I want maximize the number of folders encrypted with ecryptfs and decrypted at login with the module pam_ecryptfs.so.

Which folders cannot possibly be encrypted before login in?

I guess a lsof ran by pam_exec.so should give me the answer. Do you have a better strategy?

Example of whitelisted folders: /boot, /etc/pam.d

PS: I am using Ubuntu Desktop 16.10. Please don't mention full disk LUKS encryption (which is done).

  • 2
    If you already had full disk encryption why do you bother with eCryptfs? Anyway, the answer is that everything outside /home needs to be available--after all, the system is fully up and running even if you haven't logged in. – AlexP Dec 26 '16 at 21:02

Ecryptfs is designed to encrypt a user's home directory. Although it can be used otherwise, it wasn't designed for that and won't be easy to set up.

Ecryptfs normally gets mounted at login time, so it can only encrypt the user's data. A user's data is normally under the user's home directory, that's what the home directory is for.

System-wide files cannot be encrypted with ecryptfs unless you mount it before logging in. But if that's what you want, then there's no point in using ecryptfs: it would be harder to set up and would be slower than using LUKS/dmcrypt to encrypt the whole filesystem, and there would be no security benefit whatsoever. Using ecryptfs to protect a home directory has an advantage over whole disk encryption when you want the machine to boot unattended, but want the user's file to be protected until the user logs in. If the decryption happens before logging in then there's no point in using ecryptfs.

Looking for dependencies of pam_exec.so is futile. What you need before logging in is a whole lot of system services. The pam_exec module is just one part of the login process, the rest of the login process also needs to be available, as do the login program, the logging subsystem, all the programs used to initialize devices, and many, many other system services. If you want all of these to be encrypted, then you need something that requests the decryption key very early in the boot process, and the way to do that is whole-disk encryption, with LUKS.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.