blob: 5f2ae47efce25305d19efd429814cb288b93f045 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
|
% GOCRYPTFS(1)
% github.com/rfjakob
% May 2016
NAME
====
gocryptfs - mount an encrypted directory
SYNOPSIS
========
Initialize encrypted filesystem
-------------------------------
gocryptfs -init [OPTIONS] CIPHERDIR
Mount
-----
gocryptfs [OPTIONS] CIPHERDIR MOUNTPOINT
Change password
---------------
gocryptfs -passwd [OPTIONS] CIPHERDIR
DESCRIPTION
===========
Options:
**-allow_other**
: By default, the Linux kernel prevents any other user (even root) to
access a mounted FUSE filesystem. Settings this option allows access for
other users, subject to file permission checking. Only works if
user_allow_other is set in /etc/fuse.conf. This option is equivalent to
"allow_other" plus "default_permissions" described in fuse(8).
**-config string**
: Use specified config file instead of CIPHERDIR/gocryptfs.conf
**-cpuprofile string**
: Write cpu profile to specified file
**-d, -debug**
: Enable debug output
**-diriv**
: Use per-directory file name IV (default true)
This flag is useful when recovering old gocryptfs filesystems using
"-masterkey". It is ignored (stays at the default) otherwise.
**-emenames**
: Use EME filename encryption (default true), implies diriv.
This flag is useful when recovering old gocryptfs filesystems using
"-masterkey". It is ignored (stays at the default) otherwise.
**-extpass string**
: Use an external program (like ssh-askpass) for the password prompt.
The program should return the password on stdout, a trailing newline is
stripped by gocryptfs. Using something like "cat /mypassword.txt" allows
to mount the gocryptfs filesytem without user interaction.
**-f**
: Stay in the foreground instead of forking away.
**-fusedebug**
: Enable fuse library debug output
**-gcmiv128**
: Use an 128-bit IV for GCM encryption instead of Go's default of
96 bits (default true). This pushes back the birthday bound for IV
collisions far enough to make it irrelevant.
This flag is useful when recovering old gocryptfs filesystems using
"-masterkey". It is ignored (stays at the default) otherwise.
**-init**
: Initialize encrypted directory
**-longnames**
: Store names longer than 176 bytes in extra files (default true)
This flag is useful when recovering old gocryptfs filesystems using
"-masterkey". It is ignored (stays at the default) otherwise.
**-masterkey string**
: Mount with explicit master key specified on the command line. This
option can be used to mount a gocryptfs filesystem without a config file.
Note that the command line, and with it the master key, is visible to
anybody on the machine who can execute "ps -auxwww".
**-memprofile string**
: Write memory profile to specified file. This is useful when debugging
memory usage of gocryptfs.
**-nosyslog**
: Diagnostic messages are normally redirected to syslog once gocryptfs
daemonizes. This option disables the redirection and messages will
continue be printed to stdout and stderr.
**-notifypid int**
: Send USR1 to the specified process after successful mount. This is
used internally for daemonization.
**-openssl bool**
: Use OpenSSL instead of built-in Go crypto (default "auto"). Using
built-in crypto is 4x slower unless your CPU has AES instructions and
you are using Go 1.6+. In mode "auto", gocrypts chooses the faster
option.
**-passwd**
: Change password
**-plaintextnames**
: Do not encrypt file names
**-q, -quiet**
: Quiet - silence informational messages
**-ro**
: Mount the filesystem read-only
**-scryptn int**
: scrypt cost parameter logN. Setting this to a lower value speeds up
mounting but makes the password susceptible to brute-force attacks (default 16)
**-version**
: Print version and exit
**-wpanic**
: When encountering a warning, panic and exit immediately. This is
useful in regression testing.
**-zerokey**
: Use all-zero dummy master key. This options is only intended for
automated testing as it does not provide any security.
EXAMPLES
========
Create and mount an encrypted filesystem:
mkdir /tmp/g1 /tmp/g2
gocryptfs -init /tmp/g1
gocryptfs /tmp/g1 /tmp/g2
SEE ALSO
========
fuse(8)
|
