Obtain passphrase programatically before intial login with ecryptfs?

Question

We are learning about/experimenting with eCryptfs (Ubuntu Server 10.04). We are trying to set up users on our server programmatically using a bash script which we can do, including encrypting their "/home".

We are trying to avoid having to log into a new account to generate the ecryptfs passphrase. Once we do this, we can recover the passphrase via bash from another account, but have hoping to avoid the "manual" log in step.

We should mention, this is an Internet facing server, that we are doing our best to "lock it down", that we are trying to prevent users from changing their passwords "willy nilly", and so will require them to make password change requests, and that the point of the encryption is to keep users out of each others accounts (there are other, perhaps better ways to address this need - including just "hiding" their /home though the encryption also forces a log in, in addition to ssh).

So, is there a way to script a login (we've seen posts on google that this isn't possible) that replaces the manual one so that the passphrase gets created and they we can capture and record it using ecryptfs-unwrap-passphrase.

Answer 1

I can't say for sure if the current implementation of the encrypted home set up scripts allow you to do what you're trying. Someone else will have to help you with that.

However, I do want to point out that your use of eCryptfs is a bit misguided. eCryptfs isn't really designed to provide a form of enhanced access control and relying on it to do that has some problems.

If a malicious user is trying to access another user's data and that user's encrypted home directory is mounted (implying that the encryption key is in the kernel key ring), then eCryptfs doesn't really provide anything more than regular DAC permissions. If the attacker can bypass DAC, he likely has some type of a kernel exploit and eCryptfs provides no protection if the encryption keys are already loaded into the kernel key ring at that point.

Note that there is some useful protection for the users who do not have their home directory mounted at the time of the attack, but you'll have to determine if it is more or less likely for your users to have their home directory mounted at any given time.

Also note that if you're planning on making backups of the encrypted data, you'll get benefits from the backups being encrypted on a per-user basis. Admins won't have an easy time accessing the data and you'll lose less sleep over misplaced tape drives.

I don't mean to discourage you against using eCryptfs, but I do want you to understand what you're getting in return for the added complexity and slight decrease in performance when using file encryption.