passphrase do not get rewrapped when changing password on NixOS

[obadz]

I'm the ecryptfs package maintener for NixOS. eCryptfs, in general, works fine on NixOS, however passphrases do not get rewrapped when changing password:

Here's what I see in the log

[Invoke passwd command, haven't typed anything yet]
Aug 19 10:12:24 hostname passwd[16250]: pam_ecryptfs: PAM passphrase change module retrieved a NULL passphrase; nothing to do
[Type current password]
Aug 19 10:13:09 hostname passwd[16250]: pam_ecryptfs: Passphrase file wrapped
Aug 19 10:13:09 hostname passwd[16250]: pam_ecryptfs: PAM passphrase change module retrieved at least one NULL passphrase; nothing to do
[Type new password twice]
Aug 19 10:13:45 hostname passwd[16250]: pam_unix(passwd:chauthtok): password changed for obadz

Here's the relevant PAM config file:

$ grep ^password /etc/pam.d/passwd
password optional /nix/store/j0cz5hwb6j6jm5xz2p1w683nbjv8fmj7-ecryptfs-108/lib/security/pam_ecryptfs.so
password requisite pam_unix.so nullok sha512

If that helps, here's the ecryptfs package file for NixOS:

https://github.com/NixOS/nixpkgs/blob/master/pkgs/tools/security/ecryptfs/default.nix

and these files contain the pam entries:

https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/x11/display-managers/gdm.nix#L108
https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/security/pam.nix#L254

This problem also existed on the last couple of eCryptfs versions.

Help appreciated.

[obadz (obadz)]

I've actually gotten to the bottom of this. I had two issues:

1) I moved the password optional ecryptfs.so line BELOW the pam_unix.so line (despite what https://wiki.archlinux.org/index.php/ECryptfs says)

2) I realized that the password rewrapper looks for the wrapped-passphrase in /home/user/.ecryptfs rather than /home/.ecryptfs/user/.ecryptfs -- when I made the former a symlink to the latter, rewrapping started working.

[Dirk Haar (mideal.de)]

@obadz:
How did you manage this?

Trying to change the wrapping password
always returns in

Error: Unwrapping passphrase failed [-5]

or as syslog says

ecryptfs-rewrap-passphrase: Incorrect wrapping key for file [/home/.ecryptfs/dirk/.ecryptfs/wrapped-passphrase]

In my /home/$USER (Mint 18.3 64bit Cinnamon) there is ready a link to
/home/.ecryptfs/$USER/.ecryptfs.