1

My home is encrypted, which breaks the login. Gnome and other services try to find all sorts of .files, write to them, read from them and so on. E.g. .ICEauthority. They are not found (yet) because at that moment the home is still encrypted. I do not have automatic login set, since that has known issues with encrypted home in Ubuntu.

When I go trough the following steps, there is no problem:

  1. boot up the system.
  2. Ctrl+Alt+F1, login.
  3. run ecryptfs-mount-private
  4. Ctrl+Alt+F7, done. Can now login.

I may have some setting wrong, but have no idea where. I suspect ecryptfs-mount-private should be ran earlier in bootstrap, but do not know how to make it so.

Some issues that may cause trouble:

  • I have a fingerprint reader, it works for login and PAM.
  • I have three keyrings in seahorse, containing passwords from old machines (backups). Not just one.

Suggestion was that the PAM settings are wrong, so here are the relevant parts from /etc/pam.d/common-auth

# here are the per-package modules (the "Primary" block)
auth    [success=3 default=ignore]  pam_fprintd.so 
auth    [success=2 default=ignore]  pam_unix.so nullok_secure try_first_pass
auth    [success=1 default=ignore]  pam_winbind.so krb5_auth krb5_ccache_type=FILE cached_login try_first_pass
# here's the fallback if no module succeeds
auth    requisite           pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
auth    required            pam_permit.so
# and here are more per-package modules (the "Additional" block)
auth    optional    pam_ecryptfs.so unwrap
# end of pam-auth-update config

I am not sure about how this configuration works, but ut seems that maybe the optional in auth optional pam_ecryptfs.so unwrap is causing the ecryptfs to be ignored?

3
  • PAM is reponsible for the ecryptfs decryption task when a user logins, so it's most likely related to the fingerprint reader. Check the for the ecryptfs options defined at /etc/pam.d/ , you may need to tweak them. Jan 22, 2011 at 14:36
  • I have added a few lines from the /etc/pam.d/common-auth to the question above. I don't see anything immediately.
    – berkes
    Jan 24, 2011 at 13:04
  • @João Pinto: can you copy-paste your comment as an answer? then I can accept it. It was indeed the combination of ecryptfs and fingerprint that causes the problem. Disabling fingerprint-login solves the problem.
    – berkes
    Feb 3, 2011 at 8:11

1 Answer 1

1

PAM is reponsible for the ecryptfs decryption task when a user logins, so it's most likely related to the fingerprint reader.

Check the for the ecryptfs options defined at /etc/pam.d/ , you may need to tweak them.

1
  • Disabling fingerprintreader solves the issue. Thanks for the help, you have brought me a lot further in this issue.
    – berkes
    Feb 4, 2011 at 8:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .