Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I use eCryptFS to encrypt the home directory of my laptop. My backup script copies the encrypted files to a server (together with everything else in (home/.ecryptfs).

How can I mount the encrypted files of the backup? I'd like to verify that I can do that, and that everything is in place.

My naive try with

mount -t ecryptfs /backup/home/.ecryptfs/boldewyn /mnt/test

didn't work, eCryptFS wanted to create a new partition.

share|improve this question

1 Answer 1

up vote 12 down vote accepted

Assuming you use the Ubuntu standard encryption scheme, with no extra tweaks.

The $HOME/.ecryptfs "folder" is actually just a link.

The true place where your files stay is /home/.ecryptfs/$USER

There are two folders there, .Private (with your files encrypted) and .ecryptfs, with files like auto-mount, auto-umount, Private.mnt, Private.sig, wrapped-passphrase.

Hopefully the target files are copied to your host backup.

If there is no backup of your wraped-passphrased in this server, you're lost. If there is a backup, then your encryption scheme has been weakened by storing your wrapped passphrase over the web, unless you control the host where you make the backup.

I found this script for mounting:

ROOT=/home/.ecryptfs/$USER
TARGET=/mnt/$USER

# ROOT should be the parent of the .ecryptfs and .Private folders

sudo mkdir -p $TARGET
cd $ROOT

echo Type your password:
PASS=$(ecryptfs-unwrap-passphrase .ecryptfs/wrapped-passphrase | sed s/Passphrase:\ //)
SIG1=$(head -n1 .ecryptfs/Private.sig)
SIG2=$(tail -n1 .ecryptfs/Private.sig)

echo Passphrase:
echo $PASS
echo Signatures:
echo $SIG1
echo $SIG2

echo Should be empty:
sudo keyctl clear @u
sudo keyctl list @u

echo Do not type anything:
echo $PASS | sudo ecryptfs-add-passphrase --fnek

echo Sould have signatures:
sudo keyctl list @u

echo Mounting $ROOT on $TARGET...
sudo mount -t ecryptfs -o key=passphrase,ecryptfs_cipher=aes,ecryptfs_key_bytes=16,ecryptfs_passthrough=no,ecryptfs_enable_filename_crypto=yes,ecryptfs_sig=$SIG1,ecryptfs_fnek_sig=$SIG2,passwd=$(echo $PASS) .Private $TARGET

ls $TARGET
share|improve this answer
    
Ah, the passphrase unwrapping was the trick! Thank you! –  Boldewyn Jan 15 '11 at 8:49
1  
Good that it works. Anyway, keeping your wrapped passphrase on the server will weaken, and sometimes destroy, your encryption security. –  user39559 Jan 15 '11 at 14:56
    
Thanks, it worked for me too. –  marlar Dec 21 '12 at 23:47
    
Thank you for posting this! –  Philihp Busby Aug 13 at 7:28
1  
Link to original script (full thread). –  kenorb Oct 8 at 18:18

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.