Move ecryptfs .Private directory to another partition

Question

I don't like to keep my data in the same partition as my Home directory; so I configure my machine with a small home partition which contains a symlink to my large data partition.

For this reason, the default behavior of ecryptfs-setup-private utility doesn't quite work for me.

I would like the Private directory in my home directory; pointing to the .Private encrypted directory located in my large data partition. Is there an easy way to achieve this and still retain the automount behavior that I get with ecryptfs-setup-private?

Answer 1

I also wanted to accomplish the same thing, so I've tested a little bit and realized that symlinks alone can do what we want.

You can simply move the .Private folder to some other partition, and create a symlink at the old location pointing to the location of .Private in the new partition.

Automount and unmount still works perfectly.

Answer 2

You can add volume definitions to /etc/security/pam_mount.conf.xml:

<volume user="steve" mountpoint="/home/steve/.Private" path="/dev/loop0" fstype="crypt" />

and make sure pam includes this by adding @include common-pammount in /etc/pam.d/login and /etc/pam.d/gdm.

During bootup the loop device is setup by adding in /etc/rc.local:

losetup /dev/loop0 /data0/private/steve

Make sure the file setup as the loop device is the LUKS encrypted file (run file on the datadirectory).

You can check beforehand if this should work by running the following commands (run them one by one so you can type in the password), and assuming the file with the encrypted partition is /data0/private/steve and that /home/steve/.Private is an empty directory:

losetup /dev/loop0 /data0/private/steve
cryptsetup luksOpen /dev/loop0 home.crypt
mount /dev/mapper/home.crypt /home/steve/.Private

For the automount to work, I had to make my login password the same as for the encrypted file on the big partition.