certain things is defined by the mount status of the volume at the time of edit.<\/p>\n For an already mounted volume, you can only update the Keychain password (in case you have changed the underlying encfs password yourself). You can remove the keychain password if one was set, or add the password to Keychain if it was not set yet. \u00a0Additionally, you can change the mount options.\u00a0<\/p>\n For non-mounted volumes, you can also change the volume name (but it has to be unique within EncFSGui), and change the mount location (i.e. the location where the plaintext version of the encfs encrypted folder will be mounted at).\u00a0<\/p>\n You can edit a folder via the \u201cEdit\u201d button. \u00a0For non-mounted volumes, you can also double-click the entry in the table, which will show the \u201cEdit\u201d dialog.<\/p>\n If you don\u2019t know where to look for the mounted (plaintext) volume, you can browse\/open it via the \u201cBrowse\u201d button. \u00a0 Double-clicking a mounted volume in the table will trigger the same thing.<\/p>\n \u00a0<\/p>\n Well, I don\u2019t know. \u00a0EncFSGui is not saving the password, but it is processing it, and will use it as an argument to the \u201cexpect\u201d script in case you are creating a new encfs folder, and it will also echo it to encfs when mounting a volume. \u00a0If you believe this is not safe enough for you, mount your folders manually with the encfs command line tool.\u00a0<\/p>\nWhat is it ?<\/h2>\n
\n
Installing EncFSGui<\/h2>\n
1. Install homebrew<\/h3>\n
ruby -e \"$(curl -fsSL https:\/\/raw.githubusercontent.com\/Homebrew\/install\/master\/install)\"\nsudo chown -R $(whoami) \/usr\/local\/lib\nbrew doctor<\/pre>\n
2. Install osxfuse<\/h3>\n
3. Install encfs<\/h3>\n
brew update\nsudo chown -R $USER:admin \/usr\/local\/include\nsudo chown -R $USER:admin \/usr\/local\/lib\/pkgconfig\nbrew link xz libtool boost rlog\nbrew doctor\nbrew install homebrew\/fuse\/encfs<\/pre>\n
corelanc0d3r@~: # encfs --version\nencfs version 1.8.1<\/pre>\n
4. Install EncFSGui<\/h3>\n
![\"encfsguidmg.png\"](\"https:\/\/www.corelan.be\/wp-content\/uploads\/2016\/01\/encfsguidmg-1.png\" "\\"encfsguidmg.png\\"")
<\/p>\n![\"appicon\"](\"https:\/\/www.corelan.be\/wp-content\/uploads\/2016\/01\/appicon-1.png\" "\\"appicon.png\\"")
<\/p>\n![\"unidentified\"](\"https:\/\/www.corelan.be\/wp-content\/uploads\/2016\/01\/unidentified-1.png\" "\\"unidentified.png\\"")
<\/p>\n![\"secandpriv\"](\"https:\/\/www.corelan.be\/wp-content\/uploads\/2016\/01\/secandpriv-1.png\" "\\"secandpriv.png\\"")
<\/p>\n![\"open_anyway\"](\"https:\/\/www.corelan.be\/wp-content\/uploads\/2016\/01\/open_anyway.png\" "\\"open_anyway.png\\"")
<\/p>\n![\"areyouok\"](\"https:\/\/www.corelan.be\/wp-content\/uploads\/2016\/01\/areyouok.png\" "\\"areyouok.png\\"")
<\/p>\nEncFSGui technicalities<\/h2>\n
Using EncFSGui<\/h2>\n
GUI<\/h3>\n
![\"gui1\"](\"https:\/\/www.corelan.be\/wp-content\/uploads\/2016\/01\/gui1.png\" "\\"gui1.png\\"")
<\/p>\n![\"popup1\"](\"https:\/\/www.corelan.be\/wp-content\/uploads\/2016\/01\/popup1.png\" "\\"popup1.png\\"")
<\/p>\nSettings<\/h3>\n
![\"settings1\"](\"https:\/\/www.corelan.be\/wp-content\/uploads\/2016\/01\/settings1.png\" "\\"settings1.png\\"")
<\/p>\n\n
Creating a new encfs encrypted folder<\/h3>\n
\n
\n
![\"create1\"](\"https:\/\/www.corelan.be\/wp-content\/uploads\/2016\/01\/create1.png\" "\\"create1.png\\"")
<\/p>\n![\"created1\"](\"https:\/\/www.corelan.be\/wp-content\/uploads\/2016\/01\/created1.png\" "\\"created1.png\\"")
<\/p>\n![\"info1\"](\"https:\/\/www.corelan.be\/wp-content\/uploads\/2016\/01\/info1.png\" "\\"info1.png\\"")
<\/p>\nMounting and unmounting folders<\/h3>\n
![\"mount1\"](\"https:\/\/www.corelan.be\/wp-content\/uploads\/2016\/01\/mount1.png\" "\\"mount1.png\\"")
<\/p>\n![\"mount2\"](\"https:\/\/www.corelan.be\/wp-content\/uploads\/2016\/01\/mount2.png\" "\\"mount2.png\\"")
<\/p>\n![\"mount3\"](\"https:\/\/www.corelan.be\/wp-content\/uploads\/2016\/01\/mount3.png\" "\\"mount3.png\\"")
<\/p>\nAdding an already existing encfs folder to EncFSGui<\/h3>\n
![\"add1\"](\"https:\/\/www.corelan.be\/wp-content\/uploads\/2016\/01\/add1.png\" "\\"add1.png\\"")
<\/p>\nEditing a volume<\/h3>\n
![\"edit1\"](\"https:\/\/www.corelan.be\/wp-content\/uploads\/2016\/01\/edit1.png\" "\\"edit1.png\\"")
<\/p>\nBrowsing a volume<\/h3>\n
FAQ<\/h2>\n
1. Is the password of my encfs folder safe?<\/h4>\n
2. Sometimes, EncFSGui doesn\u2019t seem to be able to unmount my volume<\/h4>\n