How secure is encfs

brute-force-attacksencrypting-file-systempasswordsshfs

Like others on this site, I am considering using encfs + sshfs for secure offsite backups. I am wondering how robust encfs is to brute force attacks? Do some users use the –stdinpass command with a file to make it harder to crack?

Thanks

Best Answer

Depending on the reliability of your password (how secure it is), it should be effectively unbreakable. It uses high grade encryption from everything I could find.

Note that storing the password on the system you are running encfs on will make it useless. That is, if you store the password in a file on the system itself, it won't take long for an attacker to find it and use it.

If you must store it somewhere, try a USB flash drive, or type it.

Related Solutions

Proving Password Security to Non-Mathematicians – Standard Methods

Using fail2ban with the iptables is a great way.

Here is the math for you:

Mixed upper and lower case alphabet and common symbols, 8 characters long, gives you 2.9 quadrillion conbinations and with 10,000 attempts a second will take 9,488 years. Thats the maximum of course - expect your password to be cracked in 4000 years. 1000 years if you're not feeling lucky.

As you can see you shouldn't have any issues if you do a 15 character password like:

dJ&3${bs2ujc"qX

Debian – Use iptables rate limiting to temporarily block FTP server brute-force attempts

iptables -A INPUT -p tcp -m state --state NEW --dport 21 -m recent --name ftpattack --set
iptables -A INPUT -p tcp --dport 21 -m state --state NEW -m recent --name ftpattack --rcheck --seconds 60 --hitcount 4 -j LOG --log-prefix 'FTP REJECT: '
iptables -A INPUT -p tcp --dport 21 -m state --state NEW -m recent --name ftpattack --rcheck --seconds 60 --hitcount 4 -j REJECT --reject-with tcp-reset

these rules near or at the top of your ruleset will allow only three connections to port 21, from any given IP address, in a rolling 60-second window. To allow n, use --hitcount n+1; to use a bigger window than 60 seconds, increase --seconds 60.

Best Answer

Related Solutions

Proving Password Security to Non-Mathematicians – Standard Methods

Debian – Use iptables rate limiting to temporarily block FTP server brute-force attempts

Related Topic