up vote 3 down vote favorite
1

I recently set up a new server with Ubuntu karmic 9.10, and when I created my home directory I chose to make it encrypted. Now, after loading my authorized_keys file into ~/.ssh, it isn't recognized because my home directory isn't decrypted until after I log in. Is there a way to make SSH keys work with encrypted home directories under Ubuntu?

flag
86% accept rate
Better tag suggestions welcomed, couldn't find really good matches in the suggested tags. – Josh Oct 26 '09 at 20:06
1  
i think those are spot on, actually. there's an ubuntu tag but i don't think this problem is specific to any particular OS. – quack quixote♦ Oct 26 '09 at 20:46

4 Answers

up vote 6 down vote accepted

Change this line in your sshd_config file:

AuthorizedKeysFile /etc/ssh/%u/authorized_keys

And then move your authorized_keys file to /etc/ssh/your-username/authorized_keys

This post documents another way to solve this.

link|flag
I thought the first solution sounded perfect but it didn't work for me. Not sure why. But the post you linked to worked great. Thanks! – Josh Oct 27 '09 at 13:20
Josh - is the target user the owner of those files, and permissions 600 (700 for the dir)? – NVRAM Nov 21 '09 at 17:47
up vote 0 down vote

I just spent some time messing around with this, and the answer is that it's pretty much fundamentally impossible. It is possible to set up passwordless public-key-authenticated logins via ssh, so you don't have to type in your password to log in, but that doesn't get you anywhere, because your home directory is still encrypted.

The simple fact is that your encrypted home directory is encrypted with a password*, so the only way to decrypt it is with that password.

And if you're thinking that in theory it should be possible to use your ssh key to decrypt the mount passphrase upon login, that won't work because your private key is never sent to the server at all.

So basically, if you want encryption, you have to use passwords. Encrypted home directories are incompatible with fingerprint logins for the same reason.

*I know it's more complicated than a single password, but let's keep it simple for now.

link|flag
Well, djhowell's answer worked perfectly so presumably my home directory is encrypted with a key the OS has and is able to use to decrypt it. Besides, when SSHing in, sshd doesn't know how to decrypt my home directrory, so that doesn't explain why it works with password authentication. – Josh Oct 27 '09 at 13:23
Wait, so when you log in via ssh without typing any passwords, your encrypted home directory actually gets mounted? – Ryan Thompson Oct 28 '09 at 8:00
Yes, it does. And umounted when I log out. – Josh Oct 28 '09 at 13:00
Well, that's odd. I get the behavior that I describe in my answer. My private dir only gets mounted if my login involved a password (specifically, my login password). I wonder what you did differently to get it to work with public keys. – Ryan Thompson Oct 28 '09 at 17:47
@Ryan Thompson are you using Ubuntu 9.10 ? – Josh Oct 28 '09 at 22:16
show 1 more comment
up vote 0 down vote

But you can use the more secure public key to login, and then execute 'ecryptfs-mount-private' to mount your directory after you type in your password. Read the '~/README.txt' file after you login via ssh and find that you don't have your files because the encrypted directory is not mounted.

You shouldn't be using passwordless public-keys to login anyway. Look at ssh-agent for a better way.

link|flag
up vote 0 down vote

So djhowell's link worked, but I can't log in twice. I'm going to have to rethink how I really want to handle the encryption stuff.

link|flag

Your Answer

get an OpenID
or
never shown

Not the answer you're looking for? Browse other questions tagged or ask your own question.