mjhjmtu

I have installed Fedora, but used existing /home partition from previous Ubuntu install:

• partitions:
  
  
  • 
    /boot/efi,
  
  
  • 
    / (formatted during install),
  
  
  • 
    /home (kept from Ubuntu),
  
  


• user was set-up with same username and password as I had on Ubuntu install.

After installation, I couldn't login. So, I installed packages ecryptfs-simple.x86_64 and ecryptfs-utils.x86_64.

To successfully login with mounted /home/<username> I have to:

1. login to terminal,


2. run ecryptfs-mount-private,


3. login through gdm.

Direct login through gdm fails.

How can I make gdm to automatically run ecryptfs-mount-private when logging in?

Tested setup on Fedora 27:

1. Find out the UUID of the home partition you're trying to mount: blkid
2. edit /etc/crypttab and add the following line:
my-encrypted-home UUID="<UUID-from-above-command>" none luks
3. edit /etc/fstab and comment out the previous home entry and add the following:
/dev/mapper/my-encrypted-home /home ext4 defaults 1 2

Reboot, carefully. Plymouth will prompt you for your password. If you get stuck at boot, reboot and edit the grub entry to disable Plymouth (the splashscreen, instructions available here) and wait the timeout period for systemd service files to fail (1min 30s). You will be prompted to enter into recovery mode by logging in as root. Fix the error and reboot.

It was SELinux issue. I solved it by setting up proper security contexts for home and ecryptfs stuff. Run this with unmounted ecryptfs home:

chcon -u unconfined_u -t user_home_dir_t /home/<username>/
chcon -u unconfined_u -t ecryptfs_t /home/.ecryptfs/<username>/.ecryptfs/
chcon -u unconfined_u -t ecryptfs_t /home/.ecryptfs/<username>/.ecryptfs/*
chcon -h -u unconfined_u -t user_home_t /home/<username>/* /home/<username>/.*
chcon -h -u unconfined_u -t ecryptfs_t /home/<username>/.ecryptfs /home/<username>/.Private

I have done other experimenting previously, which may have some effect:

• enabling ecryptfs home encryption in SELinux: setsebool -P useecryptfshome_dirs 1
  


• configured pam to use ecryptfs:
  
  
  • setting USEECRYPTFS=yes in /etc/sysconfig/authconfig
    
  
  
  • regenerating authconfig --enableecryptfs --updateall
    
  
  

Check grep ecrypt /etc/pam.d/*:

/etc/pam.d/postlogin:auth optional pam_ecryptfs.so unwrap
/etc/pam.d/postlogin:password optional pam_ecryptfs.so unwrap
/etc/pam.d/postlogin:session optional pam_ecryptfs.so unwrap
/etc/pam.d/postlogin-ac:auth optional pam_ecryptfs.so unwrap
/etc/pam.d/postlogin-ac:password optional pam_ecryptfs.so unwrap
/etc/pam.d/postlogin-ac:session optional pam_ecryptfs.so unwrap

I hope I didn't miss anything in the answer.