Dave Crooke's questions

ubuntu 18.04 64-bit

I have a setup which has three separate block crypt devices, plus a non-encrypted /boot. If I had started with a clean sheet of paper, I could have done it with two, but it would be a science project to reformat everything now.

On boot, the scripts in initramfs ask for the passphrase for each separately, I would like to add my own script in which I prompt for it once, and decrypt all the drives / partitions in one shot, pre-empting the system script, and allowing me to use a more complex one that CBP can't brute force :)

I am struggling to figure out where to put it.

I have had a look at a bunch of stuff, and it talks a lot about how to run update-initramfs and the scripts executed then when generating the initrd file, but not how to add content to initramfs itself. I could manually unpack and repack the initrd file, but that is not compatible with the system tools like update-initramfs, and best case I'd have to redo it every kernel upgrade or other post-install trigger.

I was kinda hoping for a folder like init/rc3.d where I could just drop it and use a sequence number to get it executed early.

I set up a machine with 14.04.2 and used the encrypted homedir option, which works fine from the installer. I went to move some stuff around, and ended up re-installling. I have been trying to create the same setup as the installer does, where the encrypted home dir is automounted at login.

I could not find any documentation as to how that process works, i.e. how does the login system know to mount it? Inferring from the command line tools, it look like making the user a member of the "ecryptfs" group should do it.

I am able to successfully create an encrypted homedir with the command below - note that it complains without the group option.

sudo adduser --ingroup ecryptfs --encrypt-home fred

However, even with the user as a member of the group, the automount does not occur. Also, there is no way to provide the wrapper passwords for the encyrption key passphrase.

Is there a way to see what the installer is doing different?