Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I somehow managed to break auto-mounting for my encrypted home directory.

Every time I login via SSH, I see this:

valorin@joshua:~$ ls -la
total 44
dr-x------ 3 valorin valorin  4096 2012-03-17 17:10 .
drwxr-xr-x 7 root    root     4096 2012-03-17 11:45 ..
lrwxrwxrwx 1 valorin valorin    56 2012-03-08 20:37 Access-Your-Private-Data.desktop -> /usr/share/ecryptfs-utils/ecryptfs-mount-private.desktop
-rw------- 1 valorin valorin   917 2012-03-17 19:24 .bash_history
drwx------ 3 valorin valorin  4096 2012-03-16 17:58 .cache
lrwxrwxrwx 1 valorin valorin    33 2012-03-08 20:37 .ecryptfs -> /home/.ecryptfs/valorin/.ecryptfs
-rw-r--r-- 1 root    root    21954 2012-03-08 20:35 .face
lrwxrwxrwx 1 valorin valorin    32 2012-03-08 20:37 .Private -> /home/.ecryptfs/valorin/.Private
lrwxrwxrwx 1 valorin valorin    52 2012-03-08 20:37 README.txt -> /usr/share/ecryptfs-utils/ecryptfs-mount-private.txt
-rw------- 1 root    root      703 2012-03-17 17:10 .viminfo

Any ideas what I've done, and how I can fix it?

UPDATE:

I have set up the SSH key authentication using the method here, which in hindsight is the reason for the non-working encrypted home directory.

So, my new question, how do I get it to automatically prompt for the password after I have logged in with the SSH auth key?

share|improve this question
    
Are you prompted for your login password when you login? Are there any eCryptfs messages in syslog? –  Dustin Kirkland Mar 23 '12 at 22:03
    
@DustinKirkland, see my update in the question. I realised it is because I've set up SSH key auth... so there is no password being asked for. –  Valorin Mar 24 '12 at 0:21
    
aha, well then that's it ;-) I'll post a better answer below, now. –  Dustin Kirkland Mar 26 '12 at 17:02

3 Answers 3

up vote 6 down vote accepted

Okay, so while it's possible to use SSH Public Key authentication to log into your system without entering a password (even if your home directory is encrypted), it's not possible to automatically mount your encrypted home directory.

To solve this, you'll need to add a line to the end of your unmounted $HOME/.profile:

ecryptfs-mount-private

This will ensure that after you've logged in using SSH Public Key authentication, you'll be prompted for your password and will mount your encrypted data. If it's already mounted, then this command should just silently succeed.

Enjoy!

Full disclosure: I'm one of the authors and maintainers of eCryptfs.

share|improve this answer
1  
Awesome, thanks, that does exactly what I want :) I had to add cd /home/$HOME into the .profile file as well, to refresh it though once it had decrypted. –  Valorin Mar 28 '12 at 20:57

Try the following:

  1. Make sure that /etc/pam.d/common-session contains this line:

     # Encrypt home
     session    optional    pam_ecryptfs.so unwrap
    
  2. Make sure that /etc/pam.d/common-auth contains this line:

     auth   optional    pam_ecryptfs.so unwrap
    
  3. Make sure that /etc/pam.d/sshd contains these lines:

     # Standard Un*x authorization.
     @include common-account
    
     # Standard Un*x session setup and teardown.
     @include common-session
    
  4. If you have changed your user's password recently, check /etc/pam.d/common-password

    If it doesn't contain this line:

     password   optional    pam_ecryptfs.so
    

    Then you need your old password to reconfigure ecryptfs.

    My suggestion is to change your account to your previous password using passwd and then adding the above line to /etc/pam.d/common-password and then changing the password back to the new password.

    Alternatively you can try this:

    ecryptfs-setup-private

    Make sure you enter the same password as your users password when prompted.

  5. If none of the above works, try running ecryptfs-setup-private perhaps it will fix something.

  6. If it is still not working then I am out of ideas, sorry.

share|improve this answer
    
All that config looks good. Check the updates to my question, I think it's due to SSH key auth I have set up. –  Valorin Mar 24 '12 at 0:22
    
Try changing optional to required in common-account. The idea is that pam should really prompt for password if it doesn't get it. Be sure to keep an open session so you don't risk locking yourself out. –  d_inevitable Mar 24 '12 at 0:36

By following these instructions you mentioned in your post, you specifically made it so you could SSH into your account without your home folder being mounted. If you undo what you did there and put it back to how it was before, then when you SSH in you will be forced to enter your password if your home directory isn't decrypted already. (If your home directory is already decrypted because of another session, then your SSH key will work perfectly for a passwordless connection!)

Otherwise, the alternative is to run ecryptfs-mount-private after you log in with your key to manually decrypt your home folder.

share|improve this answer
    
Is there a way to have ecryptfs-mount-private run automatically when I login? –  Valorin Mar 24 '12 at 10:45

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.