I'm running OpenSUSE 12.3 on a VM in the cloud and have an EncFS directory set up. I can mount it manually fine. I'm trying to have the directory mounted at SSH login, ideally only for the duration of the SSH session (staying mounted as long as there is at least one current SSH session).
How do I do this? I have pam_mount configured by default, and added the lines
auth optional pam_mount.so
session optional pam_mount.so
/etc/pam.d/common-session. These get imported everywhere.
/etc/security/pam_mount.conf.xml, I enabled
luserconf and set the
allow="*". I also turned
In the user home, I have a
.pam_mount.conf.xml with the following:
<volume user="user" fstype="fuse" path="encfs#/home/%(USER)/path-raw" mountpoint="/home/%(USER)/path" options="nonempty,user=%(USER)" />
This appears to do the right thing, more or less. I can see in
/var/log/messages that the user
.pam_mount.conf.xml is loaded, and a mount attempt is made using the
user itself, instead of
The problem is with getting the password! EncFS requires a password, of course. I'm connecting over SSH, which I have found out doesn't allow pam_mount to get the password from the client stdin. I'm more than willing to just encrypt a file in the user home with the password in it. But
mount.fuse doesn't take a password argument, plaintext or otherwise.
fd0ssh can forward the SSH key password, but I want my EncFS password to be different than the SSH key password, because the SSH key belongs to the client and I have multiple clients I'm connecting from, each with a different key/password.
Yes, I can do a mount in my
.bashrc. That doesn't unmount if the connection drops however. (Maybe I can
cron something periodically to check for the existence of SSH connections and unmount if none are found?)
Also, the thing I'm encrypting is a bare git repo. (Yes, I've EncFS'd the clone on my local as well.) I don't think git connecting over SSH would trigger