10

When I login on my Ubuntu system a script will mount a truecrypt container. To decrypt the container I have of course to enter the decryption password. But Truecrypt also asks for my "administrator password". Why does Truecrypt ask for my administrator password and how can I disable this?

This is the script which runs on startup:

#!/bin/sh -e
/usr/bin/truecrypt /media/windows/data.tc /media/data
/usr/bin/dropbox start

/media/windows is a NTFS partition. /media/data is writable by the user.

1
  • Wouldn't it be easier just to put your user in the (fuse?) group, to allow mounting filesystems without superuser privilege? Mounting doesn't need root, but root has all privileges (including mount)... (At least that was the case in earlier Linux versions)
    – Dexter
    Jul 8, 2013 at 18:26

2 Answers 2

7

TrueCrypt asks you for a password because mounting a filesystem requires superuser privileges. Do not circumvent it by allowing to run truecrypt as root without password, this is insecure as a malicious script can get elevated privileges by mounting a special-crafted container, and gain root privileges from it (e.g. setsuid binaries on in an ext2 filesystem or mounting on /).

4
  • Thanks for the answer. When I have enough rep, I will upvote.
    – i.amniels
    Oct 17, 2011 at 21:52
  • 1
    Not anyone can mount if his username is declared on visudo, only him will be able to use it without sudo password. Oct 17, 2011 at 21:56
  • 1
    @brunopereira81: that's true, but it's still a security risk. I've updated the answer.
    – Lekensteyn
    Oct 17, 2011 at 22:01
  • sounds great ;) Oct 17, 2011 at 22:05
5

Here is a quick fix you can use:

sudo visudo 

Add the line <yourusername> ALL=NOPASSWD: /usr/bin/truecrypt and save the file. truecrypt wont ask for your admin password anymore for . It quick and dirty, probably not safe, but works.

3
  • Thanks for the answer. When I have enough rep, I will upvote.
    – i.amniels
    Oct 17, 2011 at 21:52
  • If it works im happy enough. gl and if needed ask ;) Oct 17, 2011 at 21:53
  • Note that the directive must be placed at the end of the config, otherwise it might be overridden by other directives, e.g. by %sudo ALL=(ALL:ALL) ALL and it won't work. It cost me a bit of time to figure this out.
    – tmt
    Jan 7, 2014 at 9:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .