Ytdyklly

Recently, we've rebooted server and got ecryptfs mount fail:

...

Signature not found in user keyring

Perhaps try the interactive 'ecryptfs-mount-private'

user@host:~$

Could that be because of password change?

Although,

1. There's no mount password

2. We might have login password

When trying to recover mount directory, it outputs:

user@host:~$ ls

Access-Your-Private-Data.desktop  README.txt

user@host:~$ ecryptfs-mount-private

Enter your login passphrase:

Error: Unwrapping passphrase and inserting into the user session keyring failed [-5]

Info: Check the system log for more information from libecryptfs

ERROR: Your passphrase is incorrect

Enter your login passphrase:

user@host:~$ sudo ecryptfs-mount-private

[sudo] password for user:

Enter your login passphrase:

Inserted auth tok with sig [ad21fabcda6abfeab] into the user session keyring

fopen: No such file or directory

user@host:~$

So, as you can see, it shows such strange error: fopen: No such file or directory and, also, when running ecryptfs-mount-private without sudo - it fails.
When mounting folder using ecrypts-recover-private and login password it mounts it in temporary folder like a charm.

Also, we've tried to ecryptfs-rewrap-password and it doesn't work without sudo. So, using sudo ecryptfs-rewrap-password succeeded in rewrapping, but after reboot the same situation persists.

All in all, what could this be; how to fix this auto mount encrypted home directory at login?

In short, user's file wrapped-passphrase had wrong permissions(should be -rw------- user user, were -rw------- root root).

Ran ecryptfs-mount-private command(entered login password) using strace like:

strace -o /tmp/strace.log -e trace=file ecryptfs-mount-private

Contents of /tmp/strace.log:

user@host:~$ sudo strace -o /tmp/strace.log -e trace=file ecryptfs-mount-private

[sudo] password for user:

Enter your login passphrase:

Inserted auth tok with sig [3ab5cd8e5f8c5acb] into the user session keyring

fopen: No such file or directory

user@host:~$ cat /tmp/strace.log

execve("/usr/bin/ecryptfs-mount-private", ["ecryptfs-mount-private"], [/* 13 vars */]) = 0

access("/etc/ld.so.nohwcap", F_OK)      = -1 ENOENT (No such file or directory)

access("/etc/ld.so.preload", R_OK)      = -1 ENOENT (No such file or directory)

open("/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3

access("/etc/ld.so.nohwcap", F_OK)      = -1 ENOENT (No such file or directory)

open("/lib/x86_64-linux-gnu/libc.so.6", O_RDONLY|O_CLOEXEC) = 3

getcwd("/home/user", 4096)                = 9

open("/usr/bin/ecryptfs-mount-private", O_RDONLY) = 3

--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=3872, si_uid=0, si_status=0, si_utime=0, si_stime=0} ---

stat("/home/user/.ecryptfs/wrapping-independent", 0x7fff65e61c30) = -1 ENOENT (No such file or directory)

open("/dev/null", O_WRONLY|O_CREAT|O_TRUNC, 0666) = 3

--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=3873, si_uid=0, si_status=1, si_utime=0, si_stime=0} ---

stat("/home/user/.ecryptfs/wrapped-passphrase", {st_mode=S_IFREG|0600, st_size=58, ...}) = 0

stat("/home/user/.ecryptfs/Private.sig", {st_mode=S_IFREG|0600, st_size=34, ...}) = 0

--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=3874, si_uid=0, si_status=0, si_utime=0, si_stime=0} ---

stat("/usr/local/sbin/stty", 0x7fff65e61c40) = -1 ENOENT (No such file or directory)

stat("/usr/local/bin/stty", 0x7fff65e61c40) = -1 ENOENT (No such file or directory)

stat("/usr/sbin/stty", 0x7fff65e61c40)  = -1 ENOENT (No such file or directory)

stat("/usr/bin/stty", 0x7fff65e61c40)   = -1 ENOENT (No such file or directory)

stat("/sbin/stty", 0x7fff65e61c40)      = -1 ENOENT (No such file or directory)

stat("/bin/stty", {st_mode=S_IFREG|0755, st_size=72496, ...}) = 0

--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=3875, si_uid=0, si_status=0, si_utime=0, si_stime=0} ---

--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=3876, si_uid=0, si_status=0, si_utime=0, si_stime=0} ---

--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=3877, si_uid=0, si_status=0, si_utime=0, si_stime=0} ---

--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=3878, si_uid=0, si_status=0, si_utime=0, si_stime=0} ---

--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=3879, si_uid=0, si_status=0, si_utime=0, si_stime=0} ---

--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=3880, si_uid=0, si_status=0, si_utime=68, si_stime=0} ---

--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=3881, si_uid=0, si_status=1, si_utime=0, si_stime=0} ---

+++ exited with 1 +++

So, we see that there's not enough information. Ran the same command(entered login password), but with flag -f to trace child processes and using root's rights:

sudo strace -o /tmp/strace2.log -f -e trace=file ecryptfs-mount-private`

Part of contents of /tmp/strace2.log file:

...

3963  open("/root/.ecryptfsrc", O_RDONLY) = -1 ENOENT (No such file or directory)

3963  open("/home/user/.ecryptfs/wrapped-passphrase", O_RDONLY) = 3

...

3964  open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 3

3964  open("/root/.ecryptfs/Private.mnt", O_RDONLY) = -1 ENOENT (No such file or directory)

3964  open("/dev/shm/ecryptfs-root-Private", O_RDWR|O_CREAT|O_NOFOLLOW, 0600) = 3

3964  open("/root/.ecryptfs/Private.sig", O_RDONLY) = -1 ENOENT (No such file or directory)

3964  +++ exited with 1 +++

3954  --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=3964, si_uid=0, si_status=1, si_utime=0, si_stime=0} ---

3954  +++ exited with 1 +++

As we can see, it can't find a file Private.sig of root; it looks like it should be ran by user who encrypted directory we are trying to recover instead of running in a particular directory.

All in all, I ran this command(entered login password) with user's rights:

strace -o /tmp/strace3.log -f -e trace=file ecryptfs-mount-private`

Part of contents of /tmp/strace3.log file:

...

4137  open("/lib/x86_64-linux-gnu/libnss_nis.so.2", O_RDONLY|O_CLOEXEC) = 3

4137  access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)

4137  open("/lib/x86_64-linux-gnu/libnss_files.so.2", O_RDONLY|O_CLOEXEC) = 3

4137  open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 3

4137  open("/home/user/.ecryptfsrc", O_RDONLY) = -1 ENOENT (No such file or directory)

4137  open("/home/user/.ecryptfs/wrapped-passphrase", O_RDONLY) = -1 EACCES (Permission denied)

4137  open("/etc/localtime", O_RDONLY|O_CLOEXEC) = 3

4137  +++ exited with 1 +++

4112  --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=4137, si_uid=1000, si_status=1, si_utime=0, si_stime=0} ---

...

As we can see now, an ecryptfs-mount-private utility can't access user's wrapped-passphrase file which resulted in Permission denied message.

Checked /home/user/.ecryptfs/wrapped-passphrase file's permissions and they were:

-rw------- 1 root root

Changed owner of this file via sudo chown user:user /home/user/.ecryptfs/wrapped-passphrase to user and reran above (ecryptfs-mount-private) command without strace(entered login password) which resulted in success message:

INFO: Your private directory has been mounted.

INFO: To see this change in your current shell:

  cd: /home/user

I set up an ecryptfs private folder, then removed the r & w permission from the wrapped-passphrase file to test... If you had checked the syslog right after seeing the message

Info: Check the system log for more information from libecryptfs

You would have seen lines like this:

Jan 15 00:21:48 sys ecryptfs-insert-wrapped-passphrase-into-keyring: Failed to detect wrapped passphrase version: Permission denied

Jan 15 00:21:48 sys ecryptfs-insert-wrapped-passphrase-into-keyring: Error attempting to unwrap passphrase from file [/home/user/.ecryptfs/wrapped-passphrase]; rc = [-13]

Together those would be a pretty strong arrow pointing to check the permissions of the ~/.ecryptfs/wrapped-passphrase file. (No sudo or strace required)