User Home directory encryption - files that must remain un-encrypted like authorized_keys

Question

Before we get to far, my question is:

If this is the wrong way, or I'm doing it wrong, what is the right way?

Pursuant to this howto: https://help.ubuntu.com/community/EncryptedHome

So I see this as noted in the above howto:

https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/362427/comments/12

Problem is that without a local login, it doesn't work. Suspect the author forgot to log out ALL of his local users and test from remote. Probably had a local tty logged in on a hidden screen somewhere.

Note: Password auth is disabled, public key only.

From the remote machine I get:

myuser@remotemachine:~$ ssh oh
Permission denied (publickey).

Verified by following test procedure:

From the GUI login screen on the machine in question:

[CTRL][ALT][F1]
Ubuntu 14.04.2 LTS otherhost tty1

otherhost login: myuser
Password: #######
Last login: Thu Apr ...
... etc. etc. 
myuser@otherhost:~$ w
 17:00:57 up  2:05,  1 user,  load average: 0.00, 0.01, 0.05
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
myuser   tty1                      16:40    1.00s  0.22s  0.00s w

OK so no other users are logged in. Just this one local tty. Then:

myuser@otherhost:~$ cd ..
myuser@otherhost:/home$ cp ~/.ssh/authorized_keys /tmp/myuser.authorized_keys
myuser@otherhost:/home$ umount.ecryptfs_private;cd $HOME
myuser@otherhost:~$ mkdir -m 700 .ssh
myuser@otherhost:~$ chmod 500 .
myuser@otherhost:~$ cat /tmp/myuser.authorized_keys > .ssh/authorized_keys
myuser@otherhost:~$ /sbin/mount.ecryptfs_private
Signature not found in user keyring
Perhaps try the interactive 'ecryptfs-mount-private'

OK thats the first problem.

myuser@otherhost:~$ ecryptfs-mount-private
Enter your login passphrase:
Inserted auth tok with sig [XXXXXXXXXXXXXXXX] into the user session keyring

 INFO: Your private directory has been mounted.
 INFO: To see this change in your current shell:
   cd /home/jim

 myuser@otherhost:~$ ls
 Access-Your-Private-Data.desktop  README.txt
 myuser@otherhost:~$ cd /home/jim

Check to make sure I'm still the only user, then exit and switch machines:

myuser@otherhost:~$ w
 17:00:57 up  2:05,  1 user,  load average: 0.00, 0.01, 0.05
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
myuser   tty1                      16:40    1.00s  0.22s  0.00s w
myuser@otherhost:~$ exit

OK now from the remote machine with no users logged in to the box with encrypted home directories:

myuser@otherhost:~$ ssh oh
Permission denied (publickey).
myuser@otherhost:~$ 

Turn up the verbosity:

myuser@otherhost:~$ ssh -v oh
OpenSSH_6.6.1, OpenSSL 1.0.1f 6 Jan 2014
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug1: Connecting to oh [192.168.1.111] port 22.
debug1: Connection established.
debug1: identity file /home/myuser/.ssh/id_rsa type 1
debug1: identity file /home/myuser/.ssh/id_rsa-cert type -1
debug1: identity file /home/myuser/.ssh/id_dsa type -1
debug1: identity file /home/myuser/.ssh/id_dsa-cert type -1
debug1: identity file /home/myuser/.ssh/id_ecdsa type -1
debug1: identity file /home/myuser/.ssh/id_ecdsa-cert type -1
debug1: identity file /home/myuser/.ssh/id_ed25519 type -1
debug1: identity file /home/myuser/.ssh/id_ed25519-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.6.1p1 Ubuntu-2ubuntu2
debug1: Remote protocol version 2.0, remote software version OpenSSH_6.6.1p1 Ubuntu-2ubuntu2
debug1: match: OpenSSH_6.6.1p1 Ubuntu-2ubuntu2 pat OpenSSH_6.6.1* compat 0x04000000
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr [email protected] none
debug1: kex: client->server aes128-ctr [email protected] none
debug1: sending SSH2_MSG_KEX_ECDH_INIT
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ECDSA *********************************************
debug1: Host 'oh' is known and matches the ECDSA host key.
debug1: Found key in /home/myuser/.ssh/known_hosts:2
debug1: ssh_ecdsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: Roaming not allowed by server
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey
debug1: Next authentication method: publickey
debug1: Offering RSA public key: /home/myuser/.ssh/id_rsa
debug1: Authentications that can continue: publickey
debug1: Trying private key: /home/myuser/.ssh/id_dsa
debug1: Trying private key: /home/myuser/.ssh/id_*******
debug1: Trying private key: /home/myuser/.ssh/id_*******
debug1: No more authentication methods to try.
Permission denied (publickey).

---

Answer 1

One alternative is to specify another location for the AuthorizedKeysFile (default ~/.ssh/authorized_keys) which is what SSH checks to pass your keys. You can do this by editing /etc/ssh/sshd_config on the server and setting:

AuthorizedKeysFile /some/path/authorized_keys

According to man 5 sshd_config:

AuthorizedKeysFile
     Specifies the file that contains the public keys that can be used
     for user authentication.  The format is described in the
     AUTHORIZED_KEYS FILE FORMAT section of sshd(8).
     AuthorizedKeysFile may contain tokens of the form %T which are
     substituted during connection setup.  The following tokens are
     defined: %% is replaced by a literal '%', %h is replaced by the
     home directory of the user being authenticated, and %u is
     replaced by the username of that user.  After expansion,
     AuthorizedKeysFile is taken to be an absolute path or one
     relative to the user's home directory.  Multiple files may be
     listed, separated by whitespace.  The default is
     “.ssh/authorized_keys .ssh/authorized_keys2”.

I would suggest a setting of:

AuthorizedKeysFile /some/path/%u/authorized_keys .ssh/authorized_keys .ssh/authorized_keys2

This should allow a fallback to the default locations, and allow you to use separate files for different users.