ecryptfs and ssh pubkey login - How automount and other stuff?

Question

I have moved my ssh authorized_keys to an /etc/ssh/ subfolder, so I can login with pubkeys and have root in control of ssh access, but there are 2 problems left.

It does not automount my users ecryptfs and when I manually mount it my terminal settings arent loaded, things like aliases and paths. How can I make this happen on sshlogin?

Answer 1

You can't do pubkey logins and have automount work. The login password is needed to decrypt the mount key. The login password isn't available when doing pubkey-based logins.

Answer 2

As already reported, ecryptfs does use your password to "unwrap" the mount key, and if you don't provide it when loggin in, it won't work.

However...

If you do run ecryptfs-umount-private to unmount the encrypted home, followed by a mkdir ~/.ecryptfs/presets ; ln -s ~/.ecryptfs/presets/.profile ~/.profile and remount the encrypted home with ecryptfs-mount-private. You will have a file in "~/.ecryptfs/presets/" called ".profile" which will be sourced on every connection. (If you it is unnecessary to be able to tweak this file with an mounted private home, you could just as well just create a real textfile called .profile in your unmounted home, instead of the softlink above).

The content of ~/.ecryptfs/presets/.profile (or unmounted "~/.profile"), could be something in the line of

ecryptfs-mount-private && cd ~ && . ./.profile 

That will make sure your home is unencrypted, or otherwise ask you of your password to unencrypt it, change directory to your new mounted home, and source the ordinary .profile, which will set up your shell as you are accustomed to.

Answer 3

Actually I made it possible by copying .profile to the home folder when private is unmounted. So aliases and colors work. Now remote X apps wont show "because of wrong authentication". It works when already logged in physical and then sshed.