Skip to content

Instantly share code, notes, and snippets.

@eschen42

eschen42/ubuntu_ecryptfs_ssh.md

Created March 5, 2019 04:28
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save eschen42/ff16bc4ec951e704cb70747a80b1b41c to your computer and use it in GitHub Desktop.
Save eschen42/ff16bc4ec951e704cb70747a80b1b41c to your computer and use it in GitHub Desktop.
Download ZIP
Public key SSH with eCryptFS home directory
Raw
ubuntu_ecryptfs_ssh.md

Public key SSH with eCryptFS home directory

The goal

I want to SSH into an Ubuntu box with an encrypted home directory, and I prefer using publickey authentication.

The problem posed by an encrypted home

Ubuntu allows you to encrypt your own home directory. If you insist, as I do, that you use publickey authentication for your SSH authentication (which is nearly two-factor authentication as long as you protect your private ID key with a passphrase), this presents a problem: to authenticate, you need your ~/.ssh/authorized_keys file accessible, but when you are not logged in, it is inaccessible.

An ideal solution

The definitive answer https://askubuntu.com/a/116198 seems straightforward: create a ~/.ssh/authorized_keys file that will be visible before your directory is mounted. The trouble is that I cannot figure out how to do that.

A practical solution when you can sudo

As long as you have sudo, you can bypass this issue by adding this line to /etc/ssh/sshd_config

AuthorizedKeysFile	/etc/ssh/authorized_keys.d/%u

and then executing service ssh restart.

Next, put the contents of what you would ordinarily put into ~/.ssh/authorized_keys into /etc/ssh/authorized_keys.d/%u. For instance, my username is art so I put my authorized keys into /etc/ssh/authorized_keys.d/art, then I

chown art:art /etc/ssh/authorized_keys.d/art
chmod 644 /etc/ssh/authorized_keys.d/art
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment