[Bug 1406940] Re: ecryptfs does not work for domain users (AD, likewise/powerbroker)
Steve Langasek
steve.langasek at canonical.com
Thu Aug 13 17:25:04 UTC 2015
nack for the pam changes.
- Dynamic home directory creation is not specific to ecryptfs and should not be part of an encryptfs-specific pam config; there is an existing mkhomedir profile to use for this.
- The /etc/security/ecryptfs script is not very reusable, it encodes your local policy preference to enable ecryptfs for all users logging in. It's also insecure, at a minimum because you are passing passwords to a program as commandline arguments, which are visible to all other users on the system.
--
You received this bug notification because you are a member of Ubuntu
Sponsors Team, which is subscribed to the bug report.
https://bugs.launchpad.net/bugs/1406940
Title:
ecryptfs does not work for domain users (AD, likewise/powerbroker)
Status in ecryptfs-utils package in Ubuntu:
Triaged
Bug description:
Ecryptfs encryption does not work for domain users in an active
directory domain, integrated with likewise open / powerbroker for the
following reasons:
- domain user names contain backslashes (DOMAIN\user.name). Ecryptfs checks for valid usernames, which mustn't contain backslashes
- There is no pam hook which automatically activates encryption of the home directory of new domain users
Steps to reproduce:
- Set up AD controller, e.g. via samba4
- Set up ecryptfs-utils on an ubuntu machine
- Add ubuntu machine to domain with likewise open / powerbroker
- Login with domain user
Result:
- Home directory is unencrypted
Additional steps:
- Manually encrypt home directory of domain user
Additional result:
- On login decryption fails with message: "Username has unsupported characters"
Expected result:
Home directories of domain users can easily be encrypted and decrypted with ecryptfs
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/ecryptfs-utils/+bug/1406940/+subscriptions
More information about the Ubuntu-sponsors
mailing list