I log in to a server via public key authentication and then mount a container (using e.g. LUKS/dm-crypt or truecrypt). At the moment, I have to enter the container password manually. Is there a way to secure that container using e.g. the ssh agent? Or if that is not possible directly, can I encrypt the container password (or probably better, keyfile) with the ssh public key and use ssh agent to decrypt it temporarily?


I did something similar to this once with a remote encfs where I stored backups from my local PC. Maybe this will help. I was using Ubuntu with gnome-keyring at the time.


# This will grab the appropriate environment variables to connect to the 
# gnome-keyring via dbus for the currently logged in user
# shouldn't be necessary if you're running from an xterm in gnome
$(sed 's/^\([^#]\)/export \1/' ~/.dbus/session-bus/*-0 | grep -v ^#)


import sys
import keyring

if len(sys.argv) < 5:
    print "Usage: keyring_helper.py get|set name server protocol [password]"

k = keyring.Keyring(sys.argv[2], sys.argv[3], sys.argv[4])

if sys.argv[1] == "get":
    c = k.get_credentials()
    print c[1]
elif sys.argv[1] == "set":
    k.set_credentials((sys.argv[2], sys.argv[5]));



. "$(dirname "$0")"/dbus_session.sh
cd /home/mike/misc/scripts

if ssh polaris mountpoint -q ~/mnt/; then
  echo 1>&2 Filesystem already mounted.
  exit 1

# Take password from gnome-keyring and store in FIFO on polaris
./keyring_helper.py get mike polaris enc_backups 2>/dev/null |ssh polaris 'cat >~/passwd' &

# Mount the encrypted filesystem
ssh polaris 'nice -n 19 encfs -f -i 5 --extpass=cat ~/enc_backups/ ~/mnt/ <~/passwd' &

# Wait for the mount to complete
ssh polaris 'while ! mountpoint -q ~/mnt/; do if [ $((I++)) -gt 15 ]; then exit 1; fi; sleep 1; done'

if [ $? -ne 0 ]; then
  echo 1>&2 Mount failed.
  exit 2

# Transfer data
rsync -az --delete --bwlimit 45 ~/misc /array/Dropbox/documents /array/pictures polaris:mnt/

# Unmount the encrypted filesystem
ssh polaris fusermount -u mnt

# Wait for child processes to exit

The initial setup is pretty simple, do a mkfifo passwd on your remote server and keyring_helper.py set <name> <server> <protocol> on your desktop. Once that's complete, your desktop should write your password from the keyring to the fifo where a remote truecrypt process will read it via stdin.

  • 1
    Interesting. Remember to chmod 600 passwd.
    – peterph
    Oct 6 '13 at 20:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.