after ecryptfs-migrate-home, encrypted home will only mount on first login

[Dimitris Kogias]

After being badly bitten by bug #344878, I decided to remove filename encryption from my home directory. I backed up the whole home directory then rm -rf'ed both /home/$USER and /home/.ecryptfs.

I then made a copy of the ecryptfs-migrate-home script and changed the line:

ECRYPTFS_SETUP_PRIVATE_ARGS=""

to

ECRYPTFS_SETUP_PRIVATE_ARGS=" -n "

in order to have it create the encrypted home directory without filename encryption. I did this because simply using ecryptfs-setup-private did not work (possible further bugs, manpage lists -a option that doesn't seem to exist).

Anyway. The new encrypted home directory seemed OK, auto[un]mounting on login/logout.

I then proceeded to rsync back the old contents, taking care to --exclude=.ecryptfs and --exclude=.Private.

The rsync finished without problems. But now I have a new problem:

- reboot the machine.
- log in (console). encrypted $HOME automounts.
- log out.
- log in. encrypted $HOME fails to mount: I get the dreaded "keyctl_search: Required key not available" message.

Needless to say, the combined experience is dreadful for a supposedly LTS version. Is there any way I can restore some sanity to this encrypted home directory, or is it time to throw in the towel?

ProblemType: Bug
DistroRelease: Ubuntu 10.04
Package: ecryptfs-utils 83-0ubuntu3.1
ProcVersionSignature: Ubuntu 2.6.32-32.62-generic 2.6.32.38+drm33.16
Uname: Linux 2.6.32-32-generic x86_64
Architecture: amd64
Date: Tue Jul 5 01:48:25 2011
EcryptfsInUse: Yes
InstallationMedia: Ubuntu 10.04 "Lucid Lynx" - Release Candidate amd64 (20100419.1)
ProcEnviron:
 PATH=(custom, user)
 LANG=en_US.utf8
 SHELL=/bin/bash
SourcePackage: ecryptfs-utils

[Dimitris Kogias (dimitris-k)]

One additional observation:

After the first, successful login, I end up with two keys in the user keyring:

<key1>: --alswrv 1000 0 user: <sig1>
<key2>: --alswrv 1000 0 user: <sig2>

Only key2 (i.e. sig2) matches ~/.ecryptfs/Private.sig.

After logout, key1 is removed from the keyring but key1 is still there.

On subsequent logins, key2 no longer reappears and, presumably that's related to the automount failing.

Now, if I then manually remove (keyctl unlink <key1> @u) the "stuck" key1 and logout, the next (one) login-automount (or manual ecryptfs-mount-private) will succeed.

Is key1 somehow leftover from the previous instance of ecryptfs? If so where is it persisting? Or are these two keys supposed to be there after a successful login/automount?

[Dimitris Kogias (dimitris-k)]

Typo: meant to say:

after logout, key*2* is removed (...)