Home / server / Questions / 160277
Accepted
BarsMonster
Asked: 2010-07-15 03:01:37 +0800 CST

Ubuntu: How to decrypt home directory, swap (basically everything) without reinstalling?

  • 772

I just faced a problem with encrypted home directory in Ubuntu Server 10.04.

While I know a workaround, I want to just to completely remove encryption from everything.

Any hints how to do that without complete backup & reinstall?

ubuntu encryption home-directory ecryptfs

3 Answers

  1. Best Answer

    This guide is pretty major surgery, only follow it if you are confident at the command line - a few mistakes could lead to losing all your data.

    You will have to copy all the files from your home directory somewhere else, and then copy them back once you have turned off the encryption, but you don't have to reinstall. So let's say you have an external drive at /media/disk-1. You can back up with

    $ cp -a /home/user /media/disk-1/

    The -a does recursive and a bit more. Make sure you back up all users, as we will delete the encrypted copies later.

    Then you need to unmount the ecryptfs mount, delete all the encrypted files, stop the automounting and copy all your files back. This is going to cause havoc if you are logged in with a GUI, so I would either log out, and log in on one of the consoles (press Ctrl-Alt-F1 to access one) or I would boot off a live CD/USB stick to do this. Either way be very sure your back ups are safe.

    If you are using a live CD you will need to mount your disk, and the paths in the following commands will change accordingly.

    So, unmount the ecryptfs mount. (If you are working off a live CD you don't need to do this step).

    $ ecryptfs-umount-private

    Next make room on the disk by deleting all the old encrypted files. Be sure your back ups are safe before you do this. And if you have over half your disk spare, you can leave this step until once you are sure the new version is working. But if you have only a bit of your disk spare then you will need to do this before copying the files back. 

    $ sudo rm -rf /home/.ecryptfs

    Next we need to stop the auto-mounting. So edit the files

    /etc/pam.d/common-auth 
/etc/pam.d/common-password 
/etc/pam.d/common-session 
/etc/pam.d/common-session-noninteractive

    and comment out the line that mentions pam_ecryptfs by putting a # at the start of the line. So for example, common-session would now contain

    #session    optional    pam_ecryptfs.so unwrap

    Now you can copy all your files back

    $ cp -a /media/disk-1/user /home

    Then do a reboot and you should be without the encrypted folders, and able to enable auto-login. If you didn't delete /home/.ecryptfs earlier, you should do so once you're confident everything is working as expected.

    • 5

  2. the problem your facing is that the filesystem is encrypted. When you decrypt the area of disk, you're not doing one file at a time. - So its not going to be possible to just "turn off" encryption without backing up files and restoring.

    • 0

  3. While reading about I came up with another strategy that might work for you, depending on what your issue is. If the issue is that you (as root) need to access users files while they are not logged in, then you could stop the encrypted files being unmounted on logout.

    ecryptfs uses files in /home/.ecryptfs/user/.ecryptfs/ to control the operations. You will see if contains files auto-mount and auto-umount. They are both of zero size. I'm pretty sure that if you 

    $ sudo rm /home/.ecryptfs/*/.ecryptfs/auto-umount

    Then the users' directories will not be unmounted on logout and will remain accessible. However the on disk format will still be encrypted, so you don't have to worry about old disks falling into the wrong hands (provided you securely delete /home/.ecryptfs/*/.ecryptfs/*) (and /tmp and /var/ and swap ...)

    • 0