Migrating to an Encrypted Home Directory

June 3, 2009

Howdy!

Many eCryptfs and Ubuntu Jaunty users have requested instructions on migrating their existing, non-encrypted home directories to an Encrypted-Home setup. I have some instructions for you now!

Prerequisites

  1. Make a complete backup copy of your non-encrypted data to another system or external media. Some of the following instructions are dangerous, could result in data lost, or lock you out of your system! Please read and follow all instructions very carefully.
  2. Make sure you have sufficient disk space available. To make a full copy, you will need at least 2x the disk usage of your current home directory. Assuming the copy succeeds and you have access to your encrypted data, you can recover some space by deleting the unencrypted data.

    du -sh $HOME
    df -h $HOME
  3. You must have administrator (sudo) privileges.
  4. You should install ecryptfs-utils

    sudo apt-get install ecryptfs-utils

  5. These instructions require an empty $HOME/Private directory. If you already have some data in your $HOME/Private directory, please move all of these files and directories out of the way, and follow the instructions in:

    ecryptfs-setup-private --undo

Instructions

Exit all desktop sessions. You need to ensure that there are no other processes on your system reading and/or writing data in your home directory. Perform all of the following instructions by logging in via SSH or at a tty terminal (ctrl-alt-F1).

Login and setup an Encrypted Private directory:


login
ecryptfs-setup-private

Logout, and log back in and make sure $HOME/Private is mounted.


exit
login
mount | grep "$USER.*ecryptfs"

Use rsync to copy all data from your home directory to your new Encrypted Private directory. If you have a large home directory, this step might take a very long time. Be very wary of any errors at this point. This is the most essential step in this migration scheme. I usually re-run this step 3 times.


rsync -aP --exclude=.Private --exclude=Private --exclude=.ecryptfs \
$HOME/ $HOME/Private/

Sync to disk, unmount, logout, and log back in.


sync && sync && sync
ecryptfs-umount-private
exit
login

Setup your eCryptfs configuration directory.


ecryptfs-umount-private
cd /
sudo mkdir -p /home/.ecryptfs/$USER
sudo chown $USER:$USER /home/.ecryptfs/$USER
mv $HOME/.ecryptfs /home/.ecryptfs/$USER/
mv $HOME/.Private /home/.ecryptfs/$USER/
sudo chmod 700 /home/.ecryptfs/$USER/.Private /home/.ecryptfs/$USER/.ecryptfs

Setup your new, unmounted home directory.


sudo mkdir -p -m 700 /home/$USER.new
sudo chown $USER:$USER /home/$USER.new
ln -sf /home/.ecryptfs/$USER/.ecryptfs \
/home/$USER.new/.ecryptfs
ln -sf /home/.ecryptfs/$USER/.Private \
/home/$USER.new/.Private

Move your old, unencrypted home directory out of the way.


sudo mv $HOME $HOME.old

“Activate” your new, unmounted home directory by renaming it.


sudo mv /home/$USER.new $HOME
echo $HOME > $HOME/.ecryptfs/Private.mnt
ln -sf \
/usr/share/ecryptfs-utils/ecryptfs-mount-private.txt \
$HOME/README.txt
sudo chmod 500 $HOME

Logout, and log back in. Ensure that $HOME is mounted, and that you have a symlink to your configuration directory.


exit
login
mount | grep "$USER.*ecryptfs"
ln -sf /home/.ecryptfs/$USER/.ecryptfs \
/home/$USER/.ecryptfs
ln -sf /home/.ecryptfs/$USER/.Private \
/home/$USER/.Private

Check all of your home directory data. Ensure that everything is in order. Once you are completely confident that the migration worked, you can reclaim some disk space by removing your old, non-encrypted data.


sudo rm -rf $HOME.old

Notes

If you are a shred-minded-individual, you will need to backup your cleartext data, shred your disk, and reinstall from scratch.

:-Dustin

12 Responses to “Migrating to an Encrypted Home Directory”

  1. Andy Says:

    I follow your blog because encrypting ~ is important to me. As a bike commuter, I also try to maintain a system at home that mirrors the work files on my laptop at work, so I can telecommute from time to time.

    Currently I am using Unison to painlessly keep my local files in-sync between my two computers.

    Here's my question. If I encrypt my home directory on the laptop, will the sync performed by unison (which is nothing more than a fancy rsync) also be encrypted? If so, is there sane way to mirror the encryption set up between the two machines.

    I'm interested, but I really value my ability to move data back and forth, but would like to have an encrypted hard drive when I'm flying/traveling for work.

    I'm interested in your thoughts.

  2. Michael Says:

    Thanks for these instructions.
    Everything went well except one thing:

    When done, a copy all the folders of my home directory also appears in the $HOME/Private folder! I assume these folders can be safely removed?

  3. hggdh2 Says:

    shred is a good idea, if you are paranoid (I am). Even paranoids *do* have enemies…

    Just two details on shred (on Jaunty it is version 6.10 (i.e., coreutils 6.10):

    (1) this version still performs, by default, 20+ iteractions on the file (or disk); each iteraction writes a specific bitmask, out of a pool of possible bitmasks;

    (2) at the beginning, middle, and the end of the iteractions a "random" pass is performed. This random pass reads from /dev/urandom, and writes over the file.

    The issues here are:

    (a) 20+ passes are now considered excessive; a consensus has been reached that 2 (even perhaps one!) passes would be enough (shred 7.3, onwards now defaults to 3 passes);
    (b) shred uses /dev/urandom! This is the critical issue, in fact: if you are shredding a small file (a few MB, at most) this is no big impact. But mass-shredding, or shredding a very large file (or disk) causes the system random pool to be deplected. The immediate consequence is a *much* longer wait to receive data from /dev/urandom (e.g., https://bugs.edge.launchpad.net/ubuntu/+source/coreutils/+bug/279598).

    (c) if you just reduce the number of passes (via the -n parameter), random passes will still be inserted.

    So… the best way is to call shred with the –random-source parameter. I usually run it with /dev/zero as the source, but a pipe could also be used:

    shred -n5 –random-source=/dev/zero file1

  4. Dustin Kirkland Says:

    Andy-

    I'm not familiar with "Unison", but I do use rsync to backup my encrypted data on a daily basis.

    Your encrypted data actually exists in a .Private directory in your unmounted home directory.

    To access this, I do the following (which I'm suggesting we do something like this for Karmic):

    sudo mkdir /.home
    echo /home /.home none ro,bind

    And then reboot. After that, you should see your encrypted data in /.home/$USER/.Private. This is what you'd want to point Unison or rsync at 😉

    :-Dustin

  5. Dustin Kirkland Says:

    Michael-

    I don't understand your comment. Are you sure you followed these instructions *very* precisely?

    :-Dustin

  6. Dustin Kirkland Says:

    hggdh2-

    Thanks for the education on shred.

    Personally, I only ever use shred when I'm returning a borrowed system to an employer.

    :-Dustin

  7. Michael Says:

    Dustin Kirkland-
    I am sure I have followed your instructions very precisely.
    They only strange thing after the process is, that a copy of my home directory remains in the /home/michael/Private folder. I have tested it under a VirtualBox Ubuntu Jaunty distribution.
    Again, this is not really a serious issue(except more space is actually needed during the process).
    A last instruction step of 'rm -rf $HOME/Private' will do the trick.
    –Michael

  8. Michael Says:

    Dustin Kirkland-
    Sorry. After repeating your instructions again it works well. The /home/michael/Private does now not exist anymore. Please forget my prior posts. Keep up the good work!
    –Michael

  9. quadernostracciato Says:

    Thank you so much for this step-by-step guide! 🙂

  10. popey Says:

    Just followed this guide on Karmic on my laptop and it worked a treat. Thanks Dustin..

    http://beeroverip.org/

  11. Emmanuel Pirsch Says:

    Looks like I did something wrong… After the procusedure, My $HOME contained a folder $USER will all my data instead of having the data directly under $HOME.

    I've done it twice and got the same result.

  12. Martin Says:

    Thanks for this guide. Worked nicely on the second attempt on Ubuntu Netbook Remix 9.04. Not sure what I did wrong the first time…


Leave a Reply

Please log in using one of these methods to post your comment:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: