Summary and Setup

This workshop teaches you how to use gocryptfs — a transparent, file-level encryption tool — to protect restricted research data on the Sagehen HPC cluster. You will learn to create encrypted directories, integrate encryption into SLURM workflows, manage encryption keys safely, and maintain compliance with federal and institutional data protection requirements.

Callout

Pomona College HPC Context

This workshop is part of the Pomona College Research Computing Workshop Series for researchers using the Sagehen HPC cluster.

This workshop is MANDATORY for all researchers storing or processing Restricted-tier data on Sagehen. Pomona’s ITS Training and Awareness Policy and NIST SP 800-171 control 3.13.11 require encryption for Controlled Unclassified Information (CUI) at rest.

Prerequisites:

Workshop 13: HPC Security Orientation (required)
Workshop 14: Data Classification and Handling (strongly recommended)
Active Sagehen HPC account (its-hpc@pomona.edu)
Comfortable with the Unix command line (Workshops 1–2)

For questions or support, contact its-hpc@pomona.edu.

Workshop Structure

The workshop is organized into 17 episodes across five sections:

Section 1 — Why Encrypt? (Episodes 1–3) Regulatory landscape, Pomona’s data classification system, and real-world scenarios.

Section 2 — How gocryptfs Works (Episodes 4–5) Architecture, AES-256-GCM encryption, FUSE filesystem model, and key derivation.

Section 3 — Hands-On Encryption (Episodes 6–9) Planning directories, creating encrypted volumes, mounting workflows, and non-interactive mounting.

Section 4 — SLURM Integration (Episodes 10–12) Decision framework for pre-mount vs. mount-in-script, job script templates, and advanced patterns (arrays, pipelines, GPU jobs).

Section 5 — Key Management and Maintenance (Episodes 13–17) Key backup, password management, lab group management, security best practices, and verification/maintenance routines.

Total estimated time: 4–5 hours (teaching + exercises)

Key Facts

Encryption: AES-256-GCM (hardware-accelerated on Sagehen)
Key derivation: scrypt (memory-hard, brute-force resistant)
Performance overhead: 5–10% CPU, 10–20% I/O typical
Password requirement: 14+ characters (NIST SP 800-63B)
No password recovery: Forgotten passwords mean permanently lost data
Critical file: gocryptfs.conf must be backed up — losing it means losing all encrypted data

Acknowledgments

Developed by Andrew Wilson, Director of Research Computing and Digital Scholarship at Pomona College, with Andrei Motchenko, who tested, edited and produced screenshots for the workshop series.

Prerequisites

Before this workshop, you should have:

An active Sagehen HPC account (request from its-hpc@pomona.edu if needed)
Completed Workshop 13: HPC Security Orientation (mandatory)
Familiarity with the Unix command line (Workshops 1–2)
Comfort with basic file operations (mkdir, ls, chmod, cp)

Verify Your HPC Access

Log into Sagehen via OnDemand or SSH and run these checks:

BASH

# Confirm you can log in
ssh <myusername>@sagehen.hpc.pomona.edu

# Check your home directory
pwd
# Expected: /rhome/<myusername>

# Check your lab's storage
ls /bigdata/lab/<labname>
# Replace "labname" with your lab directory name

If you cannot log in, contact its-hpc@pomona.edu before the workshop.

Verify gocryptfs Is Available

BASH

# Check that the module exists
module avail gocryptfs

# Load it
module load gocryptfs

# Verify it works
gocryptfs --version
# Expected: gocryptfs v2.x.x

If the module is not available, email its-hpc@pomona.edu to request installation.

Check Your Storage Quota

BASH

# Check lab quota (du does NOT work correctly on BeeGFS)
quota_check.sh

You will need at least 10 GB of free space in /bigdata/lab/<labname> for workshop exercises. If your lab is near its quota limit, contact its-hpc@pomona.edu to discuss options.

Prepare a Strong Password

During the workshop you will create an encrypted directory that requires a password. Prepare one in advance:

Minimum 14 characters (per NIST SP 800-63B)
Mix of uppercase, lowercase, numbers, and symbols
Store it in a password manager such as Bitwarden (free) or 1Password
There is no password recovery — a forgotten password means permanently lost data

Do not write your password on a sticky note, in a plain text file, or in an email draft.

Quick Readiness Check

Run this script to verify everything at once:

BASH

#!/bin/bash
echo "=== gocryptfs Workshop Readiness Check ==="

# Check home directory
echo -n "Home directory: "
if [ -d "$HOME" ]; then echo "OK ($HOME)"; else echo "FAIL"; fi

# Check gocryptfs module
echo -n "gocryptfs module: "
if module avail gocryptfs 2>&1 | grep -q gocryptfs; then
  module load gocryptfs
  echo "OK ($(gocryptfs --version 2>&1))"
else
  echo "FAIL — email its-hpc@pomona.edu"
fi

# Check /bigdata access
echo -n "/bigdata access: "
if [ -d "/bigdata" ]; then echo "OK"; else echo "FAIL"; fi

# Check /tmp directory creation
echo -n "Directory creation: "
TEST_DIR="/tmp/test_gocryptfs_$$"
if mkdir -p "$TEST_DIR" 2>/dev/null; then
  rmdir "$TEST_DIR"
  echo "OK"
else
  echo "FAIL"
fi

echo "=== Done ==="

Save this as check_readiness.sh and run it with bash check_readiness.sh. If any check fails, email its-hpc@pomona.edu with the output.

Troubleshooting

“gocryptfs: command not found” — You need to load the module first: module load gocryptfs. If module avail gocryptfs shows nothing, the module is not installed; contact its-hpc@pomona.edu.

“Permission denied” on /bigdata/lab/<labname> — You may not be in the correct group. Run groups to check your group membership, then ask your PI or email its-hpc@pomona.edu to be added.

“Disk quota exceeded” — Run quota_check.sh to see current usage. Ask your PI about cleaning up old data, or email its-hpc@pomona.edu to request additional storage.