eCryptFS: How to mount a backup of an encrypted home dir?

Question

I use eCryptFS to encrypt the home directory of my laptop. My backup script copies the encrypted files to a server (together with everything else in (home/.ecryptfs).

How can I mount the encrypted files of the backup? I'd like to verify that I can do that, and that everything is in place.

My naive try with

mount -t ecryptfs /backup/home/.ecryptfs/boldewyn /mnt/test

didn't work, eCryptFS wanted to create a new partition.

Answer 1

Assuming you use the Ubuntu standard encryption scheme, with no extra tweaks.

The $HOME/.ecryptfs "folder" is actually just a link.

The true place where your files stay is /home/.ecryptfs/$USER

There are two folders there, .Private (with your files encrypted) and .ecryptfs, with files like auto-mount, auto-umount, Private.mnt, Private.sig, wrapped-passphrase.

Hopefully the target files are copied to your host backup.

If there is no backup of your wraped-passphrased in this server, you're lost. If there is a backup, then your encryption scheme has been weakened by storing your wrapped passphrase over the web, unless you control the host where you make the backup.

I found this script for mounting:

ROOT=/home/.ecryptfs/$USER
TARGET=/mnt/$USER

# ROOT should be the parent of the .ecryptfs and .Private folders

sudo mkdir -p $TARGET
cd $ROOT

echo Type your password:
PASS=$(ecryptfs-unwrap-passphrase .ecryptfs/wrapped-passphrase | sed s/Passphrase:\ //)
SIG1=$(head -n1 .ecryptfs/Private.sig)
SIG2=$(tail -n1 .ecryptfs/Private.sig)

echo Passphrase:
echo $PASS
echo Signatures:
echo $SIG1
echo $SIG2

echo Should be empty:
sudo keyctl clear @u
sudo keyctl list @u

echo Do not type anything:
echo $PASS | sudo ecryptfs-add-passphrase --fnek

echo Sould have signatures:
sudo keyctl list @u

echo Mounting $ROOT on $TARGET...
sudo mount -t ecryptfs -o key=passphrase,ecryptfs_cipher=aes,ecryptfs_key_bytes=16,ecryptfs_passthrough=no,ecryptfs_enable_filename_crypto=yes,ecryptfs_sig=$SIG1,ecryptfs_fnek_sig=$SIG2,passwd=$(echo $PASS) .Private $TARGET

ls $TARGET

unset -v PASS