The main idea I want to have is a backup script run rsync to copy my /home/.Private/user directory off to another server. This would allow the backup script to have no knowledge of the data, but mean the remote backups would be secure. That way I don't need to worry about what happens to them. I can hopefully restore the machine by recreating a user with the same UID on a new build of a machine then copying the data back over.

I'm just wondering if there are some hidden things required... or am I being naive with it's simplicity!


Yes, this is definitely doable!

You'll just want to run rsync from a remote machine.

To back up my encrypted data, I use an hourly cronjob, like this:

00 * * * * rsync -aP username@remotehost:/home/.ecryptfs/username /path/to/local/backup

Note that this directory, /home/.ecryptfs/username, has two subdirectories:


The .ecryptfs directory contains metadata about your eCryptfs mount:

-rw-r--r-- 1 username groupname    0 2011-05-02 17:38 auto-mount         
-rw-r--r-- 1 username groupname    0 2011-05-02 17:38 auto-umount        
-rw------- 1 username groupname   15 2011-05-02 17:38 Private.mnt        
-rw------- 1 username groupname   34 2011-05-02 17:38 Private.sig        
-rw------- 1 username groupname   48 2011-05-02 17:39 wrapped-passphrase 

auto-mount and auto-umount are just flags; if present, pam_ecryptfs will automatically mount and unmount on login and logout.

Private.mnt contains the path where your encrypted directory will be mounted, and this is typically either $HOME or $HOME/Private.

Private.sig contains either one or two lines, specifying signatures or hashes of your mount key. The first line is always the signature of the file contents encryption key, and the second line if present is the signature of the file name encryption key.

wrapped-passphrase is absolutely the most important file in this directory, and without which recovering your data will be pretty much impossible. Inside this file is your actual mount passphrase -- typically a string of 16 or 32 hexadecimal characters encrypted with your login passphrase.

You will most certainly want to store a backup of this file, but you may not want to store it in the same place (or on the same system) where you're backing up your encrypted data. You should really keep your keys and encrypted data separate.

Finally, the .Private data contains your actual encrypted data.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy