Back up of encrypted home dir of logged users impossible

Asked by Milan Knizek

Once the user logs in, the $HOME/.Private is replaced by decrypted files, effectively hiding the encrypted ones.

This seems to me as a design error. The .Private directory should be outside of user's home directory to allow for backup of a live system with users logged in (no matter that this is not recommended due to possible on-going changes to the file system).

Ubuntu 9.04 amd64. Affects adduser --encrypt-home and possibly ecryptfs-setup-private --all-home

Question information

Language:
English Edit question
Status:
Solved
For:
eCryptfs Edit question
Assignee:
No assignee Edit question
Solved by:
Milan Knizek
Solved:
Last query:
Last reply:
Revision history for this message
Dustin Kirkland  (kirkland) said :
#1

Actually, it is possible to get to your encrypted data!

Try this:

 $ umount.ecryptfs_private && cd $HOME/.Private && mount.ecryptfs_private

This should momentarily unmount your home (or private) directory, put you in your encrypted directory, and then remounted (as quickly as possible).

This is how I backup my encrypted data!

:-Dustin

Revision history for this message
Launchpad Janitor (janitor) said :
#2

This question was expired because it remained in the 'Open' state without activity for the last 15 days.

Revision history for this message
Milan Knizek (knizek) said :
#3

For the record:

Rafał Błaszczyk commented the bug https://bugs.launchpad.net/bugs/365596

Dustin - you cannot do that, user is logged in and the
/home/$USER/.Private is not visible (it's overmounted). Your solution
with unmounting is also not good enough - there is a good chance user is
using some files and you cannot unmount.

There's an easier solution. You can mount /home in another directory
using --bind option. The default behaviour of bind doesn't mount the
submounts so you can easily access .Private dirs in home directories.

To do that I use /etc/fstab line:
/home /home-bind none ro,bind

now I have all home directories visible inf /home-bind as the user
weren't logged in (they are not overmounted). Read-only - just enough
for backup (you can make that rw for further restores).

Revision history for this message
Milan Knizek (knizek) said :
#4

Problem is solved with the advice in prior comment.