Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Today I set up an ecryptfs directory, which is automatically mounted at login via pam. To do so i followed the guide in the ecryptfs readme


To sum up, I now have a key stored in the usser session keyring. The first thing I do not understand is why this key is only showing up via keyctl show and not with the gnome-gui "Passwords and encryption keys".

The second thing I am curious about is the security. I assume that my passphrase is somehow stored on the harddisk. But how exactly and how secure is this?

Thanks in advance

share|improve this question
up vote 3 down vote accepted

The gnome-keyring session is separate from the "in kernel" session keys. The Gnome Keyring Manager is used to hold direct passwords and hand them out when applications need them (like when checking your email or logging into remote systems). The kernel keyring is used for in-kernel operations that need encryption, like eCryptfs.

Neither eCryptfs nor the Gnome Keyring Manager store your passphrases in the clear. Gnome Keyring Manager stores an encrypted database to disk and keeps passphrases in memory only. The eCryptfs tools do a similar thing: your mount passphrase (a large random bit string) is encrypted on disk with your login passphrase. This is what is used internally by eCryptfs and again, does not hit the disk in the clear.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.