28

I need to change my user password. Do I need to take any extra steps for my encrypted home directory to become inaccessible with my old password and only accessible with my new password?

Improve this question

1 Answer 1

Reset to default
42

There is no need to re-encrypt your home directory, and no further steps need to be taken.

Your home directory is not directly encrypted with your password. Instead, the passphrase used to encrypt the home directory is itself encrypted with your password.

When you change your password, the home directory passphrase is re-encrypted with your new password, so you should have continued access to your files with the new password.

This is handled via PAM (Pluggable Authentication Modules), so should work with any password change tool. The exception is administrative password changes where the original password is not provided. This is expected behaviour though: if the administrator could decrypt your files without knowing your password then there would be no actual protection.

In the case you perform an administrative password change, after mounting your home directory with

ecryptfs-mount-private

and your old password, issue

ecryptfs-rewrap-passphrase ~/.ecryptfs/wrapped-passphrase

to change the unwrapping password to match your new one. This way your home directory will be auto-mounted at login, just as it used to.

Improve this answer
6
  • Okay. Also, will passwd from bash do it properly or do I need to use GUI tools?
    – Septagram
    Apr 6, 2011 at 1:53
  • 3
    Yes. The encrypted home directory system is hooked in via PAM (Pluggable Authentication Modules), so any tool that makes use of PAM (such as the command line passwd tool) should work.
    – James Henstridge
    Apr 6, 2011 at 2:36
  • 8
    One other note that might not be immediately obvious: if you use some kind of administrative password reset where the original password is not provided, it won't be possible to re-encrypt the home directory passphrase. It is possible to recover from this situation if you know your old password, but it is something to keep in mind.
    – James Henstridge
    Apr 6, 2011 at 2:49
  • 1
    By editing your answer you should add your comments there to make it great.
    – Takkat
    Apr 6, 2011 at 6:38
  • 1
    In the case you perform an administrative password change, after mounting your home directory with ecryptfs-mount-private and your old password, issue ecryptfs-rewrap-passphrase ~/.ecryptfs/wrapped-passphrase to change the unwrapping password to match your new one.
    – zakkak
    Jun 6, 2014 at 21:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .