Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I'm having a problem with an installation of Kubuntu 12.10 with an encrypted home directory. I've been trying to figure it out for several weeks. For transparency, I'll note here that I posted this question on askubuntu.com for a while, but have taken it down from there and posted here, instead, because of a lack of response.

I noticed a few weeks ago that when I logged out of my system, my encrypted home directory would not always be re-encrypted -- I was still able to view and access the files within the home directory when I SSHed into the computer from another computer (to be clear, my SSHD requires a shared key -- this might be relevant later). I did some reading, and found out that ecryptfs relies on a counter file in /dev/shm/ecryptfs-$USER-Private to know when to re-encrypt the home directory: When a user is logged in, the counter is '1', and when the user logs out, the counter hits '0' and triggers encryption.

Running cat /dev/shm/ecryptfs-my_user_name-Private periodically, I found something odd: the counter file stays at 1 for a while after I log in on the physical machine, and then starts growing. At one point, after leaving the system on for several days, it was (as I remember) at 93!

I found a report about the same type of issue at http://www.mail-archive.com/ecryptfs@lists.launchpad.net/msg01705.html. That page stated that different things can cause counter increases, including ssh logins and cron.

Even having read that page, I'm having a lot of trouble figuring out what's causing the issue. Here are some things that I've observed:

1) Although the counter resets to 1 when I restart my computer and then log back in, the counter still begins to increase after several hours once I'm logged in.

2) This happens even when I have no active SSH connections to my computer.

3) This happens even when my computer is on different networks. Thus, I don't think that it has to do with an unauthorized user gaining access to my system.

4) This does not seem to do with using sudo in the terminal (or the equivalent in a GUI).

5) I set up a cron job to record the output of cat /dev/shm/ecryptfs-my_user_name-Private every 5 minutes, and couldn't find any correlation between anything that I was doing at the time and the point at which the counter started increasing (to start, from 1 to 3).

6) I've also disabled all of my custom crontab entries other than the script mentioned above that records the counter every five minutes. Increases in the counter do not seem to be correlated with this script running through cron. Anacrontab also doesn't have any custom entries.

Results of Logging

I started logging the counter's value every five minutes for several days. On a typical day, here are the results: After a restart of the computer, I logged in through SSH. The counter was at 1 for the duration of my session, which lasted a few hours. I then disabled networking and logged in to the physical machine (using the KDE DE). The counter was at 1 for 50 minutes, and then jumped to 3. I had enabled wifi around that time. An hour later, the number jumped to 420. Five minutes after that, it was at 537, where it stayed until I shut down the machine, at least a half-hour later.

w showed three lines: One on tty7, one on pts/1 (kdeinit4: kded4 [kdeinit]), and one on pts/3 (the terminal that I was using w in). Thus, I think that it was not that 537 users were logged into my computer. What could be going on here?

Later, I started logging the counter at /dev/shm/ecryptfs-$USER-Private every minute, and then looked at the system log in /var/sys/syslog during minutes during which the counter increased. The only thing that I could see that was consistent across minutes during which the counter increased was a steady stream of "[UFW BLOCK]" lines (to be clear, I use ufw as a system firewall, and only have one port open, for SSH). Nothing else seems to be consistent from incident to incident, except for my cron job that logs the counter (this cron job is not always associated with an increase in the counter, though, and was not present when the problem started).

What should I try next to figure this out? I'll be very grateful for any advice or ideas.

share|improve this question
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.