Re: Ecryptfs over sshfs and timestamps

[Tyler Hicks <tyhicks@canonical.com>]

[-- Attachment #1: Type: text/plain, Size: 2196 bytes --]

On 2013-04-24 21:59:05, Ivan Yosifov wrote:
> Sorry, the mail got sent incomplete, resending:
> 
> > Does this happen when only using sshfs (without eCryptfs mounted on
> > top)?
> 
> No, cp --preserve=timestamps to sshfs alone works.
> 
> > Does this happen when only using eCryptfs (mounted locally on top of
> > something like ext4)?
> 
> No, cp --preserve=timestamps to ecryptfs on top of ext4 works too.
> 
> > Nothing like that should be a problem from eCryptfs' standpoint. I have
> > no idea about sshfs.
> 
> Well, the existence of the allow_root and allow_other sshfs options
> suggest it somehow cares.
> 
> > Why didn't adding user,noauto to the fstab entry work for you? What
> > error message did you see? Anything relevant in the system log?
> 
> For example, I just tried with the following line (the key '1' is
> obviously just for testing):
> 
> /home/obelix/evil_host /home/obelix/bak ecryptfs
> user,noauto,verbose,key=passphrase:passphrase_passwd=1 0 0
> 
> I got:
> 
> $ mount ./bak
> Exiting. Unable to obtain passwd info
> 
> I didn't get anything written to /var/log/messages.log or dmesg.
> 
> If I run the mount as root, I get asked for the other parameters and
> in the end it mounts.
> I tried with a more comprehensive fstab line too:
> 
> /home/obelix/evil_host /home/obelix/bak ecryptfs
> user,noauto,ecryptfs_cipher=aes,ecryptfs_key_bytes=16,verbose,key=passphrase:passphrase_passwd=1,ecryptfs_passthrough,ecryptfs_enable_filename_crypto=n
> 0 0
> 
> This mounts as root without asking any questions and fails as user
> with the same error.

It is typically easier to manually perform the mount once, then take
note of the mount options listed in /proc/mounts, add an entry to fstab,
then bypass the eCryptfs mount helper when performing mounts.

So, your fstab entry might look something like this:

/tmp/ecryptfs /tmp/ecryptfs ecryptfs ecryptfs_sig=253ca7e88811d184,ecryptfs_cipher=aes,ecryptfs_key_bytes=16,defaults,users,noauto 0 0

Adjust the ecryptfs_sig= value accordingly.

Now, do a mount that bypasses the eCryptfs mount helper by using the -i
mount option.

$ mount -i /tmp/ecryptfs

Tyler

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 836 bytes --]