0

Today I had a huge scare accidentally changing my laptop password to a keepass-generated 64-alphadigit string, locking me out of my encrypted homedir. My login password was stored in a keepass file on the encrypted homedir, mounted on a locked desktop which I could not unlock due to the password change. Luckily I have my mount passphrase and was easily able to have ecryptfs-recover-private mount to files on some /tmp-folder.

However, I don't just want to recover my files, also the operational part of my laptop automatically mounting them whenever I login, without accidentally destroying something that could indefinitely remove my access to the files. Hence Try-all and error of commands is not OK, I can easily do something I will regret. I could not find anything on the official ubuntu-page:

https://help.ubuntu.com/community/EncryptedPrivateDirectory#Not_covered_in_this_tutorial

How do I reconfigure my encrypted homedir with my operating system and user account to function as before, given that my login-password is gone but my mount passphrase is available? Should I copy all my files to a proxy storage? The latter would be a pain, since I don't have the storage to duplicate my homedir.

Herbert
  • 205
  • 1
  • 2
  • 10
  • Additionally, you can and should always back up the `.ecryptfs/wrapped-passphrase` file or even the output of `ecryptfs-unwrap-passphrase` to back up the encryption key and put them in a safe location. – David Foerster May 10 '18 at 09:09

1 Answers1

0

If this situation occured after a password change from your user you can use

ecryptfs_rewrap_passphrase ~/.ecryptfs/wrapped-passphrase PREVIOUS_LOGIN_PASSWORD NEW_LOGIN_PASSWORD

to reset the passphrase in the keyring, otherwise you can use

ecryptfs-insert-wrapped-passphrase-into-keyring .ecryptfs/wrapped-passphrase`

to store the passphrase in the keyring.

Herbert
  • 205
  • 1
  • 2
  • 10
Koos
  • 1
  • 3
  • It seems that if I make sure my user login password and the wrapping password of `.ecryptfs/wrapped-passphrase`, my homedir is ecrypted and mounted again when I login. Is that the correct fix? To ensure the user-account and `.ecryptfs/wrapped-passphrase` passwords are the same? – Herbert May 10 '18 at 05:27