Questions[ecryptfs](server)

I'm trying to make a script, that creates and mounts encrypted directory using ecryptfs(on ssh logons(with passphrase sent via pipe) and by some other scripts). I know about ecryptfs-setup-private already.

What I'm trying to do:

#!/bin/bash

mkdir 1 &> /dev/null
mkdir 2 &> /dev/null

echo "passphrase_passwd=zxc" > ecryptfs_passphrase_passwd

OPTS="ecryptfs_cipher=aes,ecryptfs_key_bytes=32,ecryptfs_enable_filename_crypto=y,ecryptfs_fnek_sig=7513645981364589,ecryptfs_passthrough=n"

cat ecryptfs_passphrase_passwd | \
mount -t ecryptfs -o ${OPTS},key=passphrase:passphrase_passwd_fd=0 1 2

And it fails for some reason with following output:

# ./mountit              
Error attempting to evaluate mount options: [-22] Invalid argument
Check your system logs for details on why this happened.
Try updating your ecryptfs-utils package, and/or
submit a bug report on https://launchpad.net/ecryptfs

# tail /var/log/syslog
...
Apr 27 19:28:23 debian mount.ecryptfs: Error initializing key module [/usr/lib/ecryptfs/libecryptfs_key_mod_gpg.so];
Apr 27 19:28:23 debian mount.ecryptfs: parse_options_file: mmap failed on fd [0]; rc = [-22]
Apr 27 19:28:23 debian mount.ecryptfs: tf_pass_file: Error parsing file for passwd; rc = [-22]

What am I doing wrong?

I am running Ubuntu 11.04 with the "encrypt home directory" feature. This uses eCryptFS to encrypt and mount my home directory. Now I need to enable ACL for this mount but since it's not configured in /etc/fstab I don't know how to do that.

Enabling ACL for my / mount doesn't do anything for me. These are two of mount mounts:

$ mount
/dev/sda1 on / type ext4 (rw,acl,errors=remount-ro,commit=0)
/home/tobias/.Private on /home/tobias type ecryptfs (ecryptfs_cipher=aes,ecryptfs_key_bytes=16,ecryptfs_unlink_sigs,ecryptfs_sig=2be72e2e03c0d2a1,ecryptfs_fnek_sig=f8f38af9c5e2c0e2)

Any ideas on how to enable ACL for /home/tobias?

Raionale: I want to be able to automatically make backups to a remote machine, which will be encrypted with ecryptfs.

The title says it all:

I set up ecryptfs-utils on my Debian Squeeze box, and set up one user to use it via ecryptfs-setup-private. When I log in via SSH using password authentication, the ~/Private directory automatically gets mounted.

How can I achieve that ~/Private also automatically gets mounted when logging in via SSH using public key authentication? Obviously, the best solution would be if ecryptfs could somehow 'use' the SSH public key to en/decrypt the data (I know that then using the user's password would not be able to en/decrypt the data any more; this would be acceptable). Probably, this will not work. So perhaps somehow call ecryptfs-mount-private via ssh before logging in via public key? Probably, then I would need to somehow pipe the passphrase through the SSH connection, right? So I would need to store it on the source machine's file system. Not nice either. Any other ideas?

I have setup home directory encryption on Ubuntu 10.04 machine, but ecryptfs does not seem to be able to work with Dovecot (or CourierIMAP, etc).

After successful IMAP login, home directory is never mounted, and Dovecot obviously can not find mail directory.

I am not sure I understand how the mount is triggered, so I need some help.

Dovecot is using PAM, so I hoped that after successful login home directory would be mounted, but this is all I get in logs and directory is not mounted:

Jan 16 02:12:37 ubuntu dovecot-auth: pam_sm_authenticate: Called
Jan 16 02:12:37 ubuntu dovecot-auth: pam_sm_authenticate: username = [username]
Jan 16 02:12:37 ubuntu dovecot-auth: Passphrase file wrapped
Jan 16 02:12:38 ubuntu dovecot-auth: Error attempting to add filename encryption key to user session keyring; rc = [1]
Jan 16 02:12:38 ubuntu dovecot: imap-login: Login: user=<username>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured

If I create an SSH session and then perform IMAP login, it works (obviously) but I get this:

Jan 16 02:30:25 ubuntu dovecot-auth: pam_sm_authenticate: Called
Jan 16 02:30:25 ubuntu dovecot-auth: pam_sm_authenticate: username = [username]
Jan 16 02:30:25 ubuntu dovecot-auth: pam_sm_authenticate: /home/username is already mounted

So, it does seem like Dovecot (well, PAM module, I guess) is trying to mount the home directory, but it either mounts and dismounts it immediately or something else happen - and I am unable to figure out that part.

I have also tried using SSHD's PAM file for Dovecot, but nothing really changed, except the fact I was not getting the error message ("Error attempting to add filename encryption key to user session keyring...").

On Ubuntu community Dovecot page (https://help.ubuntu.com/community/Dovecot) there is a paragraph that says:

NOTE: Dovecot will NOT work in an encrypted directory/folder. Dovecot would just complain about permissions and wont work. One answer is to create a 2nd user account that has an unencrypted home directory. We have not tested this solution on a separate home partition, but most probably the outcome would be the same.

However, I am not sure if this is definitive answer (and I don't understand what they mean with having 2nd user account).

I would appreciate if someone could tell me if it is possible to use Dovecot (with mail directory inside user's home directory) with ecryptfs.

I have seen this question (and borrowed some wording from it :) on Launchpad's ecryptfs questions page (but no answer to it), so seems like I am not the only one with the problem.

Thanks.

We have a small network with a Ubuntu server in the middle and Ubuntu notebooks around. The notebooks all use eCryptfs to encrypt the whole home directory of users. Usually, there are two or more users per notebook. The backup procedure stays inside the network, so we are fine with transfering the files unencrypted to the server. We'd like to go with an rsync based solution, but are fine with others, too.

We ran into difficulties when trying to backup the home directories of the notebooks, that brought us major headaches. It boils down to this:

1. If user A is logged in, the home directory is decrypted, and the encrypted files in /home/.ecryptfs/A are locked against reading from other processes (which is a good thing)

2. If user B is not logged in, his home directory is not decrypted, there are only the encrypted files in /home/.ecryptfs/B.

3. We need to have a backup script, that can run, while user A is logged in (because she starts it manually in our case) and user B may or may not be logged in (usually not).

Now the question is: What should we backup? If we go for the encrypted data, the stuff of user A cannot be backed up. Decrypted data means on the other hand, that user B must be logged in, too. And mixing both leads to a fun time, when it comes to restoring something.

Are there perhaps other solutions to this problem, that we missed?