If you want to use store stuff data, put it in a Tomb, the crypt undertaker. For remote SSHFS can help you. An SSH server is a pretty common piece of software, by default on all Linux hosts and SSHFS allows you to mount the remote filesystem via SSH.

You may skip and rather how to get started

The good

It's encryption, and can burry things into all sort of non usual suspect files too.

• Easy to Set Up: Even to facilitates syncing Tomb between computers.

The bad

• Not Suitable for Real-Time Sharing: The same Tomb cannot be opened by two different computers in read/write mode simultaneously.

The ugly

• Not many seem to know about it.

HOWTO SSHFS

1. Copy your Tomb to the remote server via SCP:

   scp /path/to/yourthings.tomb user@remote.host:/

2. Install SSHFS on your system. For example, on Debian:

   sudo apt-get install sshfs

3. Mount the remote file system locally:

   sshfs -o allow_root user@remote.host:/ /local/mountpoint/

4. Open your Tomb:

   tomb open /local/mountpoint/yourthings.tomb -k /path/to/key

That is it. keep going for autosync, or skip to how to get started.

Tomb Autosync via SSHFS

Disclaimer

The code in this section is for users who understand it and are willing to debug.

Scenario

Have two laptops: a big one and a netbook, and we need to share a Tomb with personal settings and data.

Description

We can't use a "shared" Tomb because it cannot be mounted by more than one computer simultaneously. Tomb has no built-in locking mechanism, so we need an external lock.

Process

1. Acquire the lock
2. Mount the remote Tomb
3. Use Unison to sync
4. Unmount
5. Release the lock

The (not so) HORRIBLE bashing

Login Script

#!/bin/bash
# LOGIN SCRIPT

lockfile="/local/mountpoint/tomb.lock"
imgpath=$(zenity --file-selection --text='Choose an image file with an embedded key' --title='Select File')
tomb exhume /tmp/local.tomb $imgpath

(flock 5
if ! tomb open /path/to/local.tomb -k /tmp/local.tomb.key; then
    zenity --error --text='Impossible to mount local tomb!' --title='Horror!'
    return 1
else
    zenity --notification --text='Local tomb correctly mounted'
fi

if sshfs remote.server:/ /local/mountpoint/; then
    tomb open /local/mountpoint/remote.tomb -k /tmp/local.tomb.key
    zenity --notification --text='Remote tomb correctly mounted'
else
    zenity --error --text='Impossible to mount remote tomb!' --title='Horror!'
    return 1
fi
) 5> $lockfile

Post-Hook in Remote Tomb

#!/bin/bash
# POST-HOOK IN REMOTE TOMB

remotetomb="/media/remote.tomb/"
localtomb="/media/local.tomb/"

if unison $remotetomb $localtomb; then
    zenity --notification --text='Data sync success'
else
    zenity --error --text='Data sync failed!' --title='Horror!'
    return 1
fi

Logout Script

#!/bin/bash
# LOGOUT SCRIPT

lockfile="/local/mountpoint/tomb.lock"
wipe -f -s /tmp/local.tomb.key

(flock 5
if tomb close all; then
    zenity --notification --text='Tombs closed, your bones will rest in peace.'
else
    zenity --error --text='Problems closing tombs!' --title='Horror!'
    return 1
fi
) 5> $lockfile

Cron Script

#!/bin/bash
# CRON SCRIPT

remotetomb="/media/remote.tomb/"
localtomb="/media/local.tomb/"
lockfile="/local/mountpoint/tomb.lock"

(flock 5
if !ping -c 1 remote.server; then
    return 1
elif !mountpoint /local/mountpoint/; then
    if sshfs remote.server:/ /local/mountpoint/; then
        tomb open /local/mountpoint/remote.tomb -k /tmp/local.tomb.key
        unison $remotetomb $localtomb
    fi
fi
) 5> $lockfile

Using Tomb with Cloud Storage: TombDropbox

Using Tomb with Dropbox to securely store data in the cloud is coo, but has some limitations. Some are Tomb's fault, others Dropbox's.

Limitations

• Cannot open a Tomb from two different places simultaneously.
• Syncing changes to Dropbox is slow because Dropbox doesn't handle deltas well. This limitation is mitigated when using programs like SSHFS, rsync, or SparkleShare.

Why

The cloud can be useful, but storing personal data on remote servers can compromise privacy. Using Tomb with Dropbox can help you benefit from cloud storage without sacrificing privacy.

HOWTO

1. Create a Tomb:

   tomb create -s X <tomb-name>

2. Move the Tomb encryption key to a secure place:

   mv <tomb-name>.tomb.key /secure/place/

3. Move the Tomb file to a Dropbox shared directory:

   mv <tomb-name>.tomb /dropbox/shared/directory/

4. To access the Tomb:

   tomb -k /secure/place/<tomb-name>.tomb.key open /dropbox/shared/directory/<tomb-name>.tomb

Your Tomb will be accessible in the media directory:

/media/<tomb-name>.tomb/

Enjoy secure cloud storage!

Hide secrets in photos

• Hide the Key
• Extract a Hidden Key
• Hooks
• Bind Hooks
• Post Hooks
• Other avanced features

Hide the Key

To hide the key inside an image file (JPEG):

tomb bury -k /path/to/key /path/to/file.jpg

Extract a Hidden Key

To extract a pre-hidden key:

tomb exhume -k /path/to/key /path/to/file.jpg

Hooks

Hooks are special files that trigger actions when a Tomb is opened or closed.

Bind Hooks

To securely store directories in a Tomb while keeping them in their original locations:

1. Move the directories to the Tomb's root.
2. Create a bind-hooks file in the Tomb's root with paths relative to the Tomb and $HOME.

Example bind-hooks files:

mail     Mail     documents     Documents

Post Hooks

To execute a script or binary after opening a Tomb, create a post-hooks file in the Tomb's root.

Example post-hooks file:

#!/bin/sh
<your preferred text editor> todolist.txt

Now that you know how to do cool things with Tomb, here is how to get started

How Tomb Works

Tomb’s hidden file encryption generates encrypted storage folders opened and closed using key files protected by a user-chosen password. Tomb files are indistinguishable and can be safely renamed, transported, and hidden.

The keys should be kept separate, e.g., Tomb file on the hard disk and key files on a USB stick. Once open, a Tomb looks like a folder.

make install

tomb dig -s 100 secret.tomb
tomb forge secret.tomb.key
tomb lock secret.tomb -k secret.tomb.key

tomb open secret.tomb -k secret.tomb.key

tomb close

tomb slam all

ssh me@dyne.org 'cat my.tomb.key' | tomb open my.tomb -k  
# -k - tells tomb to take the key from stdin.

sshfs -o allow_root me@dyne.org:/ /mnt/cloud/
tomb open /mnt/cloud/my.tomb -k my.key

tomb bury
tomb exhume

tomb engrave

lo=$(losetup -f)
losetup -f secret.tomb
gpg -d secret.key | head -c -1 | cryptsetup --key-file - luksOpen $lo secret
mount /dev/mapper/secret /mnt

umount /

mnt
cryptsetup luksClose secret
losetup -d $lo