[PATCH] rework of ecryptfs home confidential directory setup This patch represents a total rework of the helper script associated with this how-to: * http://ecryptfs.sourceforge.net/ecryptfs-pam-doc.txt
CHANGES:
* src/utils/Makefile.am: Updated makefile, I'm really not sure if I did
this correctly, please review these changes closely. Please feel free
to update this accordingly upon checkin if necessary.
* src/utils/ecryptfs-mount-confidential: Small script extracted from
ecryptfs-setup-pam-wrapped.sh. This is the code that previously was
appended to the user's bash scripts. Instead, create a standalone
script, runnable by any user to do this.
* src/utils/ecryptfs-setup-confidential: This script is the rework of
ecryptfs-setup-pam-wrapped.sh. The changes include:
- header added, with description, history, and at least a Canonical
copyright; Mike can add an IBM one if necessary
- created a usage() function, parameter description updated
accordingly, exits 1
- use consistent indentation (tabs)
- removed all known bashisms, so that this operates in a
posix-compatible shell (eg, dash)
- check for username in /etc/passwd
- look for mount/login password first on the command line, then as an
environment variable, and finally if both are empty, interactively
prompt
- look for /etc/pam.d/system-auth and then /etc/pam.d/common-auth;
this provides support for both RH-based and Debian-based PAM-setups
- collapse the mkdir/chown operations to a single command line
- use mktemp for tempfiles
- strengthen grep regex's
- use chmod/chown --reference when overwriting config files
- rebuild the pam conf file in perhaps a more reliable manner
- add a call to the ecryptfs-mount-confidential script
to .bash_profile
- add an unmount call to .bash_logout
- backup any previous wrapped-passphrase file to a timestamped rename
* src/utils/ecryptfs-setup-pam-wrapped.sh: deleted
TODO:
* There are two BUG's noted in src/utils/ecryptfs-setup-confidential,
where passphrases will be momentarily visible in the process table to
unprivileged users. A viable workaround should be established for
these.
TESTING:
* I've tested this thoroughly under Ubuntu Hardy.
Signed-off-by: Dustin Kirkland <[EMAIL PROTECTED]>
--
:-Dustin
Dustin Kirkland
Ubuntu Server Developer
Canonical, LTD
[EMAIL PROTECTED]
GPG: 1024D/83A61194
diff --git a/src/utils/Makefile.am b/src/utils/Makefile.am
index 624e5fb..572304f 100644
--- a/src/utils/Makefile.am
+++ b/src/utils/Makefile.am
@@ -5,7 +5,9 @@ bin_PROGRAMS=ecryptfs-manager ecryptfs-wrap-passphrase \
ecryptfs-insert-wrapped-passphrase-into-keyring \
ecryptfs-rewrap-passphrase \
ecryptfs-add-passphrase ecryptfs-zombie-kill \
- ecryptfs-zombie-list
+ ecryptfs-zombie-list \
+ ecryptfs-setup-confidential \
+ ecryptfs-mount-confidential
noinst_PROGRAMS=test
TESTS=test
diff --git a/src/utils/ecryptfs-mount-confidential
b/src/utils/ecryptfs-mount-confidential
new file mode 100755
index 0000000..16f2034
--- /dev/null
+++ b/src/utils/ecryptfs-mount-confidential
@@ -0,0 +1,14 @@
+#!/bin/sh
+# This script mounts a user's ~/Confidential ecryptfs folder
+#
+# Original by Michael Halcrow, IBM
+# Extracted to a stand-alone script by Dustin Kirkland <[EMAIL PROTECTED]>
+
+
+if [ -f $HOME/.ecryptfs/auto-mount ]; then
+ if ! mount | grep "$HOME/Confidential type ecryptfs"; then
+ mount -i $HOME/Confidential
+ fi
+fi
+
+ecryptfs-zombie-kill
diff --git a/src/utils/ecryptfs-setup-confidential
b/src/utils/ecryptfs-setup-confidential
new file mode 100755
index 0000000..7133509
--- /dev/null
+++ b/src/utils/ecryptfs-setup-confidential
@@ -0,0 +1,146 @@
+#!/bin/sh
+# This script sets up an ecryptfs mount in a user's ~/Confidential, configures
+# fstab, pam, and bash to attach and wrap on login.
+#
+# Originally ecryptfs-setup-pam-wrapped.sh by Michael Halcrow, IBM
+#
+# Ported for use on Ubuntu by Dustin Kirkland <[EMAIL PROTECTED]>
+# Copyright (C) 2008 Canonical Ltd.
+
+usage() {
+ echo
+ echo "Usage:"
+ echo "# $0 USERNAME [MOUNT-PASSPHRASE] [LOGIN-PASSPHRASE]"
+ echo
+ echo " Special characters are not allowed in the USERNAME."
+ echo
+ echo " Be sure to properly escape your parameters according to your"
+ echo " shell's special character nuances, and also surround the"
+ echo " parameters by double quotes, if necessary."
+ echo
+ echo " If you want to avoid MOUNT-PASSPHRASE and/or LOGIN-PASSPHRASE"
+ echo " from being logged in your shell history, you may either:"
+ echo " 1) export the environment variables MOUNTPASS and LOGINPASS"
+ echo " 2) leave empty and you will be interactively prompted"
+ echo " BEWARE: They will, however, be displayed on STDOUT, so be"
+ echo " wary of shoulder surfers."
+ echo
+ exit 1
+}
+
+if ! whoami | grep "^root$" >/dev/null ; then
+ echo "ERROR: Please run this script as root"
+ exit 1
+fi
+
+USERNAME="$1"
+
+if [ -z "$USERNAME" ]; then
+ echo "ERROR: Must provide a username"
+ usage
+else
+ if ! grep "^$USERNAME:" /etc/passwd >/dev/null; then
+ echo "ERROR: User [$USERNAME] does not exist"
+ exit 1
+ fi
+fi
+
+if [ -z "$MOUNTPASS" ]; then
+ if [ -z "$2" ]; then
+ read -p "Enter your mount passphrase: " -r MOUNTPASS
+ if [ -z "$MOUNTPASS" ]; then
+ echo "ERROR: You must provide a mount passphrase"
+ usage
+ fi
+ else
+ MOUNTPASS="$2"
+ fi
+fi
+
+if [ -z "$LOGINPASS" ]; then
+ if [ -z "$2" ]; then
+ read -p "Enter your login passphrase: " -r LOGINPASS
+ if [ -z "$LOGINPASS" ]; then
+ echo "ERROR: You must provide the login passphrase"
+ usage
+ fi
+ else
+ LOGINPASS="$3"
+ fi
+fi
+
+if [ -f "/etc/pam.d/system-auth" ]; then
+ PAM_CONF=/etc/pam.d/system-auth
+elif [ -f "/etc/pam.d/common-auth" ]; then
+ PAM_CONF=/etc/pam.d/common-auth
+else
+ echo "ERROR: Cannot determine location of PAM system/common auth
configuration"
+ exit 1
+fi
+
+echo "Using username [$USERNAME]"
+echo "Using mount passphrase [$MOUNTPASS]"
+echo "Using login passphrase [$LOGINPASS]"
+echo "Using pam configuration file [$PAM_CONF]"
+echo
+echo "This script will attempt to set up your system to mount"
+echo "/home/$USERNAME/Confidential with eCryptfs automatically on login,"
+echo "using your login passphrase."
+echo
+
+# Setup confidential directory in home
+modprobe ecryptfs
+mkdir -m 700 -p /home/$USERNAME/Confidential
+chown $USERNAME:$USERNAME /home/$USERNAME/Confidential
+
+# Prune out of fstab, and check for an active mount
+tmpfile=`mktemp`
+grep -v "\/home\/$USERNAME\/Confidential.*,ecryptfs_sig=.*" /etc/fstab >
$tmpfile
+chmod --reference /etc/fstab $tmpfile
+chown --reference /etc/fstab $tmpfile
+mv -f $tmpfile /etc/fstab
+umount /home/$USERNAME/Confidential
+if mount | grep "/home/$USERNAME/Confidential type ecryptfs"; then
+ echo "ERROR: /home/$USERNAME/Confidential still mounted after umount"
+ exit 1
+fi
+
+# Setup /etc/fstab
+# BUG: passwd will be momentarily visible in "ps -ef" output
+mount -t ecryptfs /home/$USERNAME/Confidential /home/$USERNAME/Confidential -o
key=passphrase:passwd="$MOUNTPASS",ecryptfs_cipher=aes,ecryptfs_key_bytes=16,ecryptfs_passthrough=n,no_sig_cache
+grep ecryptfs_sig /etc/mtab | sed
's/ecryptfs_cipher\=aes,ecryptfs_key_bytes\=16/ecryptfs_cipher\=aes,ecryptfs_key_bytes\=16,user,noauto,/'
>> /etc/fstab
+umount /home/$USERNAME/Confidential
+
+# Setup PAM
+tmpfile1=`mktemp`
+grep -v "pam_ecryptfs.so" $PAM_CONF > $tmpfile1
+tmpfile2=`mktemp`
+grep -B 100000 "auth\s.*pam_unix.so" $tmpfile1 | grep -v "auth\s.*pam_unix.so"
> $tmpfile2
+echo "password required pam_ecryptfs.so" >> $tmpfile2
+grep "auth\s.*pam_unix.so" $PAM_CONF >> $tmpfile2
+echo "auth required pam_ecryptfs.so unwrap" >> $tmpfile2
+grep -A 100000 "auth\s.*pam_unix.so" $tmpfile1 | grep -v "auth\s.*pam_unix.so"
>> $tmpfile2
+rm -f $tmpfile1
+chmod --reference $PAM_CONF $tmpfile2
+chown --reference $PAM_CONF $tmpfile2
+mv -f $tmpfile2 $PAM_CONF
+
+# Setup bash profile and home dir
+if ! grep "ecryptfs-mount-confidential" /home/$USERNAME/.bash_profile
>/dev/null; then
+ echo "ecryptfs-mount-confidential" >> /home/$USERNAME/.bash_profile
+ chown $USERNAME:$USERNAME /home/$USERNAME/.bash_profile
+fi
+if ! grep "umount.*/home/$USERNAME/Confidential" /home/$USERNAME/.bash_logout
>/dev/null; then
+ echo "umount -l /home/$USERNAME/Confidential" >>
/home/$USERNAME/.bash_logout
+ chown $USERNAME:$USERNAME /home/$USERNAME/.bash_logout
+fi
+mkdir -m 700 /home/$USERNAME/.ecryptfs
+chown $USERNAME:$USERNAME /home/$USERNAME/.ecryptfs
+touch /home/$USERNAME/.ecryptfs/auto-mount
+chown $USERNAME:$USERNAME /home/$USERNAME/.ecryptfs/auto-mount
+timestamp=`date +%Y%m%d%H%M%S`
+mv -f /home/$USERNAME/.ecryptfs/wrapped-passphrase
/home/$USERNAME/.ecryptfs/wrapped-passphrase.$timestamp
+# BUG: passphrases will be momentarily visible in "ps -ef" output
+/usr/bin/ecryptfs-wrap-passphrase /home/$USERNAME/.ecryptfs/wrapped-passphrase
"$MOUNTPASS" "$LOGINPASS"
+chmod 600 /home/$USERNAME/.ecryptfs/wrapped-passphrase
+chown $USERNAME:$USERNAME /home/$USERNAME/.ecryptfs/wrapped-passphrase
diff --git a/src/utils/ecryptfs-setup-pam-wrapped.sh
b/src/utils/ecryptfs-setup-pam-wrapped.sh
deleted file mode 100755
index db87c7c..0000000
--- a/src/utils/ecryptfs-setup-pam-wrapped.sh
+++ /dev/null
@@ -1,92 +0,0 @@
-#!/bin/sh
-
-echo
-echo "You must run this script as root. Do not use sudo; either log in"
-echo "as root or use 'su -'"
-echo
-echo "This script applies to Open Client systems only with the
IBM-security-compliance RPM installed"
-echo
-
-whoami | grep "^root$" &> /dev/null
-if test $? == 1; then
- echo "Please run this script as root"
- echo
- exit
-fi
-
-echo "USAGE:"
-echo " # ecryptfs-setup-pam-wrapped.sh [username] [mount passphrase] [wrapping
passphrase]"
-echo
-echo "Be sure to properly escape your parameters according to your shell's
special character nuances, and also surround the parameters by double quotes,
if need be."
-echo
-echo "No special characters allowed in the username."
-echo
-
-if test "x$1" == "x"; then
- echo "Must provide a username"
- echo
- exit
-fi
-
-if test "x$2" == "x"; then
- echo "Must provide a mount passphrase"
- echo
- exit
-fi
-
-if test "x$3" == "x"; then
- echo "Must provide a wrapping passphrase"
- echo
- exit
-fi
-
-echo "Using username [$1]"
-echo "Using mount passphrase [$2]"
-echo "Using wrapping passphrase [$3]"
-echo
-echo "This script will attempt to set up your system to mount eCryptfs"
-echo "automatically on login, using your login passphrase."
-echo
-
-modprobe ecryptfs
-mkdir /home/$1/Confidential
-chown $1:$1 /home/$1/Confidential
-chmod 700 /home/$1/Confidential
-grep -v "ecryptfs_sig" /etc/fstab > /tmp/fstab
-mv -f /tmp/fstab /etc/fstab
-umount /home/$1/Confidential
-mount | grep "/home/$1/Confidential type ecryptfs"
-if test $? == 0; then
- echo "ERROR: /home/$1/Confidential still mounted after umount; cannot
continue with setup"
- exit 1
-fi
-mount -t ecryptfs /home/$1/Confidential /home/$1/Confidential -o
key=passphrase:passwd="$2",cipher=aes,ecryptfs_key_bytes=16,passthrough=n,no_sig_cache
-grep ecryptfs_sig /etc/mtab | sed
's/ecryptfs_cipher\=aes,ecryptfs_key_bytes\=16/ecryptfs_cipher\=aes,ecryptfs_key_bytes\=16,user,noauto,/'
>> /etc/fstab
-umount /home/$1/Confidential
-cp -f /etc/pam.d/system-auth /etc/pam.d/.system-auth-before-pam_ecryptfs
-grep -v "pam_ecryptfs" /etc/pam.d/system-auth > /tmp/system-auth
-mv -f /tmp/system-auth /etc/pam.d/system-auth
-grep -v "auth.*pam_deny" /etc/pam.d/system-auth > /tmp/system-auth
-mv -f /tmp/system-auth /etc/pam.d/system-auth
-cat /etc/pam.d/system-auth | sed 's/auth.*pam_unix\.so\(.*\)/auth required
pam_unix.so\1\nauth required pam_ecryptfs.so unwrap/' > /tmp/system-auth
-mv -f /tmp/system-auth /etc/pam.d/system-auth
-cat /etc/pam.d/system-auth | sed
's/password\s*sufficient\s*pam_unix\.so\(.*\)/password required
pam_ecryptfs.so\npassword sufficient pam_unix.so\1/' > /tmp/system-auth
-mv -f /tmp/system-auth /etc/pam.d/system-auth
-grep "Confidential type ecryptfs" /home/$1/.bash_profile
-if test $? != 0; then
- cp -f /home/$1/.bash_profile /home/$1/.bash_profile-before-pam_ecryptfs
- echo "if test -e \$HOME/.ecryptfs/auto-mount; then" >>
/home/$1/.bash_profile
- echo " mount | grep \"\$HOME/Confidential type ecryptfs\"" >>
/home/$1/.bash_profile
- echo " if test \$? != 0; then" >> /home/$1/.bash_profile
- echo " mount -i \$HOME/Confidential" >> /home/$1/.bash_profile
- echo " fi" >> /home/$1/.bash_profile
- echo "fi" >> /home/$1/.bash_profile
- echo "ecryptfs-zombie-kill" >> /home/$1/.bash_profile
-fi
-mkdir -p /home/$1/.ecryptfs
-chown $1:$1 /home/$1/.ecryptfs
-touch /home/$1/.ecryptfs/auto-mount
-chown $1:$1 /home/$1/.ecryptfs/auto-mount
-rm -f /home/$1/.ecryptfs/wrapped-passphrase
-/usr/bin/ecryptfs-wrap-passphrase /home/$1/.ecryptfs/wrapped-passphrase "$2"
"$3"
-chown $1:$1 /home/$1/.ecryptfs/wrapped-passphrase
diff --git a/src/utils/Makefile.am b/src/utils/Makefile.am
index 624e5fb..572304f 100644
--- a/src/utils/Makefile.am
+++ b/src/utils/Makefile.am
@@ -5,7 +5,9 @@ bin_PROGRAMS=ecryptfs-manager ecryptfs-wrap-passphrase \
ecryptfs-insert-wrapped-passphrase-into-keyring \
ecryptfs-rewrap-passphrase \
ecryptfs-add-passphrase ecryptfs-zombie-kill \
- ecryptfs-zombie-list
+ ecryptfs-zombie-list \
+ ecryptfs-setup-confidential \
+ ecryptfs-mount-confidential
noinst_PROGRAMS=test
TESTS=test
diff --git a/src/utils/ecryptfs-mount-confidential b/src/utils/ecryptfs-mount-confidential
new file mode 100755
index 0000000..16f2034
--- /dev/null
+++ b/src/utils/ecryptfs-mount-confidential
@@ -0,0 +1,14 @@
+#!/bin/sh
+# This script mounts a user's ~/Confidential ecryptfs folder
+#
+# Original by Michael Halcrow, IBM
+# Extracted to a stand-alone script by Dustin Kirkland <[EMAIL PROTECTED]>
+
+
+if [ -f $HOME/.ecryptfs/auto-mount ]; then
+ if ! mount | grep "$HOME/Confidential type ecryptfs"; then
+ mount -i $HOME/Confidential
+ fi
+fi
+
+ecryptfs-zombie-kill
diff --git a/src/utils/ecryptfs-setup-confidential b/src/utils/ecryptfs-setup-confidential
new file mode 100755
index 0000000..7133509
--- /dev/null
+++ b/src/utils/ecryptfs-setup-confidential
@@ -0,0 +1,146 @@
+#!/bin/sh
+# This script sets up an ecryptfs mount in a user's ~/Confidential, configures
+# fstab, pam, and bash to attach and wrap on login.
+#
+# Originally ecryptfs-setup-pam-wrapped.sh by Michael Halcrow, IBM
+#
+# Ported for use on Ubuntu by Dustin Kirkland <[EMAIL PROTECTED]>
+# Copyright (C) 2008 Canonical Ltd.
+
+usage() {
+ echo
+ echo "Usage:"
+ echo "# $0 USERNAME [MOUNT-PASSPHRASE] [LOGIN-PASSPHRASE]"
+ echo
+ echo " Special characters are not allowed in the USERNAME."
+ echo
+ echo " Be sure to properly escape your parameters according to your"
+ echo " shell's special character nuances, and also surround the"
+ echo " parameters by double quotes, if necessary."
+ echo
+ echo " If you want to avoid MOUNT-PASSPHRASE and/or LOGIN-PASSPHRASE"
+ echo " from being logged in your shell history, you may either:"
+ echo " 1) export the environment variables MOUNTPASS and LOGINPASS"
+ echo " 2) leave empty and you will be interactively prompted"
+ echo " BEWARE: They will, however, be displayed on STDOUT, so be"
+ echo " wary of shoulder surfers."
+ echo
+ exit 1
+}
+
+if ! whoami | grep "^root$" >/dev/null ; then
+ echo "ERROR: Please run this script as root"
+ exit 1
+fi
+
+USERNAME="$1"
+
+if [ -z "$USERNAME" ]; then
+ echo "ERROR: Must provide a username"
+ usage
+else
+ if ! grep "^$USERNAME:" /etc/passwd >/dev/null; then
+ echo "ERROR: User [$USERNAME] does not exist"
+ exit 1
+ fi
+fi
+
+if [ -z "$MOUNTPASS" ]; then
+ if [ -z "$2" ]; then
+ read -p "Enter your mount passphrase: " -r MOUNTPASS
+ if [ -z "$MOUNTPASS" ]; then
+ echo "ERROR: You must provide a mount passphrase"
+ usage
+ fi
+ else
+ MOUNTPASS="$2"
+ fi
+fi
+
+if [ -z "$LOGINPASS" ]; then
+ if [ -z "$2" ]; then
+ read -p "Enter your login passphrase: " -r LOGINPASS
+ if [ -z "$LOGINPASS" ]; then
+ echo "ERROR: You must provide the login passphrase"
+ usage
+ fi
+ else
+ LOGINPASS="$3"
+ fi
+fi
+
+if [ -f "/etc/pam.d/system-auth" ]; then
+ PAM_CONF=/etc/pam.d/system-auth
+elif [ -f "/etc/pam.d/common-auth" ]; then
+ PAM_CONF=/etc/pam.d/common-auth
+else
+ echo "ERROR: Cannot determine location of PAM system/common auth configuration"
+ exit 1
+fi
+
+echo "Using username [$USERNAME]"
+echo "Using mount passphrase [$MOUNTPASS]"
+echo "Using login passphrase [$LOGINPASS]"
+echo "Using pam configuration file [$PAM_CONF]"
+echo
+echo "This script will attempt to set up your system to mount"
+echo "/home/$USERNAME/Confidential with eCryptfs automatically on login,"
+echo "using your login passphrase."
+echo
+
+# Setup confidential directory in home
+modprobe ecryptfs
+mkdir -m 700 -p /home/$USERNAME/Confidential
+chown $USERNAME:$USERNAME /home/$USERNAME/Confidential
+
+# Prune out of fstab, and check for an active mount
+tmpfile=`mktemp`
+grep -v "\/home\/$USERNAME\/Confidential.*,ecryptfs_sig=.*" /etc/fstab > $tmpfile
+chmod --reference /etc/fstab $tmpfile
+chown --reference /etc/fstab $tmpfile
+mv -f $tmpfile /etc/fstab
+umount /home/$USERNAME/Confidential
+if mount | grep "/home/$USERNAME/Confidential type ecryptfs"; then
+ echo "ERROR: /home/$USERNAME/Confidential still mounted after umount"
+ exit 1
+fi
+
+# Setup /etc/fstab
+# BUG: passwd will be momentarily visible in "ps -ef" output
+mount -t ecryptfs /home/$USERNAME/Confidential /home/$USERNAME/Confidential -o key=passphrase:passwd="$MOUNTPASS",ecryptfs_cipher=aes,ecryptfs_key_bytes=16,ecryptfs_passthrough=n,no_sig_cache
+grep ecryptfs_sig /etc/mtab | sed 's/ecryptfs_cipher\=aes,ecryptfs_key_bytes\=16/ecryptfs_cipher\=aes,ecryptfs_key_bytes\=16,user,noauto,/' >> /etc/fstab
+umount /home/$USERNAME/Confidential
+
+# Setup PAM
+tmpfile1=`mktemp`
+grep -v "pam_ecryptfs.so" $PAM_CONF > $tmpfile1
+tmpfile2=`mktemp`
+grep -B 100000 "auth\s.*pam_unix.so" $tmpfile1 | grep -v "auth\s.*pam_unix.so" > $tmpfile2
+echo "password required pam_ecryptfs.so" >> $tmpfile2
+grep "auth\s.*pam_unix.so" $PAM_CONF >> $tmpfile2
+echo "auth required pam_ecryptfs.so unwrap" >> $tmpfile2
+grep -A 100000 "auth\s.*pam_unix.so" $tmpfile1 | grep -v "auth\s.*pam_unix.so" >> $tmpfile2
+rm -f $tmpfile1
+chmod --reference $PAM_CONF $tmpfile2
+chown --reference $PAM_CONF $tmpfile2
+mv -f $tmpfile2 $PAM_CONF
+
+# Setup bash profile and home dir
+if ! grep "ecryptfs-mount-confidential" /home/$USERNAME/.bash_profile >/dev/null; then
+ echo "ecryptfs-mount-confidential" >> /home/$USERNAME/.bash_profile
+ chown $USERNAME:$USERNAME /home/$USERNAME/.bash_profile
+fi
+if ! grep "umount.*/home/$USERNAME/Confidential" /home/$USERNAME/.bash_logout >/dev/null; then
+ echo "umount -l /home/$USERNAME/Confidential" >> /home/$USERNAME/.bash_logout
+ chown $USERNAME:$USERNAME /home/$USERNAME/.bash_logout
+fi
+mkdir -m 700 /home/$USERNAME/.ecryptfs
+chown $USERNAME:$USERNAME /home/$USERNAME/.ecryptfs
+touch /home/$USERNAME/.ecryptfs/auto-mount
+chown $USERNAME:$USERNAME /home/$USERNAME/.ecryptfs/auto-mount
+timestamp=`date +%Y%m%d%H%M%S`
+mv -f /home/$USERNAME/.ecryptfs/wrapped-passphrase /home/$USERNAME/.ecryptfs/wrapped-passphrase.$timestamp
+# BUG: passphrases will be momentarily visible in "ps -ef" output
+/usr/bin/ecryptfs-wrap-passphrase /home/$USERNAME/.ecryptfs/wrapped-passphrase "$MOUNTPASS" "$LOGINPASS"
+chmod 600 /home/$USERNAME/.ecryptfs/wrapped-passphrase
+chown $USERNAME:$USERNAME /home/$USERNAME/.ecryptfs/wrapped-passphrase
diff --git a/src/utils/ecryptfs-setup-pam-wrapped.sh b/src/utils/ecryptfs-setup-pam-wrapped.sh
deleted file mode 100755
index db87c7c..0000000
--- a/src/utils/ecryptfs-setup-pam-wrapped.sh
+++ /dev/null
@@ -1,92 +0,0 @@
-#!/bin/sh
-
-echo
-echo "You must run this script as root. Do not use sudo; either log in"
-echo "as root or use 'su -'"
-echo
-echo "This script applies to Open Client systems only with the IBM-security-compliance RPM installed"
-echo
-
-whoami | grep "^root$" &> /dev/null
-if test $? == 1; then
- echo "Please run this script as root"
- echo
- exit
-fi
-
-echo "USAGE:"
-echo " # ecryptfs-setup-pam-wrapped.sh [username] [mount passphrase] [wrapping passphrase]"
-echo
-echo "Be sure to properly escape your parameters according to your shell's special character nuances, and also surround the parameters by double quotes, if need be."
-echo
-echo "No special characters allowed in the username."
-echo
-
-if test "x$1" == "x"; then
- echo "Must provide a username"
- echo
- exit
-fi
-
-if test "x$2" == "x"; then
- echo "Must provide a mount passphrase"
- echo
- exit
-fi
-
-if test "x$3" == "x"; then
- echo "Must provide a wrapping passphrase"
- echo
- exit
-fi
-
-echo "Using username [$1]"
-echo "Using mount passphrase [$2]"
-echo "Using wrapping passphrase [$3]"
-echo
-echo "This script will attempt to set up your system to mount eCryptfs"
-echo "automatically on login, using your login passphrase."
-echo
-
-modprobe ecryptfs
-mkdir /home/$1/Confidential
-chown $1:$1 /home/$1/Confidential
-chmod 700 /home/$1/Confidential
-grep -v "ecryptfs_sig" /etc/fstab > /tmp/fstab
-mv -f /tmp/fstab /etc/fstab
-umount /home/$1/Confidential
-mount | grep "/home/$1/Confidential type ecryptfs"
-if test $? == 0; then
- echo "ERROR: /home/$1/Confidential still mounted after umount; cannot continue with setup"
- exit 1
-fi
-mount -t ecryptfs /home/$1/Confidential /home/$1/Confidential -o key=passphrase:passwd="$2",cipher=aes,ecryptfs_key_bytes=16,passthrough=n,no_sig_cache
-grep ecryptfs_sig /etc/mtab | sed 's/ecryptfs_cipher\=aes,ecryptfs_key_bytes\=16/ecryptfs_cipher\=aes,ecryptfs_key_bytes\=16,user,noauto,/' >> /etc/fstab
-umount /home/$1/Confidential
-cp -f /etc/pam.d/system-auth /etc/pam.d/.system-auth-before-pam_ecryptfs
-grep -v "pam_ecryptfs" /etc/pam.d/system-auth > /tmp/system-auth
-mv -f /tmp/system-auth /etc/pam.d/system-auth
-grep -v "auth.*pam_deny" /etc/pam.d/system-auth > /tmp/system-auth
-mv -f /tmp/system-auth /etc/pam.d/system-auth
-cat /etc/pam.d/system-auth | sed 's/auth.*pam_unix\.so\(.*\)/auth required pam_unix.so\1\nauth required pam_ecryptfs.so unwrap/' > /tmp/system-auth
-mv -f /tmp/system-auth /etc/pam.d/system-auth
-cat /etc/pam.d/system-auth | sed 's/password\s*sufficient\s*pam_unix\.so\(.*\)/password required pam_ecryptfs.so\npassword sufficient pam_unix.so\1/' > /tmp/system-auth
-mv -f /tmp/system-auth /etc/pam.d/system-auth
-grep "Confidential type ecryptfs" /home/$1/.bash_profile
-if test $? != 0; then
- cp -f /home/$1/.bash_profile /home/$1/.bash_profile-before-pam_ecryptfs
- echo "if test -e \$HOME/.ecryptfs/auto-mount; then" >> /home/$1/.bash_profile
- echo " mount | grep \"\$HOME/Confidential type ecryptfs\"" >> /home/$1/.bash_profile
- echo " if test \$? != 0; then" >> /home/$1/.bash_profile
- echo " mount -i \$HOME/Confidential" >> /home/$1/.bash_profile
- echo " fi" >> /home/$1/.bash_profile
- echo "fi" >> /home/$1/.bash_profile
- echo "ecryptfs-zombie-kill" >> /home/$1/.bash_profile
-fi
-mkdir -p /home/$1/.ecryptfs
-chown $1:$1 /home/$1/.ecryptfs
-touch /home/$1/.ecryptfs/auto-mount
-chown $1:$1 /home/$1/.ecryptfs/auto-mount
-rm -f /home/$1/.ecryptfs/wrapped-passphrase
-/usr/bin/ecryptfs-wrap-passphrase /home/$1/.ecryptfs/wrapped-passphrase "$2" "$3"
-chown $1:$1 /home/$1/.ecryptfs/wrapped-passphrase
signature.asc
Description: This is a digitally signed message part
------------------------------------------------------------------------- This SF.net email is sponsored by the 2008 JavaOne(SM) Conference Don't miss this year's exciting event. There's still time to save $100. Use priority code J8TL2D2. http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone
_______________________________________________ eCryptfs-devel mailing list eCryptfs-devel@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/ecryptfs-devel
