When I wrote this answer a few years ago this was the best way of implementing the solution. I'd now suggest that you look at the next answer using mount.ecryptfs_private instead.
I was also looking for a way to automatically mount a second eCryptfs volume. The following collection of scripts and configuration modifications will securely and automatically mount your volume on login, either to the GUI or the CLI.
There is a better solution that's in the process of being created (though I think not quite ready for automatic mounting on user login, as such this script will have a limited shelf life.):
ecryptfs on too-small harddrive - how to add links into the encryption?
The security of the scripts depends on your home directory being encrypted with eCryptfs so that the script and files with the password to unwrap your passphrase are encrypted. If you leave your computer unlocked with a root shell open after log in it will be possible to access the passwords, however use of sudo NOPASSWD allows secure mounting of the partition without requiring password entry or leaving the passphrase in a file readable by the user.
One known deficiency of these scripts is that your second volume will not be unmounted on logout, as such it's not particularly suitable for multi user systems.
My solution is implemented with several parts, two shell scripts, one that performs the actual mounting and another that serves as a wrapper for it.
This is the wrapper script that validates if the directory is already mounted, if it isn't then it will call the mounting script using sudo:
/home/johnf/scripts/automount_ecryptfs
#!/bin/bash
MOUNT_POINT=/home/johnf/slow
grep -q $MOUNT_POINT /proc/mounts
if [ $? -eq 1 ]; then
sudo /home/johnf/scripts/mount_other_ecryptfs
fi
This script calls /home/johnf/scripts/mount_other_ecryptfs which is as follows.
Note that this script assumes that you have file name encryption enabled, if you don't it will be necessary to either modify the script to handle detection (look at ecryptfs-recover-private) or you could remove the ecryptfs_fnek_sig mount option.
The following is the /home/johnf/scripts/mount_other_ecryptfs script:
#!/bin/bash
ENCRYPTED_VOLUME=/vol0/.ecryptfs/johnf/.Private/
MOUNT_POINT=/home/johnf/slow
PASSFILE=/home/johnf/scripts/ecryptfs_passphrase
MOUNT_PASSWORD=secret_passphrase
ECRYPTFS_SIG=`head -1 ${ENCRYPTED_VOLUME}//../.ecryptfs/Private.sig`
ECRYPTFS_FNEK_SIG=`tail -1 ${ENCRYPTED_VOLUME}//../.ecryptfs/Private.sig`
printf "%s" $MOUNT_PASSWORD | ecryptfs-insert-wrapped-passphrase-into-keyring ${ENCRYPTED_VOLUME}/../.ecryptfs/wrapped-passphrase
mount -t ecryptfs -o key=passphrase:passfile=${PASSFILE},ecryptfs_sig=${ECRYPTFS_SIG},ecryptfs_fnek_sig=${ECRYPTFS_FNEK_SIG},ecryptfs_cipher=aes,ecryptfs_key_bytes=16,ecryptfs_passthrough=n ${ENCRYPTED_VOLUME} ${MOUNT_POINT}
You will also need to create a file with your password in it, this file will be used by the eCryptfs mount command:
/home/johnf/scripts/ecryptfs_passphrase:
passwd=secret_passphrase
You need to modify the permissions on several files:
chmod +x /home/johnf/scripts/automount_ecryptfs
sudo chown root:root /home/johnf/scripts/mount_other_ecryptfs /home/johnf/scripts/ecryptfs_passphrase
sudo chmod a=x /home/johnf/scripts/mount_other_ecryptfs
sudo chmod 400 /home/johnf/scripts/ecryptfs_passphrase
Before creating the scripts you need to create a sudoers configuration to permit the execution of the mounting script using sudo without entering your sudo password.
Add the following to /etc/sudoers (or a file in /etc/sudoers.d). You will want to replace johnf with your username. It's necessary to use an absolute path to the mounting script.
johnf ALL = NOPASSWD: /home/johnf/scripts/mount_other_ecryptfs
The final step is to call the automount_ecryptfs script on login.
On Ubuntu Unity (and probably gnome) use the Startup Applications applet to create a new startup program that calls /home/johnf/scripts/automount_ecryptfs.
To automatically mount the second eCryptfs volume on login into a bash shell you will want to modify your ~/.bashrc file. Add the following:
/home/johnf/scripts/automount_ecryptfs
With this configuration in place you should now automatically mount your second eCryptfs volume.