2

I have a user, say secretuser, with an encrypted home directory. Unfortunately I forgot the password for user secretuser, because it was very secret. So I loggged on with another admin user, say masteruser, and changed the password for secretuser via graphical UI to, say, 'newpass'. When trying to login as secretuser, there was no "wrong password" or so when I use 'newpass', but I am sent back to the graphical logon screen immediately after some flash of the screen. So I logged on again as masteruser and did in a shell window:

masteruser$ su secretuser

I entered 'newpass' at the prompt and was able to log on to a shell. But still graphical login was not possible. Same effect as before. So I concluded that the graphical dialog does not do it's job completely and gave the command prompt a chance:

masteruser$ sudo passwd secretuser

Of course, I had to change to something else, say 'newpass1'. Unfortunately, the graphical login shows the same issue as before, but now, when I su'ed to secretuser, I only saw an encrypted file system.

masteruser@zhadum:~$ su secretuser
Passwort: newpass1
Signature not found in user keyring
Perhaps try the interactive 'ecryptfs-mount-private'
secretuser@zhadum:/home/masteruser$ cd /home/secretuser
secretuser@zhadum:~$ ls
Access-Your-Private-Data.desktop  README.txt
secretuser@zhadum:~$ 

Maybe I took security a bit too far, because now I am completely stuck. Seemingly the password is changed, but it does not work for the graphical login and also not for the decryption of the user's directory. Trying ecryptfs-mount-private as suggested did not work either, because neither 'newpass' nor 'newpass1' were accepted. Dropping and recreating the user would lose me 3 weeks of work because the most recent backup, shame on me, is not too current.

Do I have a chance to get access again?

Update: Thanks to the link given by @mxdsp I tried:

masteruser@zhadum:~$ sudo ecryptfs-recover-private
[sudo] password for masteruser: ---- 
INFO: Searching for encrypted private directories (this might take a while)...
INFO: Found [/home/.ecryptfs/secretuser/.Private].
Try to recover this directory? [Y/n]: 
INFO: Found your wrapped-passphrase
Do you know your LOGIN passphrase? [Y/n] Y 
INFO: Enter your LOGIN passphrase...
Passphrase: newpass1
Error: Unwrapping passphrase and inserting into the user session keyring failed [-5]
Info: Check the system log for more information from libecryptfs
masteruser@zhadum:~$ cd /var/log
masteruser@zhadum:/var/log$ tail syslog
Oct  9 06:05:19 zhadum ecryptfs-insert-wrapped-passphrase-into-keyring: Incorrect wrapping key for file [/home/.ecryptfs/secretuser/.Private/../.ecryptfs/wrapped-passphrase]
Oct  9 06:05:19 zhadum ecryptfs-insert-wrapped-passphrase-into-keyring: Error attempting to unwrap passphrase from file [/home/.ecryptfs/secretuser/.Private/../.ecryptfs/wrapped-passphrase]; rc = [-5]
Oct  9 06:05:21 zhadum wpa_supplicant[1625]: nl80211: send_and_recv->nl_recvmsgs failed: -33

and also:

masteruser@zhadum:/var/log$ sudo ecryptfs-recover-private
INFO: Searching for encrypted private directories (this might take a while)...
INFO: Found [/home/.ecryptfs/secretuser/.Private].
Try to recover this directory? [Y/n]: Y
INFO: Found your wrapped-passphrase
Do you know your LOGIN passphrase? [Y/n] n
INFO: To recover this directory, you MUST have your original MOUNT passphrase.
INFO: When you first setup your encrypted private directory, you were told to record
INFO: your MOUNT passphrase.
INFO: It should be 32 characters long, consisting of [0-9] and [a-f].
Enter your MOUNT passphrase: byebye secretuser...

I guess I am done now. I now go grieving over my dumbassery and then ask another question how to truly remove the 32 GB of secretuser from my harddisk - to make sure not to leave even more mess...

3 Answers 3

4

What you need is the passphrase you used when you created the encrypted user. That passphrase is not your password ! Once you have found it, assuming you kept it, run :

ecryptfs-unwrap-passphrase

see more here

2
  • I did as suggested in the link you gave. Now I have something mounted in tmp but when I change to it, I see all cryptic files and directories like -rw------- 1 secretuser secretuser 1406 Jul 20 22:49 ECRYPTFS_FNEK_ENCRYPTED.FXY7udVWRxM.T-Q7zrsGtqZT23BeaSWl8nYLnAY4SWzDYOrL4qvZhrIoZ0e4Yp4FMUXCcwf1KNUkZHw- and even cating the files gives I/O error. Seems that I have to go with the delete and restore. Pity that. Encryption was obviously one step too secure. I was thinking that the key is stored in some keyring and is automatically unlocked on logon. But seemingly... Thanks anyway :)
    – flaschbier
    Oct 8, 2015 at 15:45
  • 1
    Yes, sorry about that. Maybe you should just make a full backup of your encrypted files, just in case some one shows up with a solution in the next days. I'm not an expert and I might have miss something. Good luck with that.
    – mxdsp
    Oct 9, 2015 at 0:26
2

You do need either

  • the last login passphrase (the one just before you forced a new login passphrase with sudo)

    or

  • the original mount passphrase created when the encryption was set up.

The wrapped-passphrase file holds the mount passphrase for your encrypted home, and is encrypted with your login passphrase. By forcing a new passphrase with sudo, without having the old one or being logged in, your wrapped-passphrase file was not decrypted and re-encrypted with the new login passphrase. This is by design to provide real security that any sudo-armed user can't bypass.

When you set up your encrypted home with the eCryptFS tool ecryptfs-migrate-home it asks you to make a backup copy of the actual mount passphrase, just in case a problem like this comes up (you forget your login passphrase or the wrapped-passphrase file is lost or damaged.

Having just the login passphrase from when you first created the user probably won't be useful, unless you also have a copy of the wrapped-passphrase file from the same time, using the same login passphrase.

2
  • +1 for mentioning the backup copy. I should have done, yes... Btw. I really wonder why the encrytion does not employ a certificate with passphrase - which everyone interested in encryption at all could handle right away - rather than some special foo that's different to anything else...?
    – flaschbier
    Nov 1, 2015 at 16:11
  • I'm not actually sure if the Ubuntu installer has the same "make a backup of this mount key" advice, it seems most people set up an encrypted home at install, and not using the migrate-home script. Not sure about certificates, if they're encrypted with a passphrase then is that essentially how the wrapped-passphrase file works now? Or like using your pgp/gpg key somehow?
    – Xen2050
    Nov 1, 2015 at 16:32
0

Self-answer just to share my insights from this incident:

With an encrypted home directory, don't forget your password and your passphrase. You will be lost even when you have other admin users on that machine.

This answer to a similar question might provide helpful background info for others. It also explains why I can delete secureuser and will not encrypt a home directory again.

Together with the experience from this gem I really think that encrypting the home partition (and only the home partition) has the best security-to-risk ratio. At least all the other options have proven to be more risk than fun...

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .