ecryptfs-setup-private

encrypted private directory setup

TLDR

Setup encrypted private directory

$ ecryptfs-setup-private

Setup with wrapped passphrase

$ ecryptfs-setup-private --wrapping

Setup without wrapped passphrase

$ ecryptfs-setup-private --noautomount

Force setup (overwrite existing)

$ ecryptfs-setup-private --force

ecryptfs-setup-private creates an encrypted private directory for a user. It sets up ~/Private as an encrypted folder that is automatically mounted when the user logs in and unmounted on logout.The setup creates the necessary encryption keys and wrapper, storing them in ~/.ecryptfs. The mount passphrase is wrapped with the login password, enabling automatic decryption on login.

PARAMETERS

--wrapping

Use login passphrase for wrapping.

--noautomount

Don't configure automount on login.

--nopwcheck

Don't verify login password.

--force

Overwrite existing configuration.

-u, --username name

Specify username (for root use).

-l, --loginpass pass

Login passphrase (insecure, for scripting).

-m, --mountpass pass

Mount passphrase (insecure, for scripting).

CONFIGURATION

~/.ecryptfs/

Directory containing encryption keys, wrapped passphrases, and mount configuration.

~/.ecryptfs/wrapped-passphrase

Mount passphrase wrapped with login password for automatic decryption.

SETUP PROCESS

1. Prompts for login password2. Generates random mount passphrase3. Wraps mount passphrase with login password4. Creates ~/.Private (encrypted) and ~/Private (mount point)5. Configures PAM for auto-mount

INSTALL

sudo apt install ecryptfs-utils

sudo dnf install ecryptfs-utils

sudo pacman -S ecryptfs-utils

sudo apk add ecryptfs-utils

sudo zypper install ecryptfs-utils

CAVEATS

Requires eCryptfs kernel module. Swap should be encrypted for security. Login password changes require rewrapping. Recovery requires unwrapped passphrase. Deprecated in favor of fscrypt on modern systems.

HISTORY

This utility was developed for Ubuntu's encrypted home directory feature. It was widely used for per-user encryption from Ubuntu 8.10 through 18.04, after which fscrypt became the recommended solution.