Does the owner of an encrypted directory need to be logged for it to be accessible by the system?

If the user's directory is encrypted, ie other directories besides the home directory, does it mean that no process on the system, including those running as root will be able to access it?

Does the user have to be logged in physically on the computer for the files to be available? For instance, I assume that the user cannot log in via SSH using key authentication if the authorized_keys file which would be in the ~/.ssh directory, but have to login at the terminal for via a remote spice connection for access to the directory to be enabled, before logging in via SSH if that is needed.

If the user has a database or web application stored in the encrypted directory I would expect it not to be able to start until physical login.

Is that right because that is what I need. If there any services running in the encrypted directory, would the system know to shut them down if the user logged out?

  • To access the encrypted dir, you need the key, not the user. If you want to do ssh etc, then don't encrypt the whole home directory. – ctrl-alt-delor Apr 8 '17 at 19:28
  • Are you meaning logged (a record being made of activity) or logged-in (to be authenticated and using the system)? – ctrl-alt-delor Apr 8 '17 at 19:29
  • @richard I mean logged-in. For instance if I have to log in at the terminal before I can log in via ssh, if I log out of the terminal while still logged in via ssh I expect the file system to be available until I log out of the last ssh sesion. – vfclists Apr 8 '17 at 19:34

Yes, if you use a system that encrypts your user(s) home directory(s) individually. The only implementation that makes sense is to mount the encrypted directory at login time. For example, you can find this system offered in the Ubuntu installer using ecryptfs. (ecryptfs is also built in as part of Chrome OS). This is a different approach from "Full Disk Encryption", where the whole filesystem is unlocked with a password at the start of the boot process. All your desires follow naturally from ecryptfs or any equivalent system... except for the last one

If there any services running in the encrypted directory, would the system know to shut them down if the user logged out?

"Good question" :). Unfortunately unmounting appears to be more error-prone. (I've also seen bugs in stopping processes/services, which is indeed a pre-condition for unmounting. I'm not clear whether ecryptfs has any extra support to kill processes).


Since this question left this for the last sentence, & is also impossibly unspecific, you might want to ask a separate question. E.g. "does this work on X version Y. Please show how you know it works, then I will be able to verify it on my own system."

It would also be nice if you could outline reasons you're interested in logout at all. It suggests a multi-user system. This is not very common, so if you can be more specific that would probably be useful.

  • I haven't chosen one yet as I haven't looked them up yet. I have heard of systems like dmcrypt, LUKS, encryptfs, EndFS and now ecryptfs, but where it comes to a user owned directory I assume some commonality among the suitable ones. – vfclists Apr 8 '17 at 19:38
  • @vfclists that's fair up to a point. Unfortunately the last point is a quality of implementation question. – sourcejedi Apr 8 '17 at 19:43
  • Say I have account for administering an number of remote systems ssh key authentication. I want to be able to log into the account with the encrypted file system, use the keys to adminster the remote systems and logout when I am done. I basically want to reduce the time when a key compromise may be possible, and also protect against theft of the PC. – vfclists Apr 8 '17 at 19:53
  • To be honest the ability to turn of services that depend on the encrypted files being available is simply ice on the cake. It will probably depend on a logout script which can verify that it is the last one running to accomplish that. – vfclists Apr 8 '17 at 19:57

Yes and no. In a normal setup where a user's home directory is encrypted (with ecryptfs), as opposed to when the whole partition is encrypted (with dmcrypt), then the decrypted files are only visible while the user is logged in. However, there is no strong link between files-are-visible and user-is-logged-in: the way it works is that the encrypted filesystem is mounted (making the files visible) as one of the steps of logging the user in, and the encrypted filesystem is unmounted (making the files no longer visible) as one of the steps of logging the user out.

The user does not have to be logged in physically. It doesn't matter how the user logs in. It may be difficult for the user to log in over SSH, because by default the user's public key would only be recorded inside the encrypted filesystem, so it wouldn't be visible when the user tries to log in and the encrypted filesystem isn't mounted. However the user could authenticate with a different method such as a password (typing the password is necessary to decrypt the files anyway), or could create a .ssh/authorized_keys in the non-encrypted home directory (it's cumbersome but doable).

If you need to control when the unmounting is done, you'll need to remove ~/.ecryptfs/auto-umount and instead call ecryptfs-umount-private directly at the desired time.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.