Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

After setting up a private directory in ~/Private, I noticed that ecryptfs-mount-private is able to mount the directory without supplying a passphrase.

Is there a way to disable this behaviour, to force ecryptfs to ask for a passphrase (and entirely disable automounting using a key in the keyring)?

share|improve this question
up vote 5 down vote accepted

From the EncryptedPrivateDirectory wiki:

We can stop ecryptfs from unlocking the Private folder on startup, by removing the empty file auto-mount which is located in ~/.ecryptfs/, where you also can remove the auto-umount file, if you would like ecryptsfs to stop unmounting the private folder upon shutdown and logout.

UPDATE: To fix the issue of ~/Private being mountable without using a password, follow the instructions in this Ubuntu Forums post:

OK Folks, here is the true fix.

I was reading an article on ecryptfs ( and found that PAM is involved and thus started looking in /etc/pam.d/ and found 2 files that need to be modified:


Do the following as root, but make a backup copy first in a directory OUT OF this directory like ~/ or it will possibly run the backup which is unmodified.

In /etc/pam.d/common-session look for a line that says:

auth optional unwrap
and comment it out like:
#auth optional unwrap

In /etc/pam.d/common-auth look for a line that says:

session optional unwrap
and comment it out like
#session optional unwrap

Both files must be modified. The common-session file is what cause the actually mounting and the common-auth unwraps the passphrase.

If just common-session is commented out (as I tried first), all one has to do is type ecrypt-mount-private and it will mount without the login passphrase. This is NOT GOOD. So the common-auth must be modified to prevent the loading of the unwrapped passphrase into the kernel.

The caveat to this is that THIS AFFECTS ALL USERS. I have just discovered the above by rooting around myself and it satisfies my needs. However, it will make it more difficult on a multiuser system for novices as the Private will not be automatically mounted. There may be a way to prevent this on a user-level (not system level) but I don't know how to do that.

Hope this helps someone in the future.

Yours, Narnie

You will need to restart your computer after you modify those files.

share|improve this answer
Unfortunately that doesn't answer the question as I was not talking about having the Directory mounted at startup - I was talking about the fact that ecryptfs-mount-private doesn't ask for the password, but instead grabs the password from a keyfile from a keychain. and I don't know where that keyfile is stored, nor how to disable it. right now, it makes the whole encrypting process rather useless, as you only need to doubleclick "Access-your-Private-Data" in ~/Private to have the directory mounted and read/writable. but I want ecryptfs to ask for the password, instead of using a keyfile. – user2817 Oct 28 '10 at 22:47
@nebukadnezzar See my updated answer. – Alvin Row Oct 28 '10 at 23:59
I've just rebooted with said changes, and it works like a charme. thanks! :D – user2817 Oct 29 '10 at 1:59

The absolutely trivial-but-effective way to solve the question as asked is to simple remove ~/.ecryptfs/wrapped-passphrase (or rename it).

This will totally prevent pam_ecryptfs from loading any keys into the keyring.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.