Creating a new encrypted folder and moving the files into it should work, it maintains them in an encrypted state on-disk the whole time. But it's the automatic decrypt on login that may be a problem.
Creating a custom PAM module that can take the login passphrase and use it to decrypt/mount anything else (eCryptFS, EncFS, LUKS, etc) would be a general purpose solution...
ecryptfs-setup-private would work, but eCryptFS does not support nested encrypted folders (one eCryptFS with one key, inside another eCryptFS with a different key) so having an encrypted home may cause problems, but you can try a few other answers and see if one works:
Script inside your home that runs at login
Since your home's already encrypted, having a script there isn't as bad as usual, you could even keep the passphrase in plaintext in the script too (normally a terrible idea, but encrypted home).
First, get a script to run at login:
A .desktop file in ~/.config/autostart will get run on login, telling it to run a bash script that mounts your encrypted folder should work. Since your home is already encrypted, you could store the other mount passphrase in the bash script, not perfect security but still encrypted on disk, if you didn't want to enter it each time. For example
~/.config/autostart/test.desktop. A very basic one like this should work:
Or to wait a few seconds before starting (ex. give the desktop time to initialize before prompting for a passphrase) and run as root, try this:
Exec=sudo bash -c "sleep 5; /home/user/.config/autostart/runme.sh"
Then, find a script to decrypt your other folder. If you're using EncFS then it would only be basically one line, but eCryptFS is different. The easiest might be to (temporarily) create a new user, have that user run
ecryptfs-setup-private and then copy the resulting encrypted folder to your new location.
The following script assumes it's a second encrypted home you want to mount:
# Modified by Xen2050 from:
# Copyright (C) 2010 Canonical Ltd.
# Authors: Dustin Kirkland <email@example.com>
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, version 2 of the License.
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
echo "ERROR: $@" 1>&2
echo "Usage: ecryptfs-mount-single [--rw] [encrypted private dir] [mountpoint]"
echo "\tWill attempt to mount [encrypted private dir (.Private)] to [mountpoint]"
echo "\twith standard options: ecryptfs_cipher=aes,ecryptfs_key_bytes=16"
echo "\n\t--rw\tmount with read-write access (optional)"
echo "\t[mountpoint] will attempt to be created if it does not exist"
echo "INFO: $@"
# We need root access to do the mount
[ "$(id -u)" = "0" ] || error "This program must be run as root."
# Handle parameters
if [ "$1" = "--rw" ]; then
if [ -d "$1" ]; then
# Allow for target directories on the command line
# Only supplying one directory
error "No private directory found; it must be supplied."
if [ ! -d "$2" ]; then
mkdir -p "$2" || error "mountpoint $2 does not exist, can not create"
# mount directory on the command line
# Determine if filename encryption is on
ls "$d/ECRYPTFS_FNEK_ENCRYPTED"* >/dev/null 2>&1 && fnek="--fnek" || fnek=
if [ -f "$d/../.ecryptfs/wrapped-passphrase" ]; then
info "Found your wrapped-passphrase"
echo -n "Do you know your LOGIN passphrase? [Y/n] "
case "$lpw" in
# Use the wrapped-passphrase, if available
info "Enter your LOGIN passphrase..."
sigs=$(sed -e "s/[^0-9a-f]//g" "$d/../.ecryptfs/Private.sig")
# Fall back to mount passphrase
info "Could not find your wrapped passphrase file."
if [ "$use_mount_passphrase" = "1" ]; then
info "To recover this directory, you MUST have your original MOUNT passphrase."
info "When you first setup your encrypted private directory, you were told to record"
info "your MOUNT passphrase."
info "It should be 32 characters long, consisting of [0-9] and [a-f]."
echo -n "Enter your MOUNT passphrase: "
sigs=$(printf "%s\0" "$passphrase" | ecryptfs-add-passphrase $fnek | grep "^Inserted" | sed -e "s/^.*\[//" -e "s/\].*$//" -e "s/[^0-9a-f]//g")
case $(echo "$sigs" | wc -l) in
mount_sig=$(echo "$sigs" | head -n1)
mount_sig=$(echo "$sigs" | head -n1)
fnek_sig=$(echo "$sigs" | tail -n1)
(keyctl list @u | grep -qs "$mount_sig") || error "The key required to access this private data is not available."
(keyctl list @u | grep -qs "$fnek_sig") || error "The key required to access this private data is not available."
if mount -i -t ecryptfs -o "$mount_opts" "$d" "$tmpdir"; then
info "Success! Private data mounted at [$tmpdir]."
error "Failed to mount private data at [$tmpdir]."
Unmounting before/when logging out, and maybe removing the keys from the kernel keyring (with
keyctl clear or purge,
sudo keyctl clear @u clears all) are probably good ideas. I had a 2nd folder mounted inside an encrypted home, and logged out, it apparently unmounted the 2nd folder (not in /proc/mounts) but still showed up in
May have the most problems because of the already eCryptFS encrypted home...
~/.Private underlying directory containing encrypted data (OR a link from
~/.Private to a different folder elsewhere), but change the mountpoint folder to a different one:
Move/create a new mountpoint folder
mv ~/Private /path/to/new/folder
Change the contents of
~/.ecryptfs/Private.mnt (file containing path of the private directory mountpoint) to the new mountpoint folder
echo /path/to/new/folder > ~/.ecryptfs/Private.mnt
~/.ecryptfs/auto-umount files exist the folder will be automatically mounted/unmounted on login/logout.
For manual mounting/decrypting (password will be required), run
For manual unmounting, run