I am following below procedure to mount my Private directory

root@pc:~# mount -t ecryptfs /testdata/ /testdata/
Select cipher: 
 1) aes: blocksize = 16; min keysize = 16; max keysize = 32
 2) blowfish: blocksize = 8; min keysize = 16; max keysize = 56
 3) des3_ede: blocksize = 8; min keysize = 24; max keysize = 24
 4) twofish: blocksize = 16; min keysize = 16; max keysize = 32
 5) cast6: blocksize = 16; min keysize = 16; max keysize = 32
 6) cast5: blocksize = 8; min keysize = 5; max keysize = 16
Selection [aes]: 
Select key bytes: 
 1) 16
 2) 32
 3) 24
Selection [16]: 
Enable plaintext passthrough (y/n) [n]: 
Enable filename encryption (y/n) [n]: y
Filename Encryption Key (FNEK) Signature [b9fc92f854a4c85b]: 
Attempting to mount with the following options:
WARNING: Based on the contents of [/root/.ecryptfs/sig-cache.txt],
it looks like you have never mounted with this key 
before. This could mean that you have typed your 
passphrase wrong.

Would you like to proceed with the mount (yes/no)? : yes
Would you like to append sig [b9fc92f854a4c85b] to
in order to avoid this warning in the future (yes/no)? : yes
Successfully appended new sig to user sig cache file
Mounted eCryptfs

I want to write a script to automate the whole process. I want to pass the pass phrases, cipher, key bytes etc using a file.

I tried below mount command based on ecryptfs.7 documenetation

mount -t ecryptfs -o key=passphrase:passphrase_passwd_file=/home/testpc/key.txt,no_sig_cache,verbose,ecryptfs_cipher=aes,ecryptfs_key_bytes=32,ecryptfs_enable_filename=y,ecryptfs_passthrough=n,ecryptfs_enable_filename_crypto=y secure_folder1/ secure_folder1/

where key.txt is

root@testpc:/home/testpc# cat key.txt 

Once above command is executed ,it asks for FNEK.

Filename Encryption Key (FNEK) Signature [13e8b1bc6090e91d]:

Is there any way I can pass this through file to automate the whole process ? Once the PC comes up, it should not ask me for any passphrase.

Will ecryptfs-add-passphrase of any help here ?

Thanks in Advance, Murali Marimekala

  • What is the point of an encrypted directory if it is automatically decrypted on boot ? – Panther Oct 4 '16 at 16:53
  • Its a special requirement. If this laptop is lost and falls in wrong hands, if they plug hard-drive to another PC, they should not be able to decrypt the data. – Murali Oct 4 '16 at 17:26
  • Personally I would just encrypt your home directory and it will decrypt / encrypt with log in / log off. bodhizazen.net/Tutorials/Ecryptfs/#Migrate – Panther Oct 4 '16 at 18:24
  • Hi Bodhi, thank you. But as per my requirement, I need to encrypt a particular directory. Is there any way to make it encrypted when mounted and unencrypted when unmounted. This needs to be done without asking any passphrase. In a shell script, I tried reading passphrase into a variable used ecryptfs-add-passphrase to get the sig value and passed these values to key and ecryptfs_sig while mounting. Still i get promt asking for passphrase. – Murali Oct 4 '16 at 18:58
  • I do not see the point of decrytping without a password but as you wish. You will have to write a script such as expect or wait for someone to script it for you. Encryption is not really designed to decrypt without a password and as I said easiest is to encrypt home. – Panther Oct 4 '16 at 19:14

Once above command is executed ,it asks for FNEK.

Filename Encryption Key (FNEK) Signature [13e8b1bc6090e91d]:

Is there any way I can pass this through file to automate the whole process ?

You forgot to add ecryptfs_fnek_sig= to the options with the FNEK signature you want to use or have used before. I use ecryptfs though mount and it doesn't ask me for FNEK because I have the options set in my command.

  • Hi LiveWireBT, thanks a lot for the tip. I used sed to extract sig and assigned to this option. It mounted fine without asking any password. I tried unmounting and mouting back the same directory. Its asking for password (Filename Encryption Key (FNEK) Signature [63e4e3cfbfd842a6]: ) – Murali Oct 5 '16 at 2:29
  • My bad, i forgot to pass an argument to my script which was the actual pass phrase. Thats the reason its asking for it. Thanks a lot for your support Bodhi and LiveWireBT. – Murali Oct 5 '16 at 2:36

Implemented below script which solved my problem. Any better suggestions, please let me know.

#Argument 1 will be the mountphrase
echo $mountphrase 
echo "passphrase_passwd=${mountphrase}" > /home/testpc/key.txt

#Add tokens into user session keyring
printf "%s" "${mountphrase}" | ecryptfs-add-passphrase - > tmp.txt

#Now get the signature from the output of the above command
sig=`tail -1 tmp.txt | awk '{print $6}' | sed 's/\[//g' | sed 's/\]//g'`
echo $sig
rm -f tmp.txt #Remove temp file

#Now perform the mount
sudo mount -t ecryptfs -o key=passphrase:passphrase_passwd_file=/home/testpc/key.txt,no_sig_cache,ecryptfs_cipher=aes,ecryptfs_key_bytes=32,ecryptfs_enable_filename=y,ecryptfs_passthrough=n,ecryptfs_enable_filename_crypto=y,ecryptfs_fnek_sig=${sig},ecryptfs_sig=${sig},ecryptfs_unlink_sigs /home/testpc/Ecryptfs/secure5 /home/testpc/Ecryptfs/secure5
rm -rf /home/testpc/key.txt

Please do review and let me know your comments.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.