5

Following an issue with my QNAP device I've had to do a whole load of manual recovery of data and only getting at my encrypted data remains.

It seems that QNAP use eCryptFS to do this. I've managed to set-up the passphrase (with ecryptfs-add-passphrase --fnek) and mounted the filesystem with:

mount /mnt/md3/.__eN__securedocs/ /mnt/md3/documents/Secure/ -t ecryptfs \
  -o rw,ecryptfs_sig=b04b010ba4c32521,ecryptfs_fnek_sig=4f23065f483e5b1c,ecryptfs_unlink_sigs,relatime,ecryptfs_cipher=aes,ecryptfs_key_bytes=32

I can see my files but the permissions are in a state I've never seen before making them impossible to interact with, not even enough to copy:

[~] # ll /mnt/md3/documents/Secure/                                                                                                                                                                                          
/bin/ls: cannot access /mnt/md3/documents/Secure/battle.net.txt: No such file or directory
/bin/ls: cannot access /mnt/md3/documents/Secure/steam.txt: No such file or directory
/bin/ls: cannot access /mnt/md3/documents/Secure/Work: No such file or directory
/bin/ls: cannot access /mnt/md3/documents/Secure/Passport Application Declaration.pdf: No such file or directory
/bin/ls: cannot access /mnt/md3/documents/Secure/Bills: No such file or directory
/bin/ls: cannot access /mnt/md3/documents/Secure/Car: No such file or directory
/bin/ls: cannot access /mnt/md3/documents/Secure/Receipts: No such file or directory
/bin/ls: cannot access /mnt/md3/documents/Secure/.DS_Store: No such file or directory
/bin/ls: cannot access /mnt/md3/documents/Secure/._.DS_Store: No such file or directory
/bin/ls: cannot access /mnt/md3/documents/Secure/House: No such file or directory
/bin/ls: cannot access /mnt/md3/documents/Secure/Banking: No such file or directory
/bin/ls: cannot access /mnt/md3/documents/Secure/hmpo_reminder_2016_02_25.pdf: No such file or directory
/bin/ls: cannot access /mnt/md3/documents/Secure/hmrc_tax_code_2017_2018.pdf: No such file or directory
/bin/ls: cannot access /mnt/md3/documents/Secure/hmrc_tax_refund_2016_2017_full.pdf: No such file or directory
/bin/ls: cannot access /mnt/md3/documents/Secure/hmrc_tax_refund_2016_2017.pdf: No such file or directory
/bin/ls: cannot access /mnt/md3/documents/Secure/2017_11_26_disclosure_scotland_details.pdf: No such file or directory
/bin/ls: cannot access /mnt/md3/documents/Secure/2017_11_29_disclosure_scotland_basic_disclosure.pdf: No such file or directory
/bin/ls: cannot access /mnt/md3/documents/Secure/passport_scan.pdf: No such file or directory
total 12K
drwxrwxrwx 10 admin administrators 4.0K Feb 13 10:21 ./
drwxrwxrwx  9 admin administrators 4.0K Feb 13 09:53 ../
-?????????  ? ?     ?                 ?            ? .DS_Store
-?????????  ? ?     ?                 ?            ? ._.DS_Store
drwxr-xr-x  2 admin administrators 4.0K Apr  9  2017 .digest/
-?????????  ? ?     ?                 ?            ? 2017_11_26_disclosure_scotland_details.pdf
-?????????  ? ?     ?                 ?            ? 2017_11_29_disclosure_scotland_basic_disclosure.pdf
d?????????  ? ?     ?                 ?            ? Banking/
d?????????  ? ?     ?                 ?            ? Bills/
d?????????  ? ?     ?                 ?            ? Car/
d?????????  ? ?     ?                 ?            ? House/
-?????????  ? ?     ?                 ?            ? Passport Application Declaration.pdf
d?????????  ? ?     ?                 ?            ? Receipts/
d?????????  ? ?     ?                 ?            ? Work/
-?????????  ? ?     ?                 ?            ? battle.net.txt
-?????????  ? ?     ?                 ?            ? hmpo_reminder_2016_02_25.pdf
-?????????  ? ?     ?                 ?            ? hmrc_tax_code_2017_2018.pdf
-?????????  ? ?     ?                 ?            ? hmrc_tax_refund_2016_2017.pdf
-?????????  ? ?     ?                 ?            ? hmrc_tax_refund_2016_2017_full.pdf
-?????????  ? ?     ?                 ?            ? passport_scan.pdf
-?????????  ? ?     ?                 ?            ? steam.txt

Other posts on the net say this is caused by the containing directory not having execute permission but as can be seen in the snippet above that this is not the cause here as the execute permission is present.

Any thoughts on how to overcome this last hurdle?

  • 1
    If you use -o ro instead of rw while mounting, does it yeild same result? – tukan Mar 24 '18 at 16:26
  • 1
    Try the ecryptfs_xattr or ecryptfs_encrypted_view options linux.die.net/man/7/ecryptfs also as stated you should have a backup or work on a read only copy. – user1133275 Mar 24 '18 at 17:25
  • 1
    I've tried ro and it does indeed yield the same result. I also tried ecryptfs_xattr & ecryptfs_encrypted_view but they don't seem to be valid options in the version/build of ecryptfs on the QNAP. – kemra102 Mar 24 '18 at 22:17
  • 1
    Do you, by any chance, run autofs? If yes try to disable it and then try the manual mount. – tukan Mar 26 '18 at 13:29
1

None of those directories have the execute permission. According to the information you have provided you have attempted to mount the directory as rw and ro. You will need to mount the file system as rwx. However, your issue could be due to how the file system permissions were mangled by the data recovery.

It appears other people who have your issue are using QNAP in a Windows Active Directory environment. This forum post involves this issue and could shed a little light if your environment is tied to a Windows Active Directory. This is another post involving Windows. I have also found this post. Not sure if they are applicable but they come up when searching about your issue.

I am referencing the Arch Linux Wiki on ecryptfs and the Arch Linux Wiki on NTFS mounting. Here is links to the QNAP Wiki on subfolder permissions and the Data Recovery Categories. These should also help provide more information on how to troubleshoot your issue.

Re-mount your File System and Fix Permissions

I would start all over. Reboot and remount your systems. If the mount command worked before to allow you to successful decrypt your file system and mount you then need to change permissions of the directory as root(sudo) to:

chmod go= [root directory name]

You can also try to manually mount the ecryptfs using the wrapper:

ecryptfs-mount-private Path/To/File/System

Again chmod could help after this step too if permissions continue to be missing. You will be prompted for the mount password for your ecryptfs with the above command.

If you can comment with any additional issues you are having I can update with answer with more relevant solutions. I believe that your issue could be tied to a mangled data recovery (to solve you will need to follow a guide on how QNAP recommends you do data recovery) or it could be related to NFS or NTFS access control list settings preventing proper permissions. This should only be related if your environment is also tied to Windows. If anyone has any corrections to add, I would greatly appreciate it. Best of Luck!

1

I had a similar problem due to defective hardware, but it wasn't on a QNAP so it might not apply.

However, I do remember the same weird ls output.

What I did was simply to mount the partition as read/write, then force both ownership and permissions. I remember having to do that twice, but I don't recall the reason (perhaps I mistyped something).

chmod -R a+rwx /mnt/md3/documents/Secure
chown -R admin:administrators /mnt/md3/documents/Secure

I also had some troubles with ACLs, solved the same way.

Luckily it was a document partition and I was in no hurry, I just couldn't be bothered to do a slow restore from backups.

You can try with one file or one directory and see whether this applies.

Assuming that the mount and fsck went okay, this means that your data should be useable. However, perform a backup of the unmounted encrypted container and, if at all possible, mount and experiment on the copy.

After recovery, get all the files safe on a backup disk, run a complete factory restore on the QNAP (probably removing the disks, formatting them and placing them back in is enough - the QNAP should reinitialise them on its own. I know that Synology and Terastore units do), then put the files back in. This way you'll know that you can trust the QNAP filesystem again.

  • Hi, I am having exactly the same issue. However when I try to chmod the files with the mangled up permission it only tells me that there is no such files... "No such file or directory" – Alex May 10 '18 at 21:09
  • Try fixing the containing directory first (but make a backup of the unmounted encrypted container, as stated in the answer, for safety). If ls sees the files, it means it can access the inodes and directory entries, so there's no reason not to set the permissions. – LSerni May 10 '18 at 22:07
  • I did try the containing directory first, all permission look alright on the directory to which the files are mounted too – Alex May 10 '18 at 23:05
  • My files are mounted in /share/CE_CACHEDEV1_DATA/ and the permission on that folder are the following: drwxrwxrwx 2 admin administrators 40 2018-05-10 15:56 ./ – Alex May 10 '18 at 23:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.