10

I'm in the process of moving my OS and data from one drive to another within the same computer. (I got a nice, new SSD.) My old home directory had an encrypted sub directory inside, and I'd like to access the encrypted directory from my new install. I'm trying to use ecryptfs-recover-private. However, I run into the following error.

$ sudo ecryptfs-recover-private /BLAH/.Private
INFO: Found [.Private/].
Try to recover this directory? [Y/n]: 
INFO: Found your wrapped-passphrase
Do you know your LOGIN passphrase? [Y/n] 
INFO: Enter your LOGIN passphrase...
Passphrase: 
Inserted auth tok with sig [BLAH] into the user session keyring
mount: mount(2) failed: No such file or directory
ERROR: Failed to mount private data at [/tmp/ecryptfs.NcWkVmQ5].

I run into the same problem if I let ecryptfs-recover-private find the directory on its own or if I say no to the login passphrase but use the mount passphrase instead.

Thoughts?

(I realize there are several, similar questions on this site, but none seem to quite cover my situation.)

4

So this simple command ecryptfs-recover-private, proved to be unreliable. None of the metohd above worked for me, trying to move from ecryptfs to LUKS container.

What did work, was the manual method describe in ubuntu community wiki

In detail:

# sudo -i
# ecryptfs-add-passphrase --fnek 
Inserted auth tok with sig [aaaaaaaaaaaaa] into the user session keyring 
Inserted auth tok with sig [bbbbbbbbbbbbb] into the user session keyring  
# mkdir -p /mnt/new_mount_point  
# mount -t ecryptfs /mnt/old_mount_point/home/username/.Private /mnt/new_mount_point
  • select 3 (use a passphrase key type, and use your recovered passphrase aka unwrapped-passphrase)
  • select aes (use the aes cipher)
  • select 16 (use a 16 byte key)
  • enable plaintext passthrough: n
  • enable filename encryption: y
  • 1
    this worked for me but there is a final question after the filename encryption which asks for the FNEK signature to use, defaulting to the first auth tok in the output from ecryptfs-add-passphrase --fnek. I found I had to use the 2nd one instead. – darrend Apr 8 at 0:58
  • This. The only method that works for me is to open the ubuntu community wiki linked above, and follow the instructions. – fdierre May 3 at 20:52
  • This worked for me! I followed the "Recovering Your Data Manually" instructions directly, as you indicated, here: help.ubuntu.com/community/…. Just remember that if you need to follow the section "Recovering Your Mount Passphrase" as well, you need to use sudo, even though they don't mention it. ie: instead of ecryptfs-unwrap-passphrase /home/username/.ecryptfs/wrapped-passphrase, do sudo ecryptfs-unwrap-passphrase /home/.ecryptfs/username/.ecryptfs/wrapped-passphrase (notice also the slightly different path I used). – Gabriel Staples Jul 13 at 1:29
4

I'm not sure why this happens - maybe a screw-up in the kernel keyring when using the same LOGIN passphrase on your new setup as on the one you try to recover.

That said, adding the wrapped passphrase into the kernel keyring before trying to recover the filesystem works (be sure to use sudo on both commands below):

sudo ecryptfs-insert-wrapped-passphrase-into-keyring /BLAH/.ecryptfs/wrapped-passphrase
sudo ecryptfs-recover-private /BLAH/.Private
  • Thanks! This worked for me... – Kanchu Jun 14 at 14:46
  • sudo is required on the first command too (ecryptfs-insert-wrapped-passphrase-into-keyring) or else I get the following error! Error: Unwrapping passphrase and inserting into the user session keyring failed [-5] Info: Check the system log for more information from libecryptfs – Gabriel Staples Jul 11 at 6:32
  • ...but unfortunately the 2nd command (sudo ecryptfs-recover-private /BLAH/.Private) still fails for me. :( mount: /tmp/ecryptfs.aLkDeiWo: mount(2) system call failed: No such file or directory. ERROR: Failed to mount private data at [/tmp/ecryptfs.aLkDeiWo]. – Gabriel Staples Jul 11 at 6:35
2

I'm currently using debian testing and I recently needed to recover a file from the backup of my encrypted .Private folder. The backup is stored on my NAS. I experienced the same issue as you. Manually inserting the wrapped passphrase did not help and manually mounting the cifs filesystem (from my NAS) by root instead of creating the mount as my main user (to prevent right conflicts and whatever) did also not help.

However, after plainly rebooting my system, I could directly use the ecryptfs-recover-private command to mount the .Private folder, which itself was located on the cifs filesystem.

Though this is not explaining what's going wrong and it's one of the more frustrating hints you could get as a linux user:

reboot your system and try again :)

  • Ah, the oldest trick in the book! Good to know. – lnmaurer Dec 9 '15 at 15:36
0

I had similar errors after I renamed the previous (original) POSIX username to old_user (and ) and then created a new user with the original (previous username's) name.

To be able to mount the encrypted home directory from the old_user, I had to remake the symbolik links for .encryptfs and .Private in its folder (as they had poinded to /home/original_name/).

After that, the following command mounted the old home without any problem. /usr/bin/ecryptfs-recover-private /home/old_user/.Private

  • I think I have a very similar problem, but not sure how you did solve it... Do you mind having a look at my new post? Thanks! askubuntu.com/questions/1035424/… – Matifou May 12 '18 at 22:54
  • Hi, Matifou! What do you have in your syslog right after the attempt to do ecryptfs-recover-private /home/.ecryptfs/old_user/.Private ? – Yaroslav Fedorina May 14 '18 at 10:07
  • Hey! If you have problems with the key (see dmesg or syslog), e.g. Could not find key with description: [XXX] process_request_key_err: No key Could not find valid key in user session keyring for sig specified in mount option: [XXX] then, try adding the passphrase manually: Option "1" in /usr/bin/ecryptfs-manager It helped me. – Yaroslav Fedorina May 14 '18 at 11:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.