I used ecryptfs-migrate-home to encrypt my home folder on my Debian (Testing) system.

As I am a complete encryption-greenhorn, I don't know yet how to check, if the encryption succeeded. However, I suppose encryption works but filenames are not encrypted. I want to have encrypted filenames as well.

How can I get encrypted filenames for my (already encrypted) /home-folder?

  • 1
    AFAIK file name encryption is turned on by default, unless you have an ancient kernel. (2.6.32 as in Debian stable is recent enough.) What commands did you run exactly? What does cat /sys/fs/ecryptfs/version show? Commented Jan 3, 2013 at 0:27
  • cat /sys/fs/ecryptfs/version says 375 - I am on Debian Testing, therefore it should be alright, then. Can you tell me how to view the encrypted files? ls /home/username doesn't list me my files (neither encrypted nor unencrypted)
    – Marcel
    Commented Jan 3, 2013 at 0:32
  • 1
    Your kernel is fine (the version must have the 100 bit set). The encrypted files are in ~/.Private, and when active the plaintext content is accessible through ~/Private. Are you sure that you have non-encrypted filenames in ~/.Private? In ~/Private, of course, you see the real file names — or nothing when the volume isn't active. Commented Jan 3, 2013 at 0:43
  • You are right! Filenames are encrypted! For completeness: here's an instruction to check the encryption (in German) thomas-krenn.com/de/wiki/…
    – Marcel
    Commented Jan 3, 2013 at 0:46

1 Answer 1


The encrypted home utilities don't support the ability to enable encrypted filenames after you've set up your encrypted home directory. But, I looked at the ecryptfs-migrate-home script and believe that it should be enabling filename encryption by default.

Let's verify that filename encryption is enabled. Do you have two lines in your key signature file?

$ wc -l ~/.ecryptfs/Private.sig 
2 /home/user/.ecryptfs/Private.sig

If wc reports that there are two lines, things are looking good so far. Check to see if the eCryptfs mount includes the filename encryption key signature mount option:

$ grep ecryptfs_fnek_sig= /proc/mounts
/home/user/.Private /home/user ecryptfs rw,nosuid,nodev,relatime,ecryptfs_fnek_sig=0011223344556677,ecryptfs_sig=8899aabbccddeeff,ecryptfs_cipher=aes,ecryptfs_key_bytes=16,ecryptfs_unlink_sigs 0 0

If you see the ecryptfs_fnek_sig option, things are looking even better. Now make sure that filenames are encrypted in the lower filesystem:

$ ls /home/.ecryptfs/user/.Private

Do all filenames have a "ECRYPTFS_FNEK_ENCRYPTED." prefix? If so, the filename encryption feature is configured and working correctly.

  • you are right! nothing more to say :)
    – Marcel
    Commented Jan 3, 2013 at 0:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .