Non-interactive ecryptfs directory encrypt/decrypt

Question

Can I decrypt an ecryptfs Private directory from a script?

My basic use case for this type of activity is for doing remote backups. Imagine you have a machine (call it privatebox) with an encrypted private directory that stores your photos (or some other sensitive information). It is only decrypted upon logging in. And imagine that you want to be able to write a script on a remote machine that will log into the privatebox, decrypt the directory to add a photo, then re-encrypt it and log out. All without user interactive steps being required (maybe it runs from cron). Note that the passphrase for the privatebox would NOT be stored on the privatebox in plain text or anything. And since it would be encrypted (except during the update) it would be protected if someone obtained the SD card, etc.

Such a script would work like this (in my mind):

• setup private directory on privatebox that is encrypted with a passphrase
• setup ssh keys from local machine to privatebox so you can use ssh non-interactively (cron can login)
• Then what? How do you decrypt a private folder non-interactively if you know the passphrase?

It seems that ecryptfs is specifically designed to not allow this (even with SSH key trickery, you still have to manually mount your private directory).

Basically, what I'm looking for is a non-interactive version of 'ecryptfs-mount-private' or something similar if anyone knows a solution. Something like:

% ecryptfs-mount-private -p $PASSPHRASE

Where I could pass the passphrase instead of having to type it.

If ecryptfs can't do this, does anyone know of an alternative? Thanks!

Answer 1

Okay I figured this out. Thanks for your help Xen2050, I don't have enough reputation here to give you an upvote (yet).

Here's the bash script that works for me:

#Set this variable to your mount passphrase. Ideally you'd get this from $1 input so that the actual value isn't stored in bash script. That would defeat the purpose.
mountphrase='YOURMOUNTPASSPHRASE' 

#Add tokens into user session keyring
printf "%s" "${mountphrase}" | ecryptfs-add-passphrase > tmp.txt

#Now get the signature from the output of the above command
sig=`tail -1 tmp.txt | awk '{print $6}' | sed 's/\[//g' | sed 's/\]//g'`
rm -f tmp.txt #Remove temp file

#Now perform the mount
sudo mount -t ecryptfs -o key=passphrase:passphrase_passwd=${mountphrase},no_sig_cache=yes,verbose=no,ecryptfs_sig=${sig},ecryptfs_cipher=aes,ecryptfs_key_bytes=16,ecryptfs_passthrough=no,ecryptfs_enable_filename_crypto=no /home/user/.Private /home/user/Private

Note that I had to disable filename encryption for this to work. When I tried using filename encryption I got a library error during the mount. In order to not have filename encryption, you must use the following when creating your Private/ directory:

ecryptfs-setup-private -n

This is now working for me.

In response to some people who would say 'why do it this way?', well, I don't always want to mount my private data on each login. I want to have a quick way of mounting the data that does not require me to use my actual user login password. Imagine I want to share the data with someone else? I would have to give them my password. Using the mount passphrase allows me to have essentially a mount password that can be less secure than my login. This is also useful if you want to automount your data and store the phrase somewhere (perhaps on a USB stick as a key to unlock your data). I would never want to store my login password anywhere in plain text. But if you know the content of your data, and you know the data itself is less private than your own account, this is an fine solution.

Answer 2

You could first use ecryptfs-add-passphrase to get your passphrase into the kernel keyring, as in pipe-ing your passphrase to it (keeping the passphrase secure, without leaving it in a plaintext file is a concern):

printf "%s" "passphrase" | ecryptfs-add-passphrase [--fnek] -

Then used mount.ecryptfs_private:

mount.ecryptfs_private is a mount helper utility for non-root users to cryptographically mount a private directory, ~/Private by default.

This program optionally takes one argument, ALIAS. If ALIAS is omitted, the program will default to using "Private" using: - $HOME/.Private as the SOURCE - $HOME/Private as the DESTINATION - $HOME/.ecryptfs/Private.sig for the key signatures.

If ALIAS is specified, then the program will look for an fstab(5) style configuration in: - $HOME/.ecryptfs/ALIAS.conf and for key signature(s) in: - $HOME/.ecryptfs/ALIAS.sig

The mounting will proceed if, and only if: - the required passphrase is in their kernel keyring, and - the current user owns both the SOURCE and DESTINATION mount points - the DESTINATION is not already mounted

This program will:

• mount SOURCE onto DESTINATION
• as an ecryptfs filesystem
• using the AES cipher
• with a key length of 16 bytes
• using the passphrase whose signature is in ~/.ecryptfs/Private.sig

---

Or read through man ecryptfs and set up your own mount line, using a keyfile or file descriptors or variables to get your passphrase to the mount command however you see fit. As in mount -t ecryptfs [SRC DIR] [DST DIR] -o [OPTIONS] paying attention to options like:

   passphrase_passwd=(passphrase)
          The actual password is passphrase. Since the password is  visible
          to  utilities  (like ps under Unix) this form should only be used
          where security is not important.

   passphrase_passwd_file=(filename)
          The   password   should   be   specified   in   a    file    with
          passwd=(passphrase).  It  is  highly recommended that the file be
          stored on a secure medium such as a personal usb key.

   passphrase_passwd_fd=(file descriptor)
          The password is specified through the specified file descriptor.

   openssl_keyfile=(filename)
          The filename should be the filename of a file containing  an  RSA
          SSL key.

etc...

---

But if the encrypted directory is decrypted/mounted whenever the user logs in, then all you have to do is log in, isn't it?

Answer 3

Here is a method that does not require sudo or temp files and works with filename encryption. I based it on the ecryptfs-mount-private script (which is a shell script so you could also make a copy and edit it directly).

WRAPPED_PASSPHRASE_FILE="$HOME/.ecryptfs/wrapped-passphrase"
LOGINPASS="YOUR PASSWORD"

# If not using filename encryption
# printf "%s\0" "$LOGINPASS" | ecryptfs-unwrap-passphrase "$WRAPPED_PASSPHRASE_FILE" - | ecryptfs-add-passphrase -

# If using filename encryption
printf "%s\0" "$LOGINPASS" | ecryptfs-insert-wrapped-passphrase-into-keyring "$WRAPPED_PASSPHRASE_FILE" -

# Try mounting
/sbin/mount.ecryptfs_private >/dev/null 2>&1