Merge lp:~dominik-gierlach/ecryptfs/ecryptfs into lp:ecryptfs

[Dominik Gierlach]

Pass through --nopwcheck option from ecryptfs-migrate-home to ecryptfs-setup-private

Might be a fix for issue #1630477

[lp:~dominik-gierlach/ecryptfs/ecryptfs]

887. By Dominikus Gierlach <email address hidden> on 2016-10-06

Updated manpages with new option for ecryptfs-migrate-home

[Tyler Hicks (tyhicks)]

This looks reasonable to me. Thanks for the fix!

review: Approve

[suoko (suoko)]

Hi,

I'm trying this --nopwcheck with a domain user after the ubuntu 18.04 was joined to AD domain with the centrify tool.
If I use --nopwcheck , ecryptfs-migrate-home does not work, it shows instructions on how to use the command.
Without nopwcheck option, the passphrase is not recognized.
Can you suggest a solution ?
Here is a solution which is not working either in my case.

https://community.centrify.com/t5/Centrify-Express/Encrypt-Home-directories-for-domain-Users/td-p/17510

[suoko (suoko)]

Centrify guys suggest:
"Is there any chance to modify the script to interact with PAM and use "adinfo -A <domain> -u <user> -p <password>" for user password checking?"

[Murz (murznn)]

@suoko did you find a working solution for this problem?

=== modified file 'doc/manpage/ecryptfs-migrate-home.8'
--- doc/manpage/ecryptfs-migrate-home.8	2015-11-23 14:17:48 +0000
+++ doc/manpage/ecryptfs-migrate-home.8	2016-10-06 13:08:13 +0000
@@ -9,6 +9,9 @@
 .TP
 .B -u, --user USER
 Migrate USER's home directory to an encrypted home directory
+.TP
+.B \-\-nopwcheck
+Do not check the validity of the specified login password (useful for LDAP user accounts)
 
 .SH DESCRIPTION
 \fBWARNING\fP: Make a complete backup copy of the non-encrypted data to another system or external media. This script is dangerous and in case of an error, could result in data lost, or USER locked out of the system!
 
=== modified file 'src/utils/ecryptfs-migrate-home'
--- src/utils/ecryptfs-migrate-home	2012-08-04 05:37:11 +0000
+++ src/utils/ecryptfs-migrate-home	2016-10-06 13:08:13 +0000
@@ -25,6 +25,7 @@
 set -e
 
 PRIVATE_DIR="Private"
+PWCHECK_OPTION=
 
 usage() {
        echo "
@@ -33,6 +34,8 @@
 $0 -u USER
 
  -u,--user       Migrate USER's home directory to an encrypted home directory
+ --nopwcheck      Do not check the validity of the specified
+                  login password (useful for LDAP user accounts)
 
 WARNING: Make a complete backup copy of the non-encrypted data to
 another system or external media. This script is dangerous and, in
@@ -145,7 +148,7 @@
 		ECRYPTFS_SETUP_PRIVATE_ARGS="$ECRYPTFS_SETUP_PRIVATE_ARGS -m $MOUNTPASS"
 	fi
 	export ECRYPTFS_MIGRATE="1"
-	if ! ecryptfs-setup-private -u "$USER_NAME" -b $ECRYPTFS_SETUP_PRIVATE_ARGS; then
+	if ! ecryptfs-setup-private -u "$USER_NAME" $PWCHECK_OPTION -b $ECRYPTFS_SETUP_PRIVATE_ARGS; then
 		# too bad, something went wrong, we'll try to recover
 		rm -rf "$USER_HOME"
 		mv "$orig" "$USER_HOME"
@@ -177,14 +180,17 @@
 }
 
 DO_ENCRYPT=
-while true; do
-	[ -z "$1" ] && break
+while [ ! -z "$1" ]; do
 	case "$1" in
 		-u|--user)
 			DO_ENCRYPT=1
 			USER_NAME="$2"
 			shift 2
 		;;
+		--nopwcheck)
+			PWCHECK_OPTION="--nopwcheck"
+			shift 1
+		;;
 		*)
 			usage
 		;;