ecryptfs mounted via command line, what do I need to backup?

Question

I asked this question on the ecryptfs launchpad, but it expired there without answer. https://answers.launchpad.net/ubuntu/+source/ecryptfs-utils/+question/235226

It might be trivial, but I really don't want to get it wrong for obvious reasons. On the other hand, the answers that I find are all related to the Ubuntu home directory encryption where a wrapped passphrase is used and they're confusing me.

Question: I am mounting a directory as ecryptfs

sudo mount -t ecryptfs -o  ecryptfs_cipher=aes,ecryptfs_key_bytes=16,ecryptfs_passthrough=no,ecryptfs_enable_filename_crypto=yes /srv_backend /srv_use

Now I want to backup the encrypted folder /srv_backend. What do I need to backup apart from the obvious data there and my password.

The command line reply mentions a "Filename Encryption Key (FNEK) Signature [3c2034c2f35aab36]". What is this used for? Do I need to back it up / remember it?

Answer 1

What do I need to backup apart from the obvious data there and my password.

I don't know exactly how ecryptfs works, but I'd say that should be it, yes.

There is an easy way to find out though: just copy your backup to another computer and try to mount it. If everything works as expected, then you're fine. If you're missing something, you'll notice it then.

Make sure though that you have documented that exact mount command somewhere in a file that's backed up too, so that you or whoever needs to restore that backup someday doesn't need to guess all those options to get it running again.

Answer 2

I think this signature is stored to your /root/.ecryptfs/sig-cache.txt (or ~/.ecryptfs/sig-cache.txt ) and is used to verify that the filesystem has been opened with those params before ( e.g. so that you do not put a wrong password and corrupt files etc) you might want to back up the mentioned file, although if you are sure about the password, it will be automatically created the first time you access again the folder....

Answer 3

I'm using KeePass and I store the parameters used to create/mount the volume along with the password.

You already composed a command line with all the options (note FNEK would just be another parameter in the options), so it would be reasonable to note the command and the overview of the parameters mount gives you in your password manager, because this way it's just more convenient and should it ever happen, you know it's not you but the system that made a mistake.

I use ecryptfs with mount like you do and move some of my volumes around and mount them on different hosts. I don't have to "backup" certain files to get the volumes mounted, but noting down the configuration of the encrypted volumes in the password manager seems like good practice because at some point in time the crypto (configuration) may become weak and this is a way to easily keep track of this. Also with a history function like in KeePass 2 has and the ability to attach more than one file to an entry I just need KeePass.