Encrypted filesystem on a remote host using "cryptmount"

(A) Assumptions

  * Remote machine is called "rmach"
  * User login on the local machine is "luser"
  * User login on the remote machine is "ruser"
  * No firewall (otherwise an error "read: connection reset by peer"
    can occur).
  * SSH public key of user "luser" is present in
      ~ruser/.ssh/authorized_keys
    on "rmach"
  * User "luser" is a member of the "fuse" group, to allow reading of
      /etc/fuse.conf
  * Option
      user_allow_other
    is enabled in
      /etc/fuse.conf


(B) Preparing a "virtual device" (operations to be performed once)

  The following must be performed as the ordinary user on the
  local machine.

    1. Mount the remote home on the local machine:
         $ mkdir -p mnt/remote
         $ sshfs ruser@rmach: mnt/remote

    2. Create a 100 GB (sparse) file that will contain the filesystem:
         $ cd mnt/remote
         $ truncate -s 100G virtual_disk.img

    3. Release the mount point:
         $ cd
         $ fusermount -u mnt/remote

    4. Define a mount point whose contents will be stored encrypted, e.g.
         $ mkdir enc_remote


  The following must be performed as "root" on the local machine.

    5. Create an entry in "/etc/cryptmount/cmtab"

       luser_data {
         dev=/home/luser/mnt/remote/virtual_disk.img
         dir=/home/luser/enc_remote
         loop=auto
         fstype=ext4     mountoptions=defaults
         cipher=aes-cbc-plain
         keyformat=luks
       }

    6. Mount the remote filesystem:
        # cd ~luser
        # sshfs -o IdentityFile=~luser/.ssh/id_rsa ruser@rmach: mnt/remote

    7. Prepare the encrypted device (setting the password to access the
       encrypted filesystem data):
        # cryptmount --prepare luser_data

    8. Create the filesystem (must be same as defined in the "cmtab" entry)
        # mkfs.ext4 /dev/mapper/luser_data
        # chown luser.luser 

    9. Finalize:
        # cryptmount --release luser_data

   10. Mount encrypted filesystem in order to set appropriate ownership:
        # cryptmount luser_data
        # chown luser.luser /home/luser/enc_remote
   
   11. Release all resources:     
        # cryptmount -u luser_data
        # fusermount -u mnt/remote


(C) Saving data to the remote encrypted filesystem

  1. Mounting the remote home (as an ordinary user):
      $ sshfs -o allow_root ruser@rmach: mnt/remote

  2. Mounting the encrypted filesystem (password will be requested):
      $ cryptmount luser_data

  3. Checking the available space on the encrypted filsystem:
      $ df -k enc_remote
