There is a problem with ecryptfs that it heavily limits the maximal filename length.
To walkaround it I link most home subfolders to the external encrypted partition. The partition gets mounted just after a successful login with the key file that is present on the freshly-mounted encrypted $HOME.
The problem is, that mounting external partitions needs root rights, and execution just after a successful login.
For GUI systems, one can achieve it by adding a file into /etc/init with the following contents:
description "runs mounter as superuser for a user on logon as root"
start on desktop-session-start
exec /usr/local/sbin/mounter.sh
where mounter.sh is the actual mounting script, which can be something like the following:
cryptsetup luksOpen --key-file /home/myname/key.bin /dev/disk/by-uuid/ce2cd926-133f-4e20-86f8-45bc4844271c my-docs
mount -t btrfs -o compress,rw,noacl,noatime,autodefrag /dev/mapper/my-docs /home/myname/docs
chown myname:myname /home/myname/docs
chmod 0775 /home/myname/docs
sync
Now, how to make it run on headless server machines? There is no desktop-session-start event, but still, upon first successful login the system somehow manages to open ecryptfs and then to close it, when the last user logs off.
Is there any upstart event that gets triggered when an encrypted home is mounted?
