[Bug 1406940] Re: ecryptfs does not work for domain users (AD, likewise/powerbroker)

Steve Langasek steve.langasek at canonical.com
Thu Aug 13 17:25:04 UTC 2015


nack for the pam changes.

 - Dynamic home directory creation is not specific to ecryptfs and should not be part of an encryptfs-specific pam config; there is an existing mkhomedir profile to use for this.
 - The /etc/security/ecryptfs script is not very reusable, it encodes your local policy preference to enable ecryptfs for all users logging in.  It's also insecure, at a minimum because you are passing passwords to a program as commandline arguments, which are visible to all other users on the system.

-- 
You received this bug notification because you are a member of Ubuntu
Sponsors Team, which is subscribed to the bug report.
https://bugs.launchpad.net/bugs/1406940

Title:
  ecryptfs does not work for domain users (AD, likewise/powerbroker)

Status in ecryptfs-utils package in Ubuntu:
  Triaged

Bug description:
  Ecryptfs encryption does not work for domain users in an active
  directory domain, integrated with likewise open / powerbroker for the
  following reasons:

  - domain user names contain backslashes (DOMAIN\user.name). Ecryptfs checks for valid usernames, which mustn't contain backslashes
  - There is no pam hook which automatically activates encryption of the home directory of new domain users

  
  Steps to reproduce:
  - Set up AD controller, e.g. via samba4
  - Set up ecryptfs-utils on an ubuntu machine
  - Add ubuntu machine to domain with likewise open / powerbroker
  - Login with domain user

  Result:
  - Home directory is unencrypted

  Additional steps:
  - Manually encrypt home directory of domain user

  Additional result:
  - On login decryption fails with message: "Username has unsupported characters"

  
  Expected result:
  Home directories of domain users can easily be encrypted and decrypted with ecryptfs

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/ecryptfs-utils/+bug/1406940/+subscriptions



More information about the Ubuntu-sponsors mailing list