Moving your Encrypted Home Meta Data out of /var/lib/ecryptfs

In the spirit of the FHS, Encrypted Home Directories in Ubuntu 9.04 stored certain configuration information about your Encrypted Home setup in /var/lib/ecryptfs.

• http://www.pathname.com/fhs/pub/fhs-2.3.html#VARLIBVARIABLESTATEINFORMATION

However “correct” this location might be, it has caused considerable pain to a number of users, mostly because people don’t backup /var/lib, generally. That said, it is totally possible to re-generate all of the information in your /var/lib/ecryptfs directory if you recorded your all-important mount passphrase.

In any case, this is not the most user-friendly place to store this information.

Thus, in Karmic, we are using /home/.ecryptfs instead of /var/lib/ecryptfs. Each user encrypting their home directory will have a a directory in /home/.ecryptfs/$USER which will contain the “real” .ecryptfs and .Private directories.

This provides a couple of advantages.

First, your /home directory is completely self-contained. You can backup that entire hierarchy and save all of the data necessary (excepting your secret passphrase, of course). Actually, many users make /home a separate partition.

Secondly, having access to /home/.ecryptfs/$USER/.Private means that you can much more easily perform backups of your encrypted data. This feature has been requested many, many times.

You can actually take advantage of this same configuration in Ubuntu 9.04, if you follow the guide below. I recommend doing so

As always, you should log out of all desktop sessions, and perform these instructions from a tty terminal, or an ssh session.

#!/bin/sh -e

# Move out of your home directorycd /

# If your encrypted home is not mounted, try to mount itgrep -qs " $HOME ecryptfs " /proc/mounts || ecryptfs-mount-private

# With root privilege, create a /home/.ecryptfs/$USER directorysudo mkdir -p /home/.ecryptfs/$USER

# Make sure $USER owns thatsudo chown $USER:$USER /home/.ecryptfs/$USER

# Rename your /var/lib/ecryptfs/$USER dir to the new locationsudo mv -f /var/lib/ecryptfs/$USER /home/.ecryptfs/$USER/.ecryptfs

# Remove the two symlinks in your mounted home, to .ecryptfs and .Privaterm -f $HOME/.ecryptfs $HOME/.Private

# Establish links to these two dirsln -sf /home/.ecryptfs/$USER/.ecryptfs $HOME/.ecryptfsln -sf /home/.ecryptfs/$USER/.Private $HOME/.Private

# Unmount homewhile ecryptfs-umount-private | grep "Sessions still open"; dotruedone

# Make your unmounted home writable (briefly)sudo chmod 700 $HOME

# Move the *real* .Private directory to the new locationmv -f $HOME/.Private /home/.ecryptfs/$USER/

# Remove the .ecryptfs and .Private linksrm -f $HOME/.ecryptfs $HOME/.Private

# Re-establish the .ecryptfs and .Private linksln -sf /home/.ecryptfs/$USER/.ecryptfs $HOME/.ecryptfsln -sf /home/.ecryptfs/$USER/.Private $HOME/.Private

# Mount your home directory againecryptfs-mount-private

ustin