Secure Your Data: ecryptfs on Linux

Encryption is one of the most effective tools for protecting sensitive data. If your laptop is stolen, your drive is pulled, or someone gains physical access to your machine, encryption ensures your files remain unreadable without the correct passphrase. ecryptfs is a stacked filesystem built into the Linux kernel that encrypts data transparently at the filesystem layer — you work with your files normally, and encryption happens underneath.

This guide covers everything from installation to daily use on Arch Linux and other distributions.

How ecryptfs Works

ecryptfs operates as a stacked filesystem: it sits on top of your existing filesystem (ext4, btrfs, etc.) and intercepts reads and writes. When you write a file, ecryptfs encrypts it and stores the ciphertext in a lower directory. When you read it, the kernel decrypts on the fly. The encrypted files on disk are real files — you can back them up or move them anywhere.

Your applications
       │
  ecryptfs layer  ← encryption / decryption happens here
       │
  Lower directory  ← encrypted ciphertext files stored here
       │
  Physical disk

Two directories are always in play:

When you mount, ecryptfs overlays the lower directory at the mount point. When you unmount, the plaintext disappears — only ciphertext remains on disk.

Step 1 — Install ecryptfs-utils

Arch Linux / Manjaro

1

sudo pacman -S ecryptfs-utils

Debian / Ubuntu

1

sudo apt install ecryptfs-utils

Fedora / RHEL

1

sudo dnf install ecryptfs-utils

Load the Kernel Module

ecryptfs is a kernel module. Load it before using it:

1

sudo modprobe ecryptfs

To load it automatically on every boot:

1

echo 'ecryptfs' | sudo tee /etc/modules-load.d/ecryptfs.conf

Verify it is loaded:

1

lsmod | grep ecryptfs

Step 2 — Create an Encrypted Directory

This is the core workflow: a lower directory (ciphertext on disk) and a mount point (plaintext in use).

Create the Directories

1
2
3
4
5

# Lower directory — stores encrypted files on disk
mkdir -p ~/.ecryptfs/Private

# Mount point — where you access decrypted files
mkdir -p ~/Private

Mount the Encrypted Filesystem

1

sudo mount -t ecryptfs ~/.ecryptfs/Private ~/Private

ecryptfs will ask a series of questions:

Passphrase:
Select cipher:
 1) aes: blocksize = 16; min keysize = 16; max keysize = 32
 2) blowfish: blocksize = 8; min keysize = 16; max keysize = 56
 ...
Selection [aes]:

Select key bytes:
 1) 16
 2) 24
 3) 32
Selection [16]:

Enable plaintext passthrough (y/n) [n]:

Enable filename encryption (y/n) [n]:

Recommended answers:

After answering, ecryptfs shows:

Attempting to mount with the following options:
  ecryptfs_unlink_sigs
  ecryptfs_key_bytes=32
  ecryptfs_cipher=aes
  ecryptfs_sig=abc123...
Mounted eCryptfs

Your ~/Private directory is now mounted and ready. Files written here are encrypted automatically.

Step 3 — Write and Verify Encryption

Add a Test File

1
2

echo "This is secret data" > ~/Private/test.txt
cat ~/Private/test.txt

Output:

This is secret data

Check What Is Stored on Disk (Ciphertext)

1
2

ls ~/.ecryptfs/Private/
cat ~/.ecryptfs/Private/<encrypted-filename>

The file on disk is binary ciphertext — completely unreadable without the passphrase and key.

Step 4 — Unmounting the Encrypted Directory

When you are done working with your private files, unmount to remove plaintext access:

1

sudo umount ~/Private

After unmounting:

• ~/Private appears empty
• ~/.ecryptfs/Private still contains the encrypted files
• No plaintext data remains accessible on the filesystem

Verify the unmount:

1
2

ls ~/Private
# No output — directory appears empty

Step 5 — Remounting (Accessing Files Again)

To access your encrypted files again, remount with the same passphrase and options:

1
2

sudo mount -t ecryptfs ~/.ecryptfs/Private ~/Private \
  -o ecryptfs_cipher=aes,ecryptfs_key_bytes=32,ecryptfs_passthrough=no,ecryptfs_enable_filename_crypto=y

ecryptfs will prompt for your passphrase.

Save Mount Options to Avoid Retyping

Store the options in a file so you do not need to remember them:

1

nano ~/.ecryptfs/Private.conf

Add:

/home/yourusername/.ecryptfs/Private /home/yourusername/Private ecryptfs ecryptfs_cipher=aes,ecryptfs_key_bytes=32,ecryptfs_passthrough=no,ecryptfs_enable_filename_crypto=y 0 0

Mount using the saved options:

1

sudo mount ~/Private

Step 6 — Automating Mount/Unmount with ecryptfs Helper Scripts

ecryptfs-utils includes helper scripts that wrap the mount/unmount workflow cleanly.

Set Up a Private Directory with the Helper

1

ecryptfs-setup-private

This interactive tool:

1. Creates ~/.Private (lower directory) and ~/Private (mount point)
2. Generates a mount passphrase and wraps it with your login password
3. Sets up PAM integration so the directory mounts automatically when you log in

Follow the prompts — you will be asked for your login password and optionally a separate mount passphrase.

Manual Mount with the Helper

1

ecryptfs-mount-private

Manual Unmount with the Helper

1

ecryptfs-umount-private

These scripts handle the full options string for you.

Step 7 — Auto-Mount on Login with PAM

The most convenient setup is having your encrypted directory mount automatically when you log in and unmount when you log out. This requires PAM integration.

Enable PAM Auto-Mount

1
2
3

# Add ecryptfs to PAM login
sudo bash -c 'echo "auth    required  pam_ecryptfs.so unwrap" >> /etc/pam.d/login'
sudo bash -c 'echo "session required  pam_ecryptfs.so unwrap" >> /etc/pam.d/login'

On Arch Linux, the PAM configuration is typically in /etc/pam.d/system-login rather than /etc/pam.d/login. Edit the correct file for your setup.

After enabling PAM integration, the encrypted directory mounts transparently when you log in — no passphrase prompt, no manual mount step.

Verify Auto-Mount Is Working

Log out and log back in:

1

ls ~/Private

If files appear, auto-mount is working correctly.

Encrypting Your Home Directory

ecryptfs can encrypt your entire home directory. The ecryptfs-migrate-home tool handles the migration:

Warning: Back up your home directory before proceeding. Encrypting your home directory modifies fundamental aspects of your user account. A failed migration without a backup results in data loss.

1
2
3
4
5
6
7
8

# Make a full backup first
sudo rsync -avz /home/yourusername /backup/home-backup/

# Install ecryptfs-utils if not already installed
sudo pacman -S ecryptfs-utils

# Migrate the home directory (run as root, user must be logged out)
sudo ecryptfs-migrate-home -u yourusername

After migration:

1. Log in as the user — the home directory will be decrypted on login
2. Verify all files are accessible
3. Reboot and verify again
4. Only delete the unencrypted backup once you are fully satisfied

The unencrypted backup is left at /home/yourusername.random_suffix — delete it when you are sure the migration was successful:

1

sudo rm -rf /home/yourusername.random_suffix

Managing Your ecryptfs Passphrase

View Your Wrapped Passphrase

1

ecryptfs-unwrap-passphrase

You will be asked for your login password. The output is your actual mount passphrase — store this somewhere safe (password manager, printed copy in a secure location). If you forget your login password and cannot unwrap the passphrase, your data is permanently inaccessible.

Change the Wrapping Password

If you change your Linux login password, re-wrap the ecryptfs passphrase to match:

1

ecryptfs-rewrap-passphrase ~/.ecryptfs/wrapped-passphrase

Enter the old password, then the new password.

Important: Always run ecryptfs-rewrap-passphrase after changing your login password when using PAM auto-mount. If the wrapping password does not match your login password, auto-mount will fail and you will be unable to access your files on login.

Add the Passphrase to the Kernel Keyring Manually

1

ecryptfs-add-passphrase

Enter your passphrase — it is added to the kernel keyring for the current session. This is what ecryptfs-mount-private does internally.

Backing Up Encrypted Data

One of ecryptfs’s advantages over full-disk encryption is that backups are simple — copy the ciphertext (lower directory) and the passphrase, and your backup is encrypted at rest.

1
2
3
4
5
6

# Backup the encrypted lower directory
rsync -avz ~/.ecryptfs/Private/ /media/backup/Private_encrypted/

# Also back up your wrapped passphrase and ecryptfs config
cp ~/.ecryptfs/wrapped-passphrase /media/backup/
cp ~/.ecryptfs/Private.sig /media/backup/

To restore on another machine:

1. Install ecryptfs-utils
2. Restore ~/.ecryptfs/ from backup
3. Mount using ecryptfs-mount-private and enter your passphrase

Checking Mount Status

1
2
3
4
5

# Show all currently mounted filesystems including ecryptfs
mount | grep ecryptfs

# Or check with findmnt
findmnt -t ecryptfs

Quick Reference Cheat Sheet

Troubleshooting

Mount Fails: “Key not found”

The passphrase is not in the kernel keyring for the current session. Add it:

1

ecryptfs-add-passphrase

Then retry the mount.

Mount Fails After Changing Login Password

The wrapped passphrase no longer matches your login password. Re-wrap it:

1

ecryptfs-rewrap-passphrase ~/.ecryptfs/wrapped-passphrase

Enter the old password (the one the passphrase was wrapped with) and then your new password.

Filename Encryption Mismatch

If you mounted without filename encryption initially but now try to mount with it (or vice versa), ecryptfs will not read your files correctly. Always use identical options to what you used when the data was first written. Check your .conf file or the options saved during setup.

Cannot Unmount: “Device is Busy”

A process is still reading from or writing to the mounted directory:

1
2
3
4
5

# Find what is using the mount point
lsof ~/Private

# Close those processes, then unmount
sudo umount ~/Private

ecryptfs Module Not Loading at Boot

Verify your modules-load config:

1
2
3
4
5

cat /etc/modules-load.d/ecryptfs.conf
# Should contain: ecryptfs

# Check if systemd picked it up
systemctl status systemd-modules-load

A Note on ecryptfs vs Full-Disk Encryption

ecryptfs encrypts at the directory or file level — individual directories can be encrypted while the rest of the system runs normally. LUKS (Linux Unified Key Setup) encrypts the entire disk at the block level before the OS loads.

For maximum security on a laptop, LUKS full-disk encryption is the stronger choice. ecryptfs is ideal when you want to encrypt a subset of your data — a documents folder, a secrets directory, or a home directory on a shared system — without the complexity of full-disk setup.