0

My laptop (Ubuntu 12.04) stopped mounting my encrypted home drive today after several months of working fine. I have been using the same login password since I set up the encrypted home drive a few months back with no issues. /var/log/syslog is showing that it is an Incorrect wrapping key for my wrapped passphrase. I figure this means that my wrap-passphrase file is corrupted and is no longer valid. I have my mount passphrase password from when I encrypted the home drive.

I booted from LiveCD and executed the following process:

root@ubuntu:/media/backup/home/me# ecryptfs-recover-private 
INFO: Searching for encrypted private directories (this might take a while)...
INFO: Found [/media/backup/home/.ecryptfs/me/.Private].
Try to recover this directory? [Y/n]: Y
INFO: Found your wrapped-passphrase
Do you know your LOGIN passphrase? [Y/n] n
INFO: To recover this directory, you MUST have your original MOUNT passphrase.
INFO: When you first setup your encrypted private directory, you were told to record
INFO: your MOUNT passphrase.
INFO: It should be 32 characters long, consisting of [0-9] and [a-f].

Enter your MOUNT passphrase: 
INFO: Success!  Private data mounted read-only at [/tmp/ecryptfs.COf2NZVr].

However, when I cd to the tmp folder (i.e. cd /tmp/ecryptfs.COf2NZVr), all I see are encrypted files (ECRYPTFS_FNEK_ENCRYPTED.F...). Based on the question/answer located under ecryptfs-recover-private creating unreadable encrypted folders, it appears they fixed this issue with using the login passphrase. However, as I already pointed out, my login passphrase is not working.

Since the mounted Passphrase is partially working (it allows me to mount up in /tmp the files successfully) is there anything else I can do to get these files unencrypted? Any help would be appreciated.

  • Are the files actually decrypted? Can you look at / in some of them and there's regular visible data/text, not just encrypted code? Also check dmesg & /var/log/syslog for any messages about filename encryption / fnek – Xen2050 Dec 6 '15 at 12:33
0

Karl,

I did go back and look at syslog a little more carefully. I was taking it at face value that when ecryptfs-recover-private actually came back and stated it mounted successfully, that it actually did mount and unencrypt. While it is true that it mounted the directory, it was not unencrypted. Once I understood this, I checked my password a realized I was leaving off the last two characters and only putting in 30 instead of the 32. Once I added this, my directory was mounted and the files are unencrypted. Thanks for making me get in there and take a closer look!

I think that the ecryptfs-recover-pivate command should state if it does not unencrypt even if it does mount successfully.

Thanks,

Greg

  • The script does check if mount returns success, it uses this line ` if mount -i -t ecryptfs -o "$mount_opts" "$d" "$tmpdir"; then` but apparently it will mount successfully (with the wrong mount passphrase) without working correctly. Using the wrapped-passphrase file would probably fail if you had the wrong login passphrase – Xen2050 Dec 14 '15 at 4:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.