I have an ubuntu MATE setup 18.04 LTS (GNU/Linux 4.15.0-23-generic x86_64) I want to have an encrypted $HOME while the rest remains unencrypted. Additionally, I decided to use btrfs with zstd compression algorithm (the "why" is outside the scope of this question).
Due to how the PC will be used. There's a need to wait for internet until the decryption password is needed, at which point, the password may be asked to the user in any form.
At first, I encountered these symptoms:
If I leave the whole
/home/myUser encrypted, I'm unable to login. After I fill the password, I'm left hanging.... Until the timeout happens and lightdm gives up logging in. If I use a different tty, I'm also left hanging except the $HOME is changed to "/"
If I change, in fstab the mount directory to somewhere inside
$HOME, I can login normally but I'm never given the prompt to fill the password when I want to access the encrypted directory (although the directory is visible when doing ls).
After investigation, I found out that:
- if I successfully login,
- try to access
- then run
systemd-tty-ask-password-agent --queryin a terminal,
there's a password waiting to be filled.
I also noticed that, if instead of running the terminal, I just stop lightdm and stay on tty7, the text "Please enter password with the systemd-tty-ask-password-agent tool!" appears.
At that point, I can't get back to lightdm in that tty. Instead, I have to use a different tty to login, fill the password and now mount has completed and all is running properly.
My objective is to have a GUI password prompt for the password at the time the directory needs to be mounted. Any program may initiate the mount but I need the user to get the prompt visibly without the need of running extra tools.
I also tried to make a
keyscript to use with crypttab which would initiate the command prompt and prompt for password but it was failing to start. I guess because there was no keyfile.
Below, I'm using
noauto,x-systemd.automount but I could also use
_netdev and get almost the same symptoms as above.
_netdev, the only difference is that the encryption password prompt (as text) flashes on the screen right before lightdm starts Xorg.
/dev/mapper/encryptedHome /home/myUser btrfs user,noauto,x-systemd.automount,x-systemd.device-timeout=10,compress=zstd,lazytime,relatime 0 0
/etc/fstab (alternate try which allows me to login):
/dev/mapper/encryptedHome /home/myUser/crypt btrfs user,noauto,x-systemd.automount,x-systemd.device-timeout=10,compress=zstd,lazytime,relatime 0 0
encryptedHome UUID="92ab7f24-c744-4f1a-8363-c1fa157d1c12" - luks,noauto
Note: In my linux startup flags, I removed the
splash option; because of that, I see all tty text until Xorg is started.