3

As usual, when I install a new version of Ubuntu I install pam_mount to automount my with LUKS encrypted partition on login. However, for Ubuntu 11.10, I followed the same procedure as usual, but I can't make it work.

The encrypted partition is

/dev/sda5

and I added the information 

<volume user="user" fstype="crypt" path="/dev/sda5" mountpoint="/media/personal" options="fsck,relatime" />

to

/etc/security/pam_mount.conf.xml.

The partition does show up in Nautilus but is not mounted. Any idea?

Edit:

There are no error messages or other information in the terminal, pointing to a false password or configuration error.

Improve this question
2
  • I don't know the subject well, but this may be relevant: askubuntu.com/questions/21025/mount-a-luks-partition-at-boot
    – belacqua
    Oct 29, 2011 at 5:16
  • Thanks for the response, but now, I cannot use crypttab since it will ask for the password at startup. The pam_mount module allows to decrypt a partition while you login into your user session if the encryption password and user session password are identical.
    – n3rd
    Oct 29, 2011 at 5:20

2 Answers 2

Reset to default
4

Now it is working again. The reason it did not work is indeed because they changed the format of the config file

/etc/security/pam_mount.conf.xml

in Ubuntu 11.10. So, I backed up my old *pam_mount.conf.xml* and uninstalled the pam-mount module via

apt-get remove --purge libpam-mount

and reinstalled it using

apt-get install libpam-mount

Now I opened the new

/etc/security/pam_mount.conf.xml

and inserted this line, 

<volume user="user" fstype="crypt" path="/dev/sda5" mountpoint="/media/personal" options="fsck,relatime" />

from my old config file into the volume section of the new config file.

This is how it look now

<?xml version="1.0" encoding="utf-8" ?>
<!DOCTYPE pam_mount SYSTEM "pam_mount.conf.xml.dtd">
<!--
        See pam_mount.conf(5) for a description.
-->

<pam_mount>

                <!-- debug should come before everything else,
                since this file is still processed in a single pass
                from top-to-bottom -->

<debug enable="0" />

                <!-- Volume definitions -->

<volume user="user" fstype="crypt" path="/dev/sda5" mountpoint="/media/personal" $

                <!-- pam_mount parameters: General tunables -->

<!--
<luserconf name=".pam_mount.conf.xml" />
-->

<!-- Note that commenting out mntoptions will give you the defaults.
     You will need to explicitly initialize it with the empty string
     to reset the defaults to nothing. -->
<mntoptions allow="nosuid,nodev,loop,encryption,fsck,nonempty,allow_root,allow_ot$
<!--
<mntoptions deny="suid,dev" />
<mntoptions allow="*" />
<mntoptions deny="*" />
-->
<mntoptions require="nosuid,nodev" />

<logout wait="0" hup="0" term="0" kill="0" />


                <!-- pam_mount parameters: Volume-related -->

<mkmountpoint enable="1" remove="true" />


</pam_mount>
Improve this answer
2
  • As I can see you've used nano to open and copy the conf. It trimmed two long lines, can you fix it?
    – int_ua
    Jul 31, 2012 at 9:09
  • Can this be done in .pam_mount.conf.xml in user's home directory? That would be ideal since the entire disk is encrypted with user's password. Thanks.
    – inder
    Oct 1, 2013 at 4:59
1

I think here is good starting point to solve this issue is to temporary add "debug" option after pam_mount.so module (in /etc/pam.d/common.auth and common.session), set 'debug enable="1"' in /etc/security/pam_mount.conf.xml, login again and check /var/log/auth.log for additional info

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .