"ecryptfs-mount-private" returns "fopen: No such file or directory"

Question

Recently, we've rebooted server and got ecryptfs mount fail:

...
Signature not found in user keyring
Perhaps try the interactive 'ecryptfs-mount-private'
user@host:~$

Could that be because of password change?

Although,

1. There's no mount password
2. We might have login password

When trying to recover mount directory, it outputs:

user@host:~$ ls
Access-Your-Private-Data.desktop  README.txt
user@host:~$ ecryptfs-mount-private
Enter your login passphrase:
Error: Unwrapping passphrase and inserting into the user session keyring failed [-5]
Info: Check the system log for more information from libecryptfs
ERROR: Your passphrase is incorrect
Enter your login passphrase:
user@host:~$ sudo ecryptfs-mount-private
[sudo] password for user:
Enter your login passphrase:
Inserted auth tok with sig [ad21fabcda6abfeab] into the user session keyring
fopen: No such file or directory
user@host:~$

So, as you can see, it shows such strange error: fopen: No such file or directory and, also, when running ecryptfs-mount-private without sudo - it fails. When mounting folder using ecrypts-recover-private and login password it mounts it in temporary folder like a charm.
Also, we've tried to ecryptfs-rewrap-password and it doesn't work without sudo. So, using sudo ecryptfs-rewrap-password succeeded in rewrapping, but after reboot the same situation persists.

All in all, what could this be; how to fix this auto mount encrypted home directory at login?

Answer 1

I set up an ecryptfs private folder, then removed the r & w permission from the wrapped-passphrase file to test... If you had checked the syslog right after seeing the message

Info: Check the system log for more information from libecryptfs

You would have seen lines like this:

Jan 15 00:21:48 sys ecryptfs-insert-wrapped-passphrase-into-keyring: Failed to detect wrapped passphrase version: Permission denied
Jan 15 00:21:48 sys ecryptfs-insert-wrapped-passphrase-into-keyring: Error attempting to unwrap passphrase from file [/home/user/.ecryptfs/wrapped-passphrase]; rc = [-13]

Together those would be a pretty strong arrow pointing to check the permissions of the ~/.ecryptfs/wrapped-passphrase file. (No sudo or strace required)

All in all, just make sure you're running ecryptfs-mount-private command as same user's directory you're trying to mount and wrapped-passphrase file has -rw------- or (600) permissions and same owner as encrypted directory.

Answer 2

In short, user's file wrapped-passphrase had wrong permissions(should be -rw------- user user, were -rw------- root root).

Ran ecryptfs-mount-private command(entered login password) using strace like:

strace -o /tmp/strace.log -e trace=file ecryptfs-mount-private

Contents of /tmp/strace.log:

user@host:~$ sudo strace -o /tmp/strace.log -e trace=file ecryptfs-mount-private
[sudo] password for user:
Enter your login passphrase:
Inserted auth tok with sig [3ab5cd8e5f8c5acb] into the user session keyring
fopen: No such file or directory
user@host:~$ cat /tmp/strace.log
execve("/usr/bin/ecryptfs-mount-private", ["ecryptfs-mount-private"], [/* 13 vars */]) = 0
access("/etc/ld.so.nohwcap", F_OK)      = -1 ENOENT (No such file or directory)
access("/etc/ld.so.preload", R_OK)      = -1 ENOENT (No such file or directory)
open("/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
access("/etc/ld.so.nohwcap", F_OK)      = -1 ENOENT (No such file or directory)
open("/lib/x86_64-linux-gnu/libc.so.6", O_RDONLY|O_CLOEXEC) = 3
getcwd("/home/user", 4096)                = 9
open("/usr/bin/ecryptfs-mount-private", O_RDONLY) = 3
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=3872, si_uid=0, si_status=0, si_utime=0, si_stime=0} ---
stat("/home/user/.ecryptfs/wrapping-independent", 0x7fff65e61c30) = -1 ENOENT (No such file or directory)
open("/dev/null", O_WRONLY|O_CREAT|O_TRUNC, 0666) = 3
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=3873, si_uid=0, si_status=1, si_utime=0, si_stime=0} ---
stat("/home/user/.ecryptfs/wrapped-passphrase", {st_mode=S_IFREG|0600, st_size=58, ...}) = 0
stat("/home/user/.ecryptfs/Private.sig", {st_mode=S_IFREG|0600, st_size=34, ...}) = 0
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=3874, si_uid=0, si_status=0, si_utime=0, si_stime=0} ---
stat("/usr/local/sbin/stty", 0x7fff65e61c40) = -1 ENOENT (No such file or directory)
stat("/usr/local/bin/stty", 0x7fff65e61c40) = -1 ENOENT (No such file or directory)
stat("/usr/sbin/stty", 0x7fff65e61c40)  = -1 ENOENT (No such file or directory)
stat("/usr/bin/stty", 0x7fff65e61c40)   = -1 ENOENT (No such file or directory)
stat("/sbin/stty", 0x7fff65e61c40)      = -1 ENOENT (No such file or directory)
stat("/bin/stty", {st_mode=S_IFREG|0755, st_size=72496, ...}) = 0
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=3875, si_uid=0, si_status=0, si_utime=0, si_stime=0} ---
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=3876, si_uid=0, si_status=0, si_utime=0, si_stime=0} ---
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=3877, si_uid=0, si_status=0, si_utime=0, si_stime=0} ---
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=3878, si_uid=0, si_status=0, si_utime=0, si_stime=0} ---
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=3879, si_uid=0, si_status=0, si_utime=0, si_stime=0} ---
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=3880, si_uid=0, si_status=0, si_utime=68, si_stime=0} ---
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=3881, si_uid=0, si_status=1, si_utime=0, si_stime=0} ---
+++ exited with 1 +++

So, we see that there's not enough information. Ran the same command(entered login password), but with flag -f to trace child processes and using root's rights:

sudo strace -o /tmp/strace2.log -f -e trace=file ecryptfs-mount-private`

Part of contents of /tmp/strace2.log file:

...
3963  open("/root/.ecryptfsrc", O_RDONLY) = -1 ENOENT (No such file or directory)
3963  open("/home/user/.ecryptfs/wrapped-passphrase", O_RDONLY) = 3
...
3964  open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 3
3964  open("/root/.ecryptfs/Private.mnt", O_RDONLY) = -1 ENOENT (No such file or directory)
3964  open("/dev/shm/ecryptfs-root-Private", O_RDWR|O_CREAT|O_NOFOLLOW, 0600) = 3
3964  open("/root/.ecryptfs/Private.sig", O_RDONLY) = -1 ENOENT (No such file or directory)
3964  +++ exited with 1 +++
3954  --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=3964, si_uid=0, si_status=1, si_utime=0, si_stime=0} ---
3954  +++ exited with 1 +++

As we can see, it can't find a file Private.sig of root; it looks like it should be ran by user who encrypted directory we are trying to recover instead of running in a particular directory.

All in all, I ran this command(entered login password) with user's rights:

strace -o /tmp/strace3.log -f -e trace=file ecryptfs-mount-private`

Part of contents of /tmp/strace3.log file:

...
4137  open("/lib/x86_64-linux-gnu/libnss_nis.so.2", O_RDONLY|O_CLOEXEC) = 3
4137  access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
4137  open("/lib/x86_64-linux-gnu/libnss_files.so.2", O_RDONLY|O_CLOEXEC) = 3
4137  open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 3
4137  open("/home/user/.ecryptfsrc", O_RDONLY) = -1 ENOENT (No such file or directory)
4137  open("/home/user/.ecryptfs/wrapped-passphrase", O_RDONLY) = -1 EACCES (Permission denied)
4137  open("/etc/localtime", O_RDONLY|O_CLOEXEC) = 3
4137  +++ exited with 1 +++
4112  --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=4137, si_uid=1000, si_status=1, si_utime=0, si_stime=0} ---
...

As we can see now, an ecryptfs-mount-private utility can't access user's wrapped-passphrase file which resulted in Permission denied message.

Checked /home/user/.ecryptfs/wrapped-passphrase file's permissions and they were:

-rw------- 1 root root

Changed owner of this file via sudo chown user:user /home/user/.ecryptfs/wrapped-passphrase to user and reran above (ecryptfs-mount-private) command without strace(entered login password) which resulted in success message:

INFO: Your private directory has been mounted.
INFO: To see this change in your current shell:
  cd: /home/user