I am trying to write a single command which will be issued by a program at runtime, to mount a directory with ecryptfs. This needs to be a non-interactive process with nothing known in advance so that the program can create an encrypted folder using other machine secrets. I do not have a keyring or other such things installed on these machines.
I got this far:
sudo mount -t ecryptfs -o "rw,key=passphrase:passphrase_passwd=george,ecryptfs_cipher=aes,ecryptfs_key_bytes=32,ecryptfs_passthrough=n,ecryptfs_enable_filename_crypto=n,verbose=0,no_sig_cache" ~/secure_1/ ~/secure_2/
And this is great but what I would like to do is enable filename encryption. However when I do this I prompts me for a signature. I tried providing one but it seems I need to know this in advance so that it matches the passphrase, but that is no good for me because the passphrase is going to be generated using machine secrets as I mentioned.
sudo mount -t ecryptfs -o "rw,key=passphrase:passphrase_passwd=george,ecryptfs_cipher=aes,ecryptfs_key_bytes=32,ecryptfs_passthrough=n,ecryptfs_enable_filename_crypto=y,verbose=0,no_sig_cache" ~/secure_1/ ~/secure_2/
results in this interactive prompt:
Filename Encryption Key (FNEK) Signature [e983cfd4b25df524]:
I think all I need is to stop this command for prompting me for a FNEK Signature. I don't understand why this one must be prompted for when it is the same as the ecryptfs_sig field, and I've tried lots of things to get around it, but to no avail, so here I am.
Appreciate any tips or insight.
