1

I have an ubuntu MATE setup 18.04 LTS (GNU/Linux 4.15.0-23-generic x86_64) I want to have an encrypted $HOME while the rest remains unencrypted. Additionally, I decided to use btrfs with zstd compression algorithm (the "why" is outside the scope of this question).

Due to how the PC will be used. There's a need to wait for internet until the decryption password is needed, at which point, the password may be asked to the user in any form.

At first, I encountered these symptoms:

If I leave the whole /home/myUser encrypted, I'm unable to login. After I fill the password, I'm left hanging.... Until the timeout happens and lightdm gives up logging in. If I use a different tty, I'm also left hanging except the $HOME is changed to "/"

If I change, in fstab the mount directory to somewhere inside $HOME, I can login normally but I'm never given the prompt to fill the password when I want to access the encrypted directory (although the directory is visible when doing ls).

After investigation, I found out that:

  1. if I successfully login,
  2. try to access /home/myUser/crypt (see below)
  3. then run systemd-tty-ask-password-agent --query in a terminal,

there's a password waiting to be filled.

I also noticed that, if instead of running the terminal, I just stop lightdm and stay on tty7, the text "Please enter password with the systemd-tty-ask-password-agent tool!" appears.
At that point, I can't get back to lightdm in that tty. Instead, I have to use a different tty to login, fill the password and now mount has completed and all is running properly.

My objective is to have a GUI password prompt for the password at the time the directory needs to be mounted. Any program may initiate the mount but I need the user to get the prompt visibly without the need of running extra tools.

I also tried to make a keyscript to use with crypttab which would initiate the command prompt and prompt for password but it was failing to start. I guess because there was no keyfile.


Below, I'm using noauto,x-systemd.automount but I could also use _netdev and get almost the same symptoms as above.
When using _netdev, the only difference is that the encryption password prompt (as text) flashes on the screen right before lightdm starts Xorg.


/etc/fstab

/dev/mapper/encryptedHome   /home/myUser    btrfs    user,noauto,x-systemd.automount,x-systemd.device-timeout=10,compress=zstd,lazytime,relatime   0 0

/etc/fstab (alternate try which allows me to login):

/dev/mapper/encryptedHome   /home/myUser/crypt    btrfs    user,noauto,x-systemd.automount,x-systemd.device-timeout=10,compress=zstd,lazytime,relatime   0 0

/etc/crypttab

encryptedHome  UUID="92ab7f24-c744-4f1a-8363-c1fa157d1c12"  - luks,noauto

Note: In my linux startup flags, I removed the splash option; because of that, I see all tty text until Xorg is started.

0

In order to reuse the password you insert when logging in and get your home encrypted, while entering your password only once, one possible solution is to use pam_mount
https://wiki.archlinux.org/index.php/pam_mount

First, you can install it using apt install libpam-mount

Then, you need to configure pam_mount what is supposed to reuse the password.
For that, create a file at /etc/security/pam_mount.conf.xml with contents as follows:

<volume user="user" fstype="crypt" path="/dev/disk/by-partuuid/96au7f24-gbshmec6wwabhh30" mountpoint="/dev/mapper/user_home"/>
<volume user="user" fstype="auto" path="/dev/mapper/user_home" mountpoint="/home/user"/>

You may be able to do all with just one volume tag but I was unable to as I needed to do a binded mount.

Do note you may need to use some options, set as attributes of the volume tag, such as:

options="bind,rw,user,exec,suid,noauto,lazytime,relatime"

You can learn more of what each one is in the mount manual pages.

Finally, create the file /etc/pam.d/system-login and write the following:

#%PAM-1.0

auth       required   pam_tally.so         onerr=succeed file=/var/log/faillog
auth       required   pam_shells.so
auth       requisite  pam_nologin.so
auth       optional   pam_mount.so
auth       include    system-auth

account    required   pam_access.so
account    required   pam_nologin.so
account    include    system-auth

password   optional   pam_mount.so
password   include    system-auth

session    optional   pam_loginuid.so
session    optional   pam_keyinit.so       force revoke
session [success=1 default=ignore]  pam_succeed_if.so  service = systemd-user quiet
session    optional   pam_mount.so
session    include    system-auth
session    optional   pam_motd.so          motd=/etc/motd
session    optional   pam_mail.so          dir=/var/spool/mail standard quiet
-session   optional   pam_systemd.so
session    required   pam_env.so

I don't know exactly what each of these does individually but this is what I needed to have there so the mount would succeed as I wanted.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.