Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How can I prevent users from encrypting their home folder on a server inside our company without removing the respective packages?

Are there any policies I can enable to prevent this?

Edit: the reason is that employees leaving should not leave data behind in encrypted form on this machine. They have the opportunity to use encryption on their personal workstation to some extent. Those users do not have super user powers.

share|improve this question
Why do you want that, what is the problem you're trying to solve? – jippie May 11 '12 at 22:53
what privileges do these employees require, what is their job on the servers? – jippie May 11 '12 at 22:57
up vote 8 down vote accepted

If you don't want to remove the ecryptfs-utils package, then the easiest way to do this would be to remove the setuid bit on /sbin/mount.ecryptfs_private.

You should use a dpkg state override to make this setting persistent, like so:

dpkg-statoverride --add root root 0700 /sbin/mount.ecryptfs_private

This will ensure that ecryptfs-setup-private and ecryptfs-mount-private fail with an EPERM error for non-root users.

If this becomes a popular request, we could easily add this as a debconf question/option in the package.

share|improve this answer
Thank you Dustin. Great answer. – 0xC0000022L May 11 '12 at 23:23

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.