Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

My home is encrypted, which breaks the login. Gnome and other services try to find all sorts of .files, write to them, read from them and so on. E.g. .ICEauthority. They are not found (yet) because at that moment the home is still encrypted. I do not have automatic login set, since that has known issues with encrypted home in Ubuntu.

When I go trough the following steps, there is no problem:

  1. boot up the system.
  2. [ctr][alt][F1], login.
  3. run ecryptfs-mount-private
  4. [ctr][alt][F7], done. Can now login.

I may have some setting wrong, but have no idea where. I suspect ecryptfs-mount-private should be ran earlier in bootstrap, but do not know how to make it so.

Some issues that may cause trouble:

  • I have a fingerprint reader, it works for login and PAM.
  • I have three keyrings in seahorse, containing passwords from old machines (backups). Not just one.

Suggestion was that the PAM settings are wrong, so here are the relevant parts from /etc/pam.d/common-auth.

# here are the per-package modules (the "Primary" block)
auth    [success=3 default=ignore]  pam_fprintd.so 
auth    [success=2 default=ignore]  pam_unix.so nullok_secure try_first_pass
auth    [success=1 default=ignore]  pam_winbind.so krb5_auth krb5_ccache_type=FILE cached_login try_first_pass
# here's the fallback if no module succeeds
auth    requisite           pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
auth    required            pam_permit.so
# and here are more per-package modules (the "Additional" block)
auth    optional    pam_ecryptfs.so unwrap
# end of pam-auth-update config

I am not sure about how this configuration works, but ut seems that maybe the*optional* in auth optional pam_ecryptfs.so unwrap is causing the ecryptfs to be ignored?

share|improve this question
    
PAM is reponsible for the ecryptfs decryption task when a user logins, so it's most likely related to the fingerprint reader. Check the for the ecryptfs options defined at /etc/pam.d/ , you may need to tweak them. –  João Pinto Jan 22 '11 at 14:36
    
I have added a few lines from the /etc/pam.d/common-auth to the question above. I don't see anything immediately. –  berkes Jan 24 '11 at 13:04
    
@João Pinto: can you copy-paste your comment as an answer? then I can accept it. It was indeed the combination of ecryptfs and fingerprint that causes the problem. Disabling fingerprint-login solves the problem. –  berkes Feb 3 '11 at 8:11

1 Answer 1

up vote 1 down vote accepted

PAM is reponsible for the ecryptfs decryption task when a user logins, so it's most likely related to the fingerprint reader.

Check the for the ecryptfs options defined at /etc/pam.d/ , you may need to tweak them.

share|improve this answer
    
Disabling fingerprintreader solves the issue. Thanks for the help, you have brought me a lot further in this issue. –  berkes Feb 4 '11 at 8:39

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.