Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I need to change my user password. Do I need to take any extra steps for my encrypted home directory to become inaccessible with my old password and only accessible with my new password?

share|improve this question
add comment

1 Answer 1

up vote 17 down vote accepted

There is no need to re-encrypt your home directory, and no further steps need to be taken.

Your home directory is not directly encrypted with your password. Instead, the passphrase used to encrypt the home directory is itself encrypted with your password.

When you change your password, the home directory passphrase is re-encrypted with your new password, so you should have continued access to your files with the new password.

This is handled via PAM (Pluggable Authentication Modules), so should work with any password change tool. The exception is administrative password changes where the original password is not provided. This is expected behaviour though: if the administrator could decrypt your files without knowing your password then there would be no actual protection.

In the case you perform an administrative password change, after mounting your home directory with

ecryptfs-mount-private

and your old password, issue

ecryptfs-rewrap-passphrase ~/.ecryptfs/wrapped-passphrase

to change the unwrapping password to match your new one. This way your home directory will be auto-mounted at login, just as it used to.

share|improve this answer
    
Okay. Also, will passwd from bash do it properly or do I need to use GUI tools? –  Septagram Apr 6 '11 at 1:53
3  
Yes. The encrypted home directory system is hooked in via PAM (Pluggable Authentication Modules), so any tool that makes use of PAM (such as the command line passwd tool) should work. –  James Henstridge Apr 6 '11 at 2:36
5  
One other note that might not be immediately obvious: if you use some kind of administrative password reset where the original password is not provided, it won't be possible to re-encrypt the home directory passphrase. It is possible to recover from this situation if you know your old password, but it is something to keep in mind. –  James Henstridge Apr 6 '11 at 2:49
    
By editing your answer you should add your comments there to make it great. –  Takkat Apr 6 '11 at 6:38
    
In the case you perform an administrative password change, after mounting your home directory with ecryptfs-mount-private and your old password, issue ecryptfs-rewrap-passphrase ~/.ecryptfs/wrapped-passphrase to change the unwrapping password to match your new one. –  zakkak Jun 6 at 21:50
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.