I used ecryptfs-migrate-home to encrypt my home folder on my Debian (Testing) system.

As I am a complete encryption-greenhorn, I don't know yet how to check, if the encryption succeeded. However, I suppose encryption works but filenames are not encrypted. I want to have encrypted filenames as well.

How can I get encrypted filenames for my (already encrypted) /home-folder?

  • 1
    AFAIK file name encryption is turned on by default, unless you have an ancient kernel. (2.6.32 as in Debian stable is recent enough.) What commands did you run exactly? What does cat /sys/fs/ecryptfs/version show? – Gilles 'SO- stop being evil' Jan 3 '13 at 0:27
  • cat /sys/fs/ecryptfs/version says 375 - I am on Debian Testing, therefore it should be alright, then. Can you tell me how to view the encrypted files? ls /home/username doesn't list me my files (neither encrypted nor unencrypted) – Marcel Jan 3 '13 at 0:32
  • 1
    Your kernel is fine (the version must have the 100 bit set). The encrypted files are in ~/.Private, and when active the plaintext content is accessible through ~/Private. Are you sure that you have non-encrypted filenames in ~/.Private? In ~/Private, of course, you see the real file names — or nothing when the volume isn't active. – Gilles 'SO- stop being evil' Jan 3 '13 at 0:43
  • You are right! Filenames are encrypted! For completeness: here's an instruction to check the encryption (in German) thomas-krenn.com/de/wiki/… – Marcel Jan 3 '13 at 0:46

The encrypted home utilities don't support the ability to enable encrypted filenames after you've set up your encrypted home directory. But, I looked at the ecryptfs-migrate-home script and believe that it should be enabling filename encryption by default.

Let's verify that filename encryption is enabled. Do you have two lines in your key signature file?

$ wc -l ~/.ecryptfs/Private.sig 
2 /home/user/.ecryptfs/Private.sig

If wc reports that there are two lines, things are looking good so far. Check to see if the eCryptfs mount includes the filename encryption key signature mount option:

$ grep ecryptfs_fnek_sig= /proc/mounts
/home/user/.Private /home/user ecryptfs rw,nosuid,nodev,relatime,ecryptfs_fnek_sig=0011223344556677,ecryptfs_sig=8899aabbccddeeff,ecryptfs_cipher=aes,ecryptfs_key_bytes=16,ecryptfs_unlink_sigs 0 0

If you see the ecryptfs_fnek_sig option, things are looking even better. Now make sure that filenames are encrypted in the lower filesystem:

$ ls /home/.ecryptfs/user/.Private

Do all filenames have a "ECRYPTFS_FNEK_ENCRYPTED." prefix? If so, the filename encryption feature is configured and working correctly.

| improve this answer | |
  • you are right! nothing more to say :) – Marcel Jan 3 '13 at 0:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.