Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I used ecryptfs-migrate-home to encrypt my home folder on my Debian (Testing) system.

As I am a complete encryption-greenhorn, I don't know yet how to check, if the encryption succeeded. However, I suppose encryption works but filenames are not encrypted. I want to have encrypted filenames as well.

How can I get encrypted filenames for my (already encrypted) /home-folder?

share|improve this question
1  
AFAIK file name encryption is turned on by default, unless you have an ancient kernel. (2.6.32 as in Debian stable is recent enough.) What commands did you run exactly? What does cat /sys/fs/ecryptfs/version show? –  Gilles Jan 3 '13 at 0:27
    
cat /sys/fs/ecryptfs/version says 375 - I am on Debian Testing, therefore it should be alright, then. Can you tell me how to view the encrypted files? ls /home/username doesn't list me my files (neither encrypted nor unencrypted) –  Marcel Jan 3 '13 at 0:32
1  
Your kernel is fine (the version must have the 100 bit set). The encrypted files are in ~/.Private, and when active the plaintext content is accessible through ~/Private. Are you sure that you have non-encrypted filenames in ~/.Private? In ~/Private, of course, you see the real file names — or nothing when the volume isn't active. –  Gilles Jan 3 '13 at 0:43
    
You are right! Filenames are encrypted! For completeness: here's an instruction to check the encryption (in German) thomas-krenn.com/de/wiki/… –  Marcel Jan 3 '13 at 0:46

1 Answer 1

up vote 1 down vote accepted

The encrypted home utilities don't support the ability to enable encrypted filenames after you've set up your encrypted home directory. But, I looked at the ecryptfs-migrate-home script and believe that it should be enabling filename encryption by default.

Let's verify that filename encryption is enabled. Do you have two lines in your key signature file?

$ wc -l ~/.ecryptfs/Private.sig 
2 /home/user/.ecryptfs/Private.sig

If wc reports that there are two lines, things are looking good so far. Check to see if the eCryptfs mount includes the filename encryption key signature mount option:

$ grep ecryptfs_fnek_sig= /proc/mounts
/home/user/.Private /home/user ecryptfs rw,nosuid,nodev,relatime,ecryptfs_fnek_sig=0011223344556677,ecryptfs_sig=8899aabbccddeeff,ecryptfs_cipher=aes,ecryptfs_key_bytes=16,ecryptfs_unlink_sigs 0 0

If you see the ecryptfs_fnek_sig option, things are looking even better. Now make sure that filenames are encrypted in the lower filesystem:

$ ls /home/.ecryptfs/user/.Private

Do all filenames have a "ECRYPTFS_FNEK_ENCRYPTED." prefix? If so, the filename encryption feature is configured and working correctly.

share|improve this answer
    
you are right! nothing more to say :) –  Marcel Jan 3 '13 at 0:51

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.