16.04 Encryption disappears, impossible to log-in from desktop environment

Question

Ingredients

• Ubuntu 16.04
• Linux 4.4.0-47-generic

Antecedents

• upgraded Ubuntu from 14.04 from 16.04 months ago (and still regretting it)

• modified user and root passwords some time ago

• the filesystem is encrypted (I claim I recall the password)

• computer not used for a few weeks (immaterial, perhaps, but the only thing worth mentioning)

Problem

After a time off, I turned on the computer.

The Ubuntu greeter asks me for the encryption password in a bizarre way: the string Please enter passphrase for disk <disk ID> (cryptswap1) on none!: disappears immediately.

I regain the view of this string when I start typing the passphrase/password (the terminology is actually ambiguous). I claim I do recall this encryption password.

When I then splash in the user-selection screen and try to log in, this screenful falls into a loop. So I never log in. Note that this is not a question of incorrect passwords.

Research

The way I would normally work around this in another computer in similar circumstances, is to go to tty1, log in and launch sudo ecryptfs-mount-private and give my encryption passphrase there. Now, rather, I get the message

ERROR: Encrypted private directory is not set up properly

If I ask ecryptfs-verify -p (source Cannot mount encrypted home after password change, ecryptfs not configured (no passphrase set)), the diagnosis is

ERROR: [/home/user/.ecryptfs] does not exist ERROR: Configuration invalid

If I ask sudo ecrypts-recover-private (source ecryptfs-mount-private ERROR), the result is find: @/run/user/104/gvfsA: Permission denied

Again, the only thing happening between the system when it worked and the system as it does not work is that I did not use the computer in the meantime.

However, I will add that, after the persistence of the problem had been established and while I was in tty1, I launched a sudo apt-get update && sudo apt-get upgrade in the hope that rejuvenating the system would do no harm. Interestingly, during the installation process, I had to type in the encryption passphrase/password several times, without complaints being thrown at that (a proof that I recall that password?)

Addition 6 Dec If I go to tty1 I can actually see the directory tree unencrypted, to my surprise. Hence, I deduce that the encryption has disappeared unawares of me and the graphical user interface cannot cope with this.

Questions

A reasonable explanation of what this diagnostics means (in terms of reliability of the system), and some instructions to regain access to my filesystem with the desktop environment once again, svp.

Answer 1

This answer addresses how to restore encryption. The problem of the loop in the log-in screen remains, so please feel free to edit this answer or post your own answer (I'll be glad to accept it).

Restoring encryption with ecryptfs-migrate-home

Mandatory reading

man ecryptfs-migrate-home explains concisely how this works and the critical caveats. Note this solution works if you have enough space in your drive to make a whole copy of the unencrypted data (and a bit more). Check out with df -h, for example.

Useful reading

This tutorial http://bodhizazen.com/Tutorials/Ecryptfs/ gives a good overview to familiarise with ecryptfs, although it refers to old releases of Ubuntu.

Pseudo-code

This must be done from the terminal (tty accessible from CTRL + ALT + F1, for example) with all users logged out from any session.

The strategy is to make a temporary profile next to the one whose data are unencrypted. Then, use this temp user to launch ecryptfs-migrate-home on the unencrypted home. Here user is the profile with unencrypted home

login  # as user 
sudo adduser <tmpuser>
sudo adduser <tmpuser> sudo  # sudo rights are essential
exit  # log out user

login  # as tmp-user
sudo ecryptfs-migrate-home -u user  # sudo needed, mind the option
# ...
# script asks for `login passphrase` of user = linux login password
# makes check (with lsof, see below)
# verbose listings, can take time 
# prints diagnostics, to read carefully
exit  # log out tmp-user, DO NOT REBOOT

login  # as user again
ecryptfs-unwrap-passphrase  
# type in the log-in passphrase and save the mount passphrase
ls -a /home  # check that the directory .encryptfs has been created
ls /home/user  # check that the files are visibile
# play around until change of mood and mind, you may reboot

During the doing

The script ecryptfs-migrate-home launches a lsof -u user (list open files) to make sure that user has no open files. The outcome can be a warning about one file open in the way of What means this error message: lsof: WARNING: can't stat() fuse.gvfs-fuse-daemon file system /home/nes/.gvfs -- I presumed that this can be ignored, since it deals with an unavoidable circumstance. Corrections welcome.

At the end of its task ecryptfs-migrate-home notified me of a rsync error: some files/attrs were not transferred (see previous errors) (code 23) at main.c(1183) [sender=3.1.1] -- rsync is launched by the script itself, but I could not trace back which files had not been transferred and which previous errors it refers to.

After the doing

If you look at /home there will be a new directory user.<some code> next to user. The former contains the old state of things: it is a clear-text copy kept as a fall-back position, just in case. This can be deleted/shred after having tested the functioning of the new encrypted home thoroughly and before it gets risky to hold unencrypted data in your drive.

In the end I managed to get my /home/user encrypted back in place.

Logging in with the desktop environment

Still to be solved. Contributions welcome