Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm running OpenSUSE 12.3 on a VM in the cloud and have an EncFS directory set up. I can mount it manually fine. I'm trying to have the directory mounted at SSH login, ideally only for the duration of the SSH session (staying mounted as long as there is at least one current SSH session).

How do I do this? I have pam_mount configured by default, and added the lines

auth optional pam_mount.so

to /etc/pam.d/common-auth, and

session optional pam_mount.so

to /etc/pam.d/common-session. These get imported everywhere.

In /etc/security/pam_mount.conf.xml, I enabled luserconf and set the mntoptions to require="" and allow="*". I also turned debug on.

In the user home, I have a .pam_mount.conf.xml with the following:

<volume user="user" fstype="fuse" path="encfs#/home/%(USER)/path-raw" mountpoint="/home/%(USER)/path" options="nonempty,user=%(USER)" />

This appears to do the right thing, more or less. I can see in /var/log/messages that the user .pam_mount.conf.xml is loaded, and a mount attempt is made using the user itself, instead of root.

The problem is with getting the password! EncFS requires a password, of course. I'm connecting over SSH, which I have found out doesn't allow pam_mount to get the password from the client stdin. I'm more than willing to just encrypt a file in the user home with the password in it. But mount.fuse doesn't take a password argument, plaintext or otherwise. fd0ssh can forward the SSH key password, but I want my EncFS password to be different than the SSH key password, because the SSH key belongs to the client and I have multiple clients I'm connecting from, each with a different key/password.

Any thoughts?

Yes, I can do a mount in my .bashrc. That doesn't unmount if the connection drops however. (Maybe I can cron something periodically to check for the existence of SSH connections and unmount if none are found?)

Also, the thing I'm encrypting is a bare git repo. (Yes, I've EncFS'd the clone on my local as well.) I don't think git connecting over SSH would trigger .bashrc.

share|improve this question

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.