I recently assembled a new workstation for home and in the process did a clean install of Ubuntu 9.10 on the system. Though I have been working with Ubuntu’s very handy ecryptfs setup for encrypted home directories, I had limited such to laptops and had never done so on a desktop system before. I figured I would give it a try and see what happened.
Performance tests done by others had always shown that there was a slight degradation of speed on ecryptfs encrypted filesystems, which I had fully expected, but I ran into something I hadn’t dealt with on my laptop: directory trees with hundreds of thousands of files.
The difference in speed of accessing individual files a few at a time in ecryptfs was never really noticeable, but I had never tried to stat a tree of 600,000+ files before. It was as if my brand new system was an artifact from the ’70′s. It dropped to its knees and cried.
Not believing how slow it was, I tested the issue by copying the directory tree to an unencrypted filesystem on the same physical hard drive and the same task (running ‘tree’ on the directory structure) took only a few seconds, instead of minutes. It was apparent that any task which had to do a lot of file stat processing, simply dragged to a crawl under ecyptfs.
I was left with the dilemma of how to deal with changing my entire home directory under the ecryptfs system – complete with Ubuntu’s handy automatic mounting – to a standard, unencrypted form. A bit of searching on the Web lead to dozens of approaches, some as drastic as copying the files to an unencrypted filesystem and removing the ecryptfs software. That seemed ludicrous to me. There should be no reason to disable an entire feature globally, to deal with one directory.
I finally came across some handy information on a blog, which gave me a clue as to how the automatic mounting worked in Ubuntu 9.04. Although not exactly the same as the Ubuntu 9.10 implementation, it was more than enough to give me a very simple way to not only remove the encryption from my home directory, but to allow the system to work for me in creating an encrypted directory to use within my home directory, which took advantage of the slick auto-mount setup the Ubuntu developers had designed.
So, should anyone stumble on this issue, I’ll detail the steps taken here on how to alter Ubuntu 9.10 to switch a full home directory encryption to a normal home directory with an auto-mounting encrypted sub-directory. The process is amazingly simple. All text in red are actual commands to type. Green text is a file or directory path. “username” is a token for the name of your account.
- Logoff the system. No occurrences of your user account should be active.
- Login as root or a different sudo enabled account.
- Make sure that your account’s home directory is not mounted, using the ‘df‘ command. If it is still in place, use umount /home/username to un-mount the encrypted filesystem.
- Change the line “/home/username” to “/home/username/Private” in the /home/.ecryptfs/username/.ecryptfs/Private.mnt file using your favorite text editor.
- mkdir /home/username/Private
- chown username.username Private
- Reboot the computer. (You can try restarting the cryptdisks init scripts, but I didn’t have any luck with it.)
When you login now, your previous home directory will be mounted at /home/username/Private instead of at /home/username. Login the first time using a console rather than X11 (Ctrl-Alt-[F1-F6] from the login screen should be available) and move what files you want from ~/Private to your home directory and use the ~/Private encrypted directory for your sensitive documents. Moving your dotfiles and hidden sub-directories back into /home/username is a good idea, unless you feel like re-configuring Gnome or KDE.
From this point on, Ubuntu will continue to automatically mount and dismount your ~/Private directory, just as it did for your entire home directory before.
Addendum: The procedure used above is identical in Ubuntu 10.04 LTS.
