We are learning about/experimenting with eCryptfs (Ubuntu Server 10.04). We are trying to set up users on our server programmatically using a bash script which we can do, including encrypting their "/home".
We are trying to avoid having to log into a new account to generate the ecryptfs passphrase. Once we do this, we can recover the passphrase via bash from another account, but have hoping to avoid the "manual" log in step.
We should mention, this is an Internet facing server, that we are doing our best to "lock it down", that we are trying to prevent users from changing their passwords "willy nilly", and so will require them to make password change requests, and that the point of the encryption is to keep users out of each others accounts (there are other, perhaps better ways to address this need - including just "hiding" their /home though the encryption also forces a log in, in addition to ssh).
So, is there a way to script a login (we've seen posts on google that this isn't possible) that replaces the manual one so that the passphrase gets created and they we can capture and record it using ecryptfs-unwrap-passphrase.