Home / ubuntu / Questions / 135719
Accepted
0xC0000022L
Asked: 2012-05-12 14:50:54 +0800 CST

Prevent users from encrypting their home folders

  • 772

How can I prevent users from encrypting their home folder on a server inside our company without removing the respective packages?

Are there any policies I can enable to prevent this?

Edit: the reason is that employees leaving should not leave data behind in encrypted form on this machine. They have the opportunity to use encryption on their personal workstation to some extent. Those users do not have super user powers.

encryption server ecryptfs 12.04

1 Answers

  1. Best Answer

    If you don't want to remove the ecryptfs-utils package, then the easiest way to do this would be to remove the setuid bit on /sbin/mount.ecryptfs_private.

    You should use a dpkg state override to make this setting persistent, like so:

    dpkg-statoverride --add root root 0700 /sbin/mount.ecryptfs_private

    This will ensure that ecryptfs-setup-private and ecryptfs-mount-private fail with an EPERM error for non-root users.

    If this becomes a popular request, we could easily add this as a debconf question/option in the package.

    • 8