I need to change my user password. Do I need to take any extra steps for my encrypted home directory to become inaccessible with my old password and only accessible with my new password?
There is no need to re-encrypt your home directory, and no further steps need to be taken.
Your home directory is not directly encrypted with your password. Instead, the passphrase used to encrypt the home directory is itself encrypted with your password.
When you change your password, the home directory passphrase is re-encrypted with your new password, so you should have continued access to your files with the new password.
This is handled via PAM (Pluggable Authentication Modules), so should work with any password change tool. The exception is administrative password changes where the original password is not provided. This is expected behaviour though: if the administrator could decrypt your files without knowing your password then there would be no actual protection.
In the case you perform an administrative password change, after mounting your home directory with
and your old password, issue
to change the unwrapping password to match your new one. This way your home directory will be auto-mounted at login, just as it used to.
Okay. Also, will passwd from bash do it properly or do I need to use GUI tools? Apr 6, 2011 at 1:53
3Yes. The encrypted home directory system is hooked in via PAM (Pluggable Authentication Modules), so any tool that makes use of PAM (such as the command line
passwdtool) should work. Apr 6, 2011 at 2:36
8One other note that might not be immediately obvious: if you use some kind of administrative password reset where the original password is not provided, it won't be possible to re-encrypt the home directory passphrase. It is possible to recover from this situation if you know your old password, but it is something to keep in mind. Apr 6, 2011 at 2:49
1By editing your answer you should add your comments there to make it great.– TakkatApr 6, 2011 at 6:38
1In the case you perform an administrative password change, after mounting your home directory with
ecryptfs-mount-privateand your old password, issue
ecryptfs-rewrap-passphrase ~/.ecryptfs/wrapped-passphraseto change the unwrapping password to match your new one.– zakkakJun 6, 2014 at 21:50