1

I would like to have a directory accessible to a couple of users, and not readable by maintenance types ... I can do what I want using ecryptfs and a password known only to the "couple of users" in question, who then can mount the directory and use as they see fit.

I would love to be able to automate that process and unlock the directory at login - again, only for the "couple users" in question, without asking a password.

Gnome-keyring is able to store passphrases/passwords encrypted; and, apparently, if I could get a key identity to ecryptfs, Gnome PAM modules would allow the key with that identity to be unlocked, and the directory could be mounted.

Alas, I have found no way to go from point A (Gnome PAM keyring module) to point B (use the unlocked key in ecryptfs).

Another use of the same mechanism would allow to build a "key escrow" mechanism, where keys to encrypted volumes are safekept with, e.g., HR; so that company information in encrypted directories can be recovered if you pass under the proverbial bus.

Improve this question

3 Answers 3

Reset to default
2

Another solution are gpg-encryption. You can eckrypt a directory using gpg and peoples public gpg-keys and then publish the directory thru UbuntuOne to each of the participants.

A convenient tool for Nautilus to do this comes with seahorse-plugins (just right-click in the file dialog).

Right know there is a problem with the package seahorse-plugins (11.10), but there is a PPA ppa:mdeslaur/testing with a funktioning package.

A directory encrypted using gpg can function as a key escrow, its possible to store this directory in public, store it in a third part deposit, distribute it on a public network, and only those that the directory where encrypted for can read.

Improve this answer
1
  • This appears veerrry promising, as it's the only solution I've seen that would pass the key escrow capability test. I suppose that I wouldn't even need to use UbuntuOne if the participants can login to the machine where this encrypted directory resides. Thanks!
    – Michel
    Dec 2, 2011 at 0:59
0

Create a new user on a server accessible with ssh (openssh-server installed) and encrypted home directory. You can then add all peoples ssh-keys letting each user use the command ssh-copy from their client using a "public" known password. When this is done change the password. All users that copied their public ssh-keys can still login with their password for the ssh-key not knowing your secret password for the account. If you want to retire one of the users just remove the public-key from ~/.ssh/authorized_keys.

You can also manually add users public keys to ~/.ssh/autorized_keys

Improve this answer
1
  • Thanks, but there is a something I don't get: Yes, they will be able to login. But where will the ecryptfs password come from? If one logs in normally, it comed from pam (use_first_pass); but here ?
    – Michel
    Dec 2, 2011 at 0:56
0

For the key escrow aspect of your question, see KeyEscrow.net, which is designed specifically for eCryptfs key escrow.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .