Private network storage for my users?
from talkingpumpkin@lemmy.world to selfhosted@lemmy.world on 23 Jan 08:05
https://lemmy.world/post/42051701

I’d like to give my users some private network storage (private from me, ie. something encrypted at rest with keys that root cannot obtain).

Do you have any recommendations?

Ideally, it should be something where files are only decrypted on the client, but server-side decryption would be acceptable too as long as the server doesn’t save the decryption keys to disk.

Before someone suggests that, I know I could just put lucks-encrypted disk images on the NAS, but I’d like the whole thing to have decent performance (the idea is to allow people to store their photos/videos, so some may have several GB of files).

#selfhosted

threaded - newest

just_another_person@lemmy.world on 23 Jan 08:13 next collapse

There’s dozens out there, but the bigger question is: what’s your current hosting setup? What NAS are you running?

It would be simpler to just run something that your NAS platform supports already or has a mobile app for. Pretty much every solution you’ll find with e2e encryption is going to have its own client.

avidamoeba@lemmy.ca on 23 Jan 08:50 next collapse

LUKS-encrypted images won’t have bad performance. Could also use VeraCrypt or something like that for better portability if you need cross-platform function. Expose the folders where the images are stored via NFS/SAMBA. Flexible and portable solution.

You could expose volumes with iSCSI and format/mount them on the clients. Probably don’t want to do that.

E:

LUKS-encrypted images won’t have bad performance.

Actually it depends whether the underlying network fs can do partial writes. I imagine both NFS and SAMBA can. If the file has to be fully rewritten with every change, then perf would be dead.

just_another_person@lemmy.world on 23 Jan 08:55 collapse

Those aren’t end-to-end encrypted from the user, and would need to be mounted on the local system with a key that is unique to each user. Not exactly user-friendly if supporting multiple users.

There are plenty of other solutions meant for the purpose OP is asking about.

avidamoeba@lemmy.ca on 23 Jan 09:04 collapse

Not sure I’m getting you and probably didn’t explain myself well. Here’s what I mean:

  • Host exposes a network share (1-time setup)
  • Client mounts the network share (N-time setup, could be automated)
  • Client creates a LUKS or VeraCrypt (or something else) file in that network share, secured with their key. The key is generated on the client and it doesn’t leave the client or enter the host. (1-time setup)
  • Client decrypts the image with their key and mounts it on the client (N-time setup, can be automated)
  • Client modifies data in the decrypted vol
  • Client unmounts the volume (N-time, not required)
  • Client unmounts the network share (N-time, not required)

At no point does the client’s key leave their computer and the host only ever sees encrypted data.

Subsequent uses without automation:

  • Client mounts network share
  • Client decrypts volume

That’s at least how I understood OP’s suggestion for putting LUKS images on the NAS and that is secure indeed. They’re worried about performance.

just_another_person@lemmy.world on 23 Jan 11:05 collapse

OP said they DON’T want LUKS. I’m also missing how the admin of the server (OP) wouldn’t have or store the keys unless and have these mounts available at all times?

You seem to be suggesting there is some way for a remote user to mount a LUKS image on its host, which is not a thing unless you’re first SSH’ing to said host and mounting it and making it available for export mount elsewhere, which is clearly not what OP is asking for here when they just want space for people to store media. Maybe I’m misunderstanding.

There Hook, Filen, Yeetfile, BatchIT…tons of these self-hosted stacks that do this with auth and user management built in. That’s what OP is asking about.

avidamoeba@lemmy.ca on 23 Jan 11:16 collapse

The host mounts no LUKS. The host just exports a network share via NFS. The client mounts that NFS share to a local mount pount. Then the client has a dir which actually resides on the host. So far completely standard NAS stuff. Then the client creates a file in that dir. E.g. secretcontainer.img. This file is then encrypted on the client using cryptsetup (LUKS). Then it’s mounted on the client using LUKS. All the LUKS stuff happens on the client. The only interaction with the host is throgh NFS. The host just sees a file appear called secretcontainer.img on its storage. The same idea would work with VeraCrypt instead of LUKS. Or Cryptomator. Or anything else that can store encrypted data in file(s) in a directory.

LUKS can be used on a single file where the file acts as a disk device.

Also what I’m describing here is bog-standard Linux functionality that’s existed at least for 2 decades. Nothing fancy. It’s stuff that’s good to know so I’d be happy to answer questions.

E:

The procedure on the client is roughly:

cd /network/share/mountpoint
fallocate -l 1G test.img
cryptsetup luksFormat test.img
cryptsetup open test.img test_decrypted
mkfs.ext4 /dev/mapper/test_decrypted
mount /dev/mapper/test_decrypted /mnt

Once that’s done, subsequent uses are:

cryptsetup open test.img test_decrypted
mount /dev/mapper/test_decrypted /mnt

Of course that can be automated further.

Just tested it in a local dir and it works fine. The only difference between that and the real scenario is whether test.img resides on a network mount or local disk. Since the network mounts behave like normal disks, everything else works the same. The only concern is what the performance would be, which depends on how the underlying network fs handles reads/writes to test.img. E.g. if you change 0.5MB, does it send that 0.5MB or does it rewrite the whole 1GB file. When reading, does it have to read the whole 1GB file or just parts of it as needed. Etc.

just_another_person@lemmy.world on 23 Jan 12:00 collapse

Bud…been doing this for 20 years. Don’t need your explainer.

The fact you didn’t mention the barest of minimums in your comment if where the issue lies. You’re just adding stacks on stacks of things by using any other network mount and having the user manage an encrypted image inside that mount. Also absent from what you were trying to explain. I’d work on that.

Point being, for a multi-user/tenant utility like OP is asking for, there are better tools for the job, of which I just named a couple standalone options. If they are running TrueNAS, Synology, or QNAP, or even NextCloud, there are already built-ins for this purpose, and apps to match.

If not, any of the other solutions I mentioned are much better suited for the use-case, especially, and if not only because, OP specifically said they DID NOT want exactly what you’re describing.

avidamoeba@lemmy.ca on 23 Jan 12:14 collapse

The fact you didn’t mention the barest of minimums in your comment if where the issue lies.

I described the procedure step-by-step mentioning each layer. That’s the best I could do.

OP specifically said they DID NOT want exactly what you’re describing.

OP said they’re worried about performance with this solution. Hence why my first response addressed the performance issue. The rest was responding to you (and anyone else who is reading) since you thought that is not an E2E solution. I tried explaining why it’s client-side encryption and no keys are stored on the host.

bowroat@infosec.pub on 23 Jan 09:03 next collapse

Resilio sync, using encrypted shares

irmadlad@lemmy.world on 23 Jan 09:11 next collapse

The first thing that pops into my paranoid brain is: How well do you trust these ‘users’? Personally, I would have to implicitly trust someone to be able to allow them even a few kb on my server.

talkingpumpkin@lemmy.world on 23 Jan 11:36 collapse

IDK how much I’d trust them with tech stuff (not much, definitely). However I don’t see how encrypted storage may become an attack vector?

I mean, they could clog up the HDDs with crap, but they can already do that via non-encrypted network storage (and in several other ways).

irmadlad@lemmy.world on 23 Jan 12:16 collapse

However I don’t see how encrypted storage may become an attack vector?

Not an attack vector. I’m speaking more towards the content of what they will be storing on your server.

francois@jlai.lu on 23 Jan 12:53 collapse

Can the hoster be liable for illegal content stored on their server if they have no way to decrypt the files?

irmadlad@lemmy.world on 23 Jan 13:10 collapse

There are Safe Harbor laws, however, these vary by jurisdiction, country, etc. It would be a litigation I wouldn’t want to get involved in. I’m not crapping on your deployment idea. I’m just very cautious…perhaps overly cautious.

asbestos@lemmy.world on 23 Jan 09:17 next collapse

Share a drive with each user via SMB and tell them to use Cryptomator

avidamoeba@lemmy.ca on 23 Jan 09:34 collapse

Cryptomator encrypts files individually right?

E:

For the curious like me, here’s how Cryptomator makes a directory with multiple encrypted files appear as a single vol when decrypted. From mount:

fuse-nio-adapter on $HOME/.local/share/Cryptomator/mnt/test type fuse.fuse-nio-adapter (rw,nosuid,nodev,relatime,user_id=1000,group_id=1000)

It uses its own fuse module to present it as a volume. The real directory has its own file structure:

~/test/test$ find
.
./c
./vault.cryptomator
./vault.cryptomator.12A05032.bkup
./d
./d/LO
./d/LO/AYYSWMZO35ASQ2HOACU3I7LRVIAMH4
./d/LO/AYYSWMZO35ASQ2HOACU3I7LRVIAMH4/PmAyroZAF5W7kGoHxr3Fhi-NeQIeO7SZcufE.c9r
./d/LO/AYYSWMZO35ASQ2HOACU3I7LRVIAMH4/dirid.c9r
./IMPORTANT.rtf
./masterkey.cryptomator.7DB56291.bkup
./masterkey.cryptomator

This looks like a good option. Perhaps more flexible than using LUKS/VeraCrypt file, but those should work too if the underlying dir is on NFS/SAMBA.

irmadlad@lemmy.world on 23 Jan 12:32 collapse

Plus, the cryptomater ‘containers’ are portable.

avidamoeba@lemmy.ca on 23 Jan 13:21 collapse

Yup. VeraCrypt is also portable but it would play badly with web-backed storage that uploads/downlaods whole files. Would only be usable on local NAS storage. That said, I’m curious to see how Cryptomator performs on local NAS for high-perf applications compared to VC or LUKS. E.g. if you want to have a large photo collection with Immich on top of it. 😀 Sadly I don’t have NAS anymore to test it out.

Decronym@lemmy.decronym.xyz on 23 Jan 09:25 next collapse

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:

Fewer Letters More Letters
NAS Network-Attached Storage
NFS Network File System, a Unix-based file-sharing protocol known for performance and efficiency
SMB Server Message Block protocol for file and printer sharing; Windows-native
SSH Secure Shell for remote terminal access

4 acronyms in this thread; the most compressed thread commented on today has 8 acronyms.

[Thread #1015 for this comm, first seen 23rd Jan 2026, 17:25] [FAQ] [Full list] [Contact] [Source code]

avidamoeba@lemmy.ca on 23 Jan 11:36 next collapse

OP, test the performance of LUKS image, VeraCrypt (if entertaining that) and Cryptomator and tell us how they perform! 😁

You could run a small set of fio runs to test sequential, random and parallel perf.

kokomo@lemmy.kokomo.cloud on 23 Jan 12:41 collapse

Nextcloud has server-side encryption where there are user keys? docs.nextcloud.com/…/encryption_configuration.htm…