encryption – How to Encrypt Folders (Not in Home)

You must run gparted from a livecd because you will be moving the partitions.

1. Backup your data (there is an high risk if something goes wrong during partition changes)
2. Move sda3 to the beginning of the unallocated space

3. Move sda4 to the beginning of the unallocated space

4. Resize sda4

Lucky you! I just had the same problem and wrote a script that will facilitate mounting ecryptfs Folders with FNEK.

sudo su -

Then open nano/vim/your editor of choice and create a file ecryptfs-fnek-helper.sh with the following contents:

#!/bin/bash

# Thanks to https://bugs.launchpad.net/ubuntu/+source/ecryptfs-utils/+bug/455709
# 

echo "Where is the /home with the .ecryptfs mounted? (default=/mnt/home)"
read home_ecryptfs
if [ -z "$home_ecryptfs" ]; then
    home_ecryptfs=/mnt/home
fi
home_ecryptfs=$home_ecryptfs/.ecryptfs

echo "Whose encrypted home would you like to mount?"
read user
if [ -z "$user" ]; then
    echo "You have to enter a user!"
    exit;
fi

echo "What is the user's password?"
read -s password
if [ -z "$password" ]; then
    echo "You have to enter a password!"
    exit;
fi

echo "Where would you like to mount it? (Default: /mnt/[username])"
read target
if [ -z "$target" ]; then
    target=/mnt/$user
fi
target=$target/
mkdir -p $target

wrapped=$home_ecryptfs/$user/.ecryptfs/wrapped-passphrase
sig=$home_ecryptfs/$user/.ecryptfs/Private.sig
private=$home_ecryptfs/$user/.Private/

echo I will be mounting $private into $target.

echo "Clearing the keyring."
keyctl clear @u
keyctl list @u

echo "Unwrapping passphrase and inserting it into key:"
printf "%s" $password | ecryptfs-insert-wrapped-passphrase-into-keyring $wrapped -

keyctl list @u

echo -e "\e[0;92mPassphrase:"
echo -e '\e[1;92m'`printf "%s" $password | ecryptfs-unwrap-passphrase $wrapped - `'\e[0m'
echo -e "\e[0;96mFilename Encryption Key (FNEK) Signature:"
echo -e '\e[1;96m'`tail -n1 $sig`'\e[0m'
echo -e "Mounting now! Be sure to enable FNEK!"
mount.ecryptfs $private $target -o ecryptfs_cipher=aes,ecryptfs_key_bytes=16,key=passphrase

This will unwrap your passphrase and add it to the keyring. It will also display the passhprase and the correct FNEK signature, so you can copy/paste them when prompted by mount.ecryptfs.

Make the file executable and run it while still in su:

chmod +x ecryptfs-fnek-helper.sh
./ecryptfs-fnek-helper.sh