Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Heres the closest I've gotten: I installed gitolite in the /Private folder using ecryptfs-utils (sudo apt-get install ecryptfs-utils adduser git ecryptfs-setup-private then the rest was configuring gitolite using a root install).

It worked just fine as long as someone was logged in as the user git using a password (su git using root does not work). Since the private folder activates through logging in with a password and gitolite uses RSA keys (required) the private folder is hidden thus error occurs.

Is there a way I can log into my server after a reboot, type in the password and have the git user private folder available until next time the machine restarts?

Or maybe theres an easy way to encrypt a folder for git repositories?

share|improve this question
I'm not sure what you mean. Pushing and pulling over SSH is already encrypted. Do you need encryption beyond that? – jonescb Mar 31 '11 at 17:29
Does su - git work? Also, what is the point of encrypting the FS if you want to have it always available if the machine is on? Is it strictly to protect against offline attacks? – Hank Gay Mar 31 '11 at 17:33
@jonescb filesystem encryption – acidzombie24 Mar 31 '11 at 17:41
@Hank Gay: Yes. offline attacks is all i want to secure with this. It should always be available so reasonably offline+securing the user who access the encrypt files+using good software that access said files is really all i could do. -edit- and su - git didnt solve it unfortunately. – acidzombie24 Mar 31 '11 at 17:46
maybe you wanna close the other thread: unix.stackexchange.com/questions/10355/… – D4RIO Mar 31 '11 at 20:32
up vote 6 down vote accepted

You simply need to remove the file ~/.ecryptfs/auto-umount.

This file is a flag that pam_ecryptfs checks on logout. This file exists by default at setup, along with ~/.ecryptfs/auto-mount, such that your private directory is automatically mounted and unmounted at login/logout. But each can be removed independently to change that behavior. Enjoy!

share|improve this answer

Sorry, can't post as a comment...

Maybe you could mount your ssh through sshfs and use encfs inside?

share|improve this answer
git is pretty automatic. I dont think i can tell git to execute commands over ssh before/after doing its git stuff – acidzombie24 Mar 31 '11 at 17:42
I meant mount your remote dir as a local dir with sshfs, then mount an encrypted folder inside that with encfs and then use your git folder inside that. Git doesn't need to know what's going on. – solarc Mar 31 '11 at 17:57

You could use a smudge/clean git filter approach; this will encrypt the contents of the repository, and decrypt it for working with in the working tree.

See https://gist.github.com/873637.

It will not encrypt the names of the files, however.

share|improve this answer

Use screen. just create a screen, su into the user and do what you need to do. Detach from it by using Ctrl+A,d. Then you should be able to disconnect without killing the process thus someone is logged in at all time.

share|improve this answer

If you can disable the pam_ecryptfs session module, than ecryptfs mount points won't be unmounted on log-out, but this also affects everyone. Another idea is to use a different passphrase from your login to wrap your mount phasephrase. In this case, it will fail to mount it automatically on log-in, and therefore it shouldn't (won't?) unmount on log-out. You can then manually mount ecryptfs and it should stay mounted until next reboot:

ecryptfs-rewrap-passphrase .ecryptfs/wrapped-passphrase
share|improve this answer

Maybe packing your repo in an GPG encrypted tar. It's possible to delete the private key from your home each time, so your repo will be almost undecryptable. Each time you log-in, you write the private key to your home, decrypt the repo, and use it.

share|improve this answer

If you're looking for strictly offline protection, then something like an auto-mounted encrypted partition should do the trick. I see you're using apt-get, so there's a fair chance you're on Ubuntu. In that case, it might interest you to know that Ubuntu has encryption as an option during installation. If you're using Debian, here's an article I found that covers How to set up an encrypted filesystem in several easy steps.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.