I usually use full disk encryption but I want to create a Ubuntu server that multiple user can use as a file server (using SSHFS GUI clients) and therefore I want their home directories to be encrypted when they are not logged on.

  • I installed Ubuntu 16.04. I installed ecryptfs-utils and cryptsetup.
  • I typed ecryptfs-migrate-home -u <username>
  • Then I logged in as <username>.
  • Then I typed touch filename.
  • Then I logged out as <username>.
  • Then as root I did ls /home/<username>.

And I saw filename! But root should not be able to see this because the directory should be encrypted.

What am I doing wrong?

  • LUKS containers mounted as loop devices can only be unlocked by those with the key. Have those mount on login with the user's own keys and automagically unmount and close on logout. I can't tell you how to do it, so I'm posting this as a comment instead of an answer. ^_^; – Mioriin Apr 18 '18 at 16:13
  • @miorlin That is what I thought I did and yet it does not work so that is why I am posting here. – stone.212 Apr 19 '18 at 3:48

Root can always see encrypted files/folders. There are a few ways to hide your activities from a root users but with a little bit of effort a root user can still find it. Root sees all. You should be the only one on the system with root access anyway so it shouldn't matter too much in your situation.

  • ps. even though root can see the encrypted folder it still cant access the contents without the crypt key. – CGar4 Apr 18 '18 at 15:21
  • Not seeing encrypted files within the folder is the expected result but what actually happens is what I described in my post. Can you explain why? – stone.212 Apr 19 '18 at 3:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.