zfscrypt
zfscrypt implements a Linux Pluggable Authentication Module that encrypts users home directories with their login password leveraging ZFS native encryption. The concept was heavily inspired by Google's fscrypt.
Warning: This is my first project written in C. It might contain severe security issues.
Setup
Check that ZFS v0.8.0 or later is installed.
zfs -V
Build and install the PAM module.
make
make install
Unfortunately PAM configuration is a bit of a mess, beacuse every distribution configures PAM differently. So chances are high that you have to adapt the follwing example to your distribution.
Note: Tested on Arch Linux with pam v1.3.1 and zfs v0.8.2.
Append the following line to the auth
section in /etc/pam.d/system-login
:
auth optional pam_zfscrypt.so
And append this two lines to the session
section:
session [success=1 default=ignore] pam_succeed_if.so service = systemd-user quiet
session optional pam_zfscrypt.so
The first line is needed to work around some quirks in systemd (more info here).
Finally append the next line to etc/pam.d/passwd
:
password optional pam_zfscrypt.so
Having problems with PAM? Maybe one of this Arch Wiki pages can help you: pam, fscrypt
Usage
All datasets with the following properties will be automatically unlocked when the corresponding user logs in (and locked after logout).
Property | Value |
---|---|
io.github.benkerry:zfscrypt_user |
user name |
encryption |
not off |
keyformat |
passphrase |
keylocation |
prompt |
canmount |
not off |
Create a new user with zfscrypt
The encryption key and the login password must be the same, otherwise automatic unlocking won't work. Future password changes will update the encryption key automatically.
zfs create -o mountpoint=/home tank/home
zfs create -o io.github.benkerry:zfscrypt_user=ben -o encryption=on -o keyformat=passphrase -o keylocation=prompt -o canmount=noauto tank/home/ben
zfs mount tank/home
zfs mount tank/home/ben
useradd --create-home ben
zfs allow -u ben load-key,change-key,mount tank/home/ben
passwd ben
Migrate an existing user to zfscrypt
mv /home/ben /home/_ben
zfs create -o io.github.benkerry:zfscrypt_user=ben -o encryption=on -o keyformat=passphrase -o keylocation=prompt -o canmount=noauto -o mountpoint=/home/ben tank/home/ben
zfs allow -u ben load-key,change-key,mount tank/home/ben
zfs mount tank/home/ben
chown ben:ben /home/ben
chmod 0700 /home/ben
cp -ar /home/_ben/. /home/ben/
rm -rf /home/_ben