1

I am trying to secure a Linux system to prevent offline access to the home directory (i.e. someone takes the HDD and mounts it on their system), which I've done with ecryptfs.

I use nodm which boots my system into a xsession running an application from that home directory. However, now that I've added ecryptfs my xsession doesn't launch... I have to go to a TTY and login first.

The question is, why can't I use ecrpytfs on my home directory, and have something like nodm (or another autologin) decrypt the home directory and run the application on bootup?

3

Not possible.

Someone, or something has to supply the password for decryption. Obviously it can't be on your home directory (as that is encrypted). It should not be on your hard disk at all, as that would be pointless: An attacker could extract it from there.

So I don't see a way to make this automated (i.e, not requiring you) while preserving that only you can access it.

  • In the case of an auto-login like nodm, is it not using the password to get access? – jdwiegman May 21 '14 at 14:58
  • 2
    The point is: If nodm was able to decrypt and log you in just after powering on the system, then any thief who got your hardware can do so. It might be possible to configure nodm todo so, but you would lose all security gained by encrypting your harddisk. – Fabian May 21 '14 at 15:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.