Linux – How to encrypt Linux (Debian 8) post-installation and what are the consequences

You can use EncFS on top of NFS

encfs /encrypted_place_at_nfs /mnt/place_to_access_it_unencrypted

I'm seeing a sketch of a solution using Samba "logon scripts" - client-side code that runs after a samba login - but a complete solution needs to complete the sketch with details. Also related are "preexec scripts" - server-side code that runs during a samba login.

Referencing the smb.conf man page

logon script (G)

This parameter specifies the batch file (.bat) or NT command file (.cmd) to be downloaded and run on a machine when a user successfully logs in. The file must contain the DOS style CR/LF line endings. Using a DOS-style editor to create the file is recommended.

The script must be a relative path to the [netlogon] service. If the [netlogon] service specifies a path of /usr/local/samba/netlogon, and logon script = STARTUP.BAT, then the file that will be downloaded is:

/usr/local/samba/netlogon/STARTUP.BAT

The contents of the batch file are entirely your choice. A suggested command would be to add NET TIME \SERVER /SET /YES, to force every machine to synchronize clocks with the same time server. Another use would be to add NET USE U: \SERVER\UTILS for commonly used utilities, or

NET USE Q: \\SERVER\ISO9001_QA

for example.

Note that it is particularly important not to allow write access to the [netlogon] share, or to grant users write permission on the batch files in a secure environment, as this would allow the batch files to be arbitrarily modified and security to be breached.

This option takes the standard substitutions, allowing you to have separate logon scripts for each user or machine.

and also

preexec (S)

This option specifies a command to be run whenever the service is connected to. It takes the usual substitutions.

An interesting example is to send the users a welcome message every time they log in. Maybe a message of the day? Here is an example:

preexec = csh -c 'echo \"Welcome to %S!\" | /usr/local/samba/bin/smbclient -M %m -I %I' &

In your case, though, you really want logon scripts (unencrypted form is mounted on the client), so a solution sketch might involve:

1. ensure that each computer has a EncFS equivalent installed
2. write a logon script (.bat format) that calls encfs on the client and prompts the user for logon. The encfs command thus mounts the unencrypted form locally, with the remote store remaining encrypted.

3. configure smb.conf so that the relevant users run the logon script. e.g. something like

   logon script = runencfs.bat

4. For bonus points, your logon script might automate / prompt installation of Encfs (from the samba share) and only run the mount if it's installed!

Client-side scripts, though, are bound to give you headaches because of the cmd language, ensuring installation of encfs, and working around windows gotchas, like Windows 8.1 and up not running the logon scripts till five minutes later unless otherwise configured.