An encrypted /home directory gets mounted automatically for me when I log in. I have a second internal hard drive that I've formatted and encrypted with Disk Utility. I want it to be automatically mounted when I login, just like my encrypted /home directory is. How do I do this?

There are several very similar questions here, but the answers don't apply to my situation. It might be best to close/merge my question here and edit the second one below, but I think it may have been abandoned (and therefore never to be marked as accepted).

This solution isn't a secure method, it circumvents the encryption.
This one requires editing fstab, which necessitates entering an additional password at boot. It's not automatic like mounting /home.
This question is very similar, but does not apply to an encrypted drive. The solution won't work for my needs.
Here is one but it's for NTFS drives, mine is ext4.

I can re-format and re-encrypt the second drive if a solution requires this. I've got all the data backed up elsewhere.

  • What FS do you use for encryption ? LUKS or ecrytpfs ?
    – daisy
    Mar 21, 2012 at 4:11
  • @AaronLewis I just use Ubuntu's Disk Utility to format the drive, then check the 'encrypt this drive' box. If I had to guess I would go with ecryptfs, since this is how /home is encrypted by default. Since it's so easy to do I've never looked into it. Mar 21, 2012 at 8:10

7 Answers 7


Building on @johnf's answer but using mount.ecryptfs_private instead:

  • encrypted /home/bob/ (eg. on a SSD), using Ubuntu's normal encrypted home dir magic.
  • encrypted /media/hdd/bob_extra/ (eg. on a HDD), to be mounted to /home/bob/extra. This should automount on login, just like the home dir does.
  • use the same keys/credentials for both.

create it

mkdir /media/hdd/bob_extra
cp /home/bob/.ecryptfs/Private.sig /home/bob/.ecryptfs/extra.sig
echo "/media/hdd/bob_extra /home/bob/extra ecryptfs none 0 0" > /home/bob/.ecryptfs/extra.conf

test it

mount.ecryptfs_private extra

running mount, you should see:

/media/hdd/bob_extra on /home/bob/extra type ecryptfs (ecryptfs_check_dev_ruid,ecryptfs_cipher=aes,ecryptfs_key_bytes=16,ecryptfs_unlink_sigs,ecryptfs_sig=12345678abcdef,ecryptfs_fnek_sig=abcdef12345678)

to unmount:

sudo umount /media/hdd/bob_extra

setup automount

Create /home/bob/bin/automount_ecryptfs.extra, which will mount it if it hasn't been mounted already.



grep -q $MOUNT_POINT /proc/mounts
if [ $? -eq 1 ]; then
  mount.ecryptfs_private extra

Make it executable (chmod +x), then add it into /home/bob/.bashrc:


Then add it to Gnome's Startup Applications as well.

  • +1 Thanks for the answer. I have a far more complicated setup now with multiple SSDs and symlinks to a shared drive, so I won't be able to test this. I'm hopeful encrypting multiple HDDs will be as simple as encrypting /home someday. Jul 19, 2012 at 20:05
  • See also ecryptfs-mount-private which is similar more featured. E.g. it can automatically use a key from the user's keyring.
    – mc0e
    Feb 5, 2016 at 12:23
  • 1
    This answer is about mounting a eCryptfs private directory. The question was about mounting a LUKS partition created with the Disks utility.
    – Victor
    Jun 23, 2017 at 21:05

When I wrote this answer a few years ago this was the best way of implementing the solution. I'd now suggest that you look at the next answer using mount.ecryptfs_private instead.

I was also looking for a way to automatically mount a second eCryptfs volume. The following collection of scripts and configuration modifications will securely and automatically mount your volume on login, either to the GUI or the CLI.

There is a better solution that's in the process of being created (though I think not quite ready for automatic mounting on user login, as such this script will have a limited shelf life.):

ecryptfs on too-small harddrive - how to add links into the encryption?

The security of the scripts depends on your home directory being encrypted with eCryptfs so that the script and files with the password to unwrap your passphrase are encrypted. If you leave your computer unlocked with a root shell open after log in it will be possible to access the passwords, however use of sudo NOPASSWD allows secure mounting of the partition without requiring password entry or leaving the passphrase in a file readable by the user.

One known deficiency of these scripts is that your second volume will not be unmounted on logout, as such it's not particularly suitable for multi user systems.

My solution is implemented with several parts, two shell scripts, one that performs the actual mounting and another that serves as a wrapper for it.

This is the wrapper script that validates if the directory is already mounted, if it isn't then it will call the mounting script using sudo:




grep -q $MOUNT_POINT /proc/mounts
if [ $? -eq 1 ]; then
  sudo /home/johnf/scripts/mount_other_ecryptfs

This script calls /home/johnf/scripts/mount_other_ecryptfs which is as follows.

Note that this script assumes that you have file name encryption enabled, if you don't it will be necessary to either modify the script to handle detection (look at ecryptfs-recover-private) or you could remove the ecryptfs_fnek_sig mount option.

The following is the /home/johnf/scripts/mount_other_ecryptfs script:


ECRYPTFS_SIG=`head -1 ${ENCRYPTED_VOLUME}//../.ecryptfs/Private.sig`
ECRYPTFS_FNEK_SIG=`tail -1 ${ENCRYPTED_VOLUME}//../.ecryptfs/Private.sig`

printf "%s" $MOUNT_PASSWORD | ecryptfs-insert-wrapped-passphrase-into-keyring ${ENCRYPTED_VOLUME}/../.ecryptfs/wrapped-passphrase
mount -t ecryptfs -o key=passphrase:passfile=${PASSFILE},ecryptfs_sig=${ECRYPTFS_SIG},ecryptfs_fnek_sig=${ECRYPTFS_FNEK_SIG},ecryptfs_cipher=aes,ecryptfs_key_bytes=16,ecryptfs_passthrough=n ${ENCRYPTED_VOLUME} ${MOUNT_POINT}

You will also need to create a file with your password in it, this file will be used by the eCryptfs mount command:



You need to modify the permissions on several files:

chmod +x /home/johnf/scripts/automount_ecryptfs
sudo chown root:root /home/johnf/scripts/mount_other_ecryptfs /home/johnf/scripts/ecryptfs_passphrase
sudo chmod a=x /home/johnf/scripts/mount_other_ecryptfs
sudo chmod 400 /home/johnf/scripts/ecryptfs_passphrase

Before creating the scripts you need to create a sudoers configuration to permit the execution of the mounting script using sudo without entering your sudo password.

Add the following to /etc/sudoers (or a file in /etc/sudoers.d). You will want to replace johnf with your username. It's necessary to use an absolute path to the mounting script.

johnf   ALL = NOPASSWD: /home/johnf/scripts/mount_other_ecryptfs

The final step is to call the automount_ecryptfs script on login.

On Ubuntu Unity (and probably gnome) use the Startup Applications applet to create a new startup program that calls /home/johnf/scripts/automount_ecryptfs.

To automatically mount the second eCryptfs volume on login into a bash shell you will want to modify your ~/.bashrc file. Add the following:


With this configuration in place you should now automatically mount your second eCryptfs volume.

  • Wow, great answer! Upvoted and accepted. Can't test it yet but this looks very complete. Mar 21, 2012 at 8:26
  • The author of mount.ecryptfs_private now recommends the use ecryptfs-mount-private, also by him, which is a wrapper script for mount.ecryptfs_private. thesimplecomputer.info/… may be worth a read for the relative merits of ecryptfs and LUKS.
    – mc0e
    Feb 5, 2016 at 12:17

You no longer need the solutions above.


Note: this method is less secure than mounting an encrypted drive manually. If someone has physical access to your computer, you are careless with your root password, or your computer has multiple users/guest accounts, this method is not secure; the secondary drive stays mounted when you log out but do not shut down the system, so its contents are visible to other users.

Part 1: Encrypt the secondary drive.

  1. In the Unity dash type "disks" and hit enter.
  2. Below "Devices" click on the hard drive you want to encrypt.
  3. Below "Volumes" click on the cog/more actions button.
  4. Click "Format Volume". For type, choose "Encrypted, compatible with Linux systems." Name your drive and give it a strong pass phrase.
  5. Click "Format"

Part 2: Automatically mount the HDD on system start-up.

  1. Keep the "Disks" application open, and click on the cog.
  2. Click "Edit Encryption Options."
  3. "Automatic Encryption Options" will be turned on, and the menu below greyed out. Turn automatic encryption options off.
  4. Enter the pass phrase from when you formatted the disk. Click "Ok".

You now have an encrypted hard drive that will automatically mount when your computer boots.

  • 1
    While I'm sure that someone will have a use for this, it's not an answer to the question as posed, which specifies that the secondary mount should occur at user login, as opposed to system startup. This makes the initial claim that "You no longer need the solutions above" inappropriate, and I invite the author to reword the answer accordingly.
    – mc0e
    Feb 5, 2016 at 11:35
  • 2
    I think you are wrong here. That is, the secondary mount does occur at user login (only on the account the operation I mentioned was performed on) and not a second before hand. When my wife logs into her Ubuntu account on the same computer the drive is not mounted. If she tries to mount it, it asks for the encryption key. I maintain, you do not need the answers above.
    – tryion
    Apr 9, 2016 at 6:38
  • 1
    Agreed, this is by far the simplest way now as I am the only user on the machine. It won't work for everyone but if you have an Ubuntu install and you are the primary/admin user, this is the way to go. There really should be a big "Make this work exactly like encrypted /home" check-box somewhere by now, it's a simple use-case. Jul 6, 2016 at 12:46
  • 1
    @tryion The LUKS partition is unlocked at system startup, but not mounted. So as soon as the computer is turned on, it is as accessible as an unencrypted partition. The password is stored in cleartext in /etc/crypttab. No user password is necessary to access the partion. So this setting is equivalent to having no encryption at all, and is not an answer to the question.
    – Victor
    Jun 23, 2017 at 19:30
  • Are there options for storing it elsewhere using libsecret to unencrypt for a specific user, and is there a cli guide to this for non-GUI / headless users.
    – MrMesees
    Mar 12, 2018 at 14:11

Create a script in your encrypted home directory: ~/scripts/mount_storage.sh:


sudo cryptsetup open --type luks UUID=12e26119-0ee2-4eb4-bd40-d8a3547ecf0c storage --key-file ~/keys/storage_keyfile
sudo mount /dev/mapper/storage /storage

Add to "Startup Applications":

sh ~/scripts/mount_storage.sh

Add to /etc/sudoers:

%sudo   ALL= NOPASSWD: /sbin/cryptsetup open --type luks UUID=12e26119-0ee2-4eb4-bd40-d8a3547ecf0c storage --key-file *
%sudo   ALL= NOPASSWD: /bin/mount /dev/mapper/storage /storage

You need to have created the /storage mount point and change UUID in the above script (find it with blkid).

  • Is there an easy way to get a script like this to run whenever a USB is plugged in?
    – naught101
    Mar 3, 2019 at 8:00
  • I haven't tried this myself so cannot say for sure but I don't see why not. You would need to create a udev rule which targets a specific USB device and runs the above script. This post could be a starting point, for example. Mar 3, 2019 at 15:56

Proceeding as follows should be secure. Requiring the passphrase stops other users from getting access to the volume, even though it is mounted.

1.Open Disks, choose the drive and click on the LUKS volume. Click on the cogwheels and unchoose "User Session Defaults". Choose "Unlock at system startup" and "Require additional authorization to unlock": enter image description here

2.Click on the disk volume (below the LUKS volume). Click on the cogwheels and unchoose "User Session Defaults". Choose "Mount at system startup" and "Show in user interface": enter image description here

You could also choose to require additional authentication to mount the volume, but in that case the mounting would not be automatic for the user in question.

  • This should be the accepted answer -- it's simple and it works.
    – moomima
    Dec 22, 2020 at 21:39

I'm afraid that this isn't going to be a popular answer...

It's not going to be possible to automatically mount any encrypted partition, without circumventing the security of the encryption itself.

Think about what "automatically" means, and understand that automatically means that they will get to see your data too.

  • I used 'Securely' subjectively, I could remove it from the question. I just want the encrypted drive full of photos to be mounted when I log in, just like /home is. I know that this is theoretically possible, since I have a third (also encrypted) drive as a destination for Déjà Dup. That drive only gets mounted when the backup utility fires up. Fully automatic, I have the key saved so I don't enter it each time. I'm comfortable with having all my keys handled automatically after I enter my password at the login screen. Any idea how to make this happen? Thanks. Feb 19, 2012 at 11:41
  • 3
    Automatically in this context means that it should be mounted after you enter your login password. You login password can be the key, or more often the key to the key, to your encrypted partition. This is reasonable secure (giving a good login password). Mar 21, 2012 at 14:08
  • It will not be automatically mounted in another computer, which is the reason why most of us encrypt some disks. In my case it is a disk I use to make backups. I work in a shared space and know that one of you guys with a lot of knowledge will be able to circumvent whatever I do with physical access to my disk/computer: I just want to reduce the accessibility to my files so that anybody else can not do it. Mar 28, 2013 at 15:00
  • By making it an automatic process, would it be possible that someone who steals your computer, could access to the key of your encrypted extra HD?? (and then of course mount and access this HD)
    – miguelfg
    Apr 28, 2017 at 10:03
  • Easy, obvious scenario: I plug in a USB drive to a server in the office to back up data. I take the USB drive home to ensure off-site backups in case Something Bad Happens to the server. Someone breaks into my car and takes the USB disk while I'm at the store on the way home. Now they have to 1) know where the server even is, and 2) break into the office to decrypt the disk. That part is a whole lot harder than "just plug it into their computer at home".
    – Ernie
    Jul 13, 2017 at 21:05

Updating on rcoup's anwser :

  • as per mount.ecryptfs_private manpage, it will do nothing if the folder is already mounted, so it is not useful to check for that ;
  • it is probably more suitable to use systemd to auto-run it, as it will be independent from bash or the graphical session, and it also gives a convenient way to explicitly unmount at the end of the session.

So we can do systemctl --user edit --force --full mount-ecryptfs-extra.service : this opens up an editor, in which we can type

Description=Mount ecryptfs folder extra

ExecStart=mount.ecryptfs_private extra
ExecStop=umount.ecryptfs_private extra


Then systemctl --user install mount-ecryptfs-extra.service.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.