Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

According to documentation, I simply create a public/private keypair for ecryptfs using ecryptfs-manager. But there is nothing to select.

$ sudo ecryptfs-manager
eCryptfs key management menu
-------------------------------
    1. Add passphrase key to keyring
    2. Add public key to keyring
    3. Generate new public/private keypair
    4. Exit

Make selection: 3
Select key type to use for newly created files: 
Selection: 

There should at least one option for me to select, sorta like this:

Make selection: 3
Select key type to use for newly created files: 
    1. OpenSSL
    2. Probably some other option here
Selection: 

I am using Ubuntu 11.10 (with Xubuntu-desktop). I have all relevant packages AFAIK like ecryptfs-utils, openssl, keyutils. What am I missing?

Although I can create a key pair using openssl like so (I am not sure this is right for use with ecryptfs):

$ openssl genrsa -out rsakey.pem -aes256 2048
Generating RSA private key, 2048 bit long modulus
(...)
Enter pass phrase for rs-efs-rsakey.pem:
Verifying - Enter pass phrase for rs-efs-rsakey.pem:
$ openssl rsa -in rsakey.pem -out rsapub.pem -pubout
Enter pass phrase for rsakey.pem:
writing RSA key

There is still a problem with ecryptfs because just like ecryptfs-manager, mount -t ecryptfs also misses the option to choose for keys.

When I mount something random, I get:

$ sudo mount -t ecryptfs ~/temp ~/temp
[sudo] password for redsandro: 
Passphrase:

It immediately assumes I want to use password encryption. What I should have gotten is something like this:

$ sudo mount -t ecryptfs ~/temp ~/temp
[sudo] password for redsandro: 
Select key type to use for newly created files:
    1) openssl
    2) passphrase
    3) tspi
Selection:

I am guessing the same [something] is missing for ecryptfs-manager and mount, because the same question is present in documentation. What am I missing?

share|improve this question

1 Answer 1

up vote 2 down vote accepted

You're not missing anything. Ubuntu, and other distros, could not ship the OpenSSL key module due to licensing issues with the GPLv2-licensed libecryptfs.

The copyright holders to the OpenSSL key module recently added an exception that should allow distros to ship the OpenSSL key module.

You can probably expect the key module to show up in the Ubuntu release after the 12.04 release. Note that the time frame is still undecided.

In the meantime, you could compile ecryptfs-utils yourself and copy the libecryptfs_key_mod_openssl.so to the appropriate location (likely /usr/lib/ecryptfs/). If you decide to do that, please keep in mind that it is not tested and you will be unsupported.

share|improve this answer
    
I should add that in addition to the OpenSSL module not being tested in Ubuntu, the OpenSSL support is quite raw in general. The code isn't to the level of quality that you should depend on at this time. –  tyhicks Mar 8 '12 at 21:07
    
Can you advise on any other method to better ecryptfs backups for transfer to a remote location? Because, as the ecryptfs manual puts it: Cryptographic keys derived from passphrases are generally worthless. –  Redsandro Mar 8 '12 at 21:11
    
Note though, that according to the Ubuntu Manual, section about KEY MODULE OPTIONS, which key modules are available on any given system is dependent upon whatever happens to be installed in /usr/lib*/ecryptfs/. By default, this includes, at a minimum, "passphrase" and "openssl." –  Redsandro Mar 8 '12 at 22:15
    
That comment in about passphrase based keys is a little too strong. They aren't worthless but you do need to use a strong passphrase. –  tyhicks Mar 8 '12 at 23:38
    
About the man page stating that openssl is included by default, it is wrong in the context of Ubuntu but correct in the context of upstream. The configure script enables eCryptfs by default, but the Ubuntu build disables it. –  tyhicks Mar 8 '12 at 23:39

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.