Just wondering if I use ecryptfs to encrypt my /home folder
sudo ecryptfs-migrate-home -u username
Can another user with root privilege change my password, then login my account using the new password see my encrypted /home?
If I change my own password, I suppose I can still access my encrypted /home , how is it different from root changing my password and login as me?
Best Answer
Short answer: Yes and no.
Yes. As long as you are logged in, root as well as any sudo user can see your decrypted files. Also, when you wake up from sleep, your
/homewill still be decrypted.Also there is a bug in
ecryptfsthat prevents unmounting the decrypted/homefolder at logout. You should instead shutdown or restart the machine or manually unmount the folder from another sudo/root user. See this question for more information.No. Your
/homefolder is not encrypted with your password, but with a passphrase which is encrypted with your password. Another user changing your password will not affect the passphrase.At the first login after an administrative password change, you have to mount your encrypted home manually and rewrap the passphrase. For these tasks you need your old and the new password
When you change your password, the home directory passphrase is re-encrypted with your new password, so you should have continued access to your files with the new password. This is handled via PAM (Pluggable Authentication Modules) (via).
See this related question.