Encrypted ZFS Home

[DanielBowman]

This How to considers ZFS is setup as zroot/home i.e. the default - if not, make changes accordingly.

Configuring PAM to automatically (be able to) mount your zfs home directory on login:


/etc/pam.d/system

auth    required    pam_unix.so        no_warn try_first_pass    nullok
auth    optional    pam_zfs_key.so     try_first_pass  homes=zroot/home
session    optional    pam_zfs_key.so    homes=zroot/home

and to change zfs key alongside with your password:

/etc/pam.d/passwd

password    optional    pam_zfs_key.so homes=zroot/home
password    required    pam_unix.so    no_warn try_first_pass nullok

This works fine with
adduser
and on
login
(lightdm-gtk-greeter works too).
On login it asks for password once and logs you in, mounting encrypted home properly.

passwd
works as intended. Only difference is that when you change password for your_user as root, it will first ask for Old Passphrase. Which you can ignore (Enter) if the user does not have Encrypted ZFS dataset. If your_user does have Encrypted home, your_user will need to change his zfs key passphrase later on to match his login password.

For ssh to work you need:


/usr/local/etc/doas.conf

permit nopass your_user as root cmd zfs args mount -l zroot/home/your_user

And to mount home after ssh login:
doas zfs mount -l zroot/home/your_user

 

[cracauer@]

How does that play with ~/.ssh/authorized_keys?

 

[DanielBowman]

How does that play with ~/.ssh/authorized_keys?

No clue. Should play nice - since ssh does not ask for password or zfs passphrase it will not trigger PAM until you trigger zfs mount manually already in the shell. There is PAM section for ssh but the implementation did not produce desired effect when tested (half a year ago). Most of the credit goes to BSDJEdi

 

[6502]

How does that play with ~/.ssh/authorized_keys?

Maybe he can change its location in /etc/ssh/sshd_config and move outside /home

 

[DanielBowman]

Maybe he can change its location in /etc/ssh/sshd_config and move outside /home

My bad. I totally missed the point of the question. Indeed if the keys are on encrypted ZFS Home, that would not work.
One option is to save it in unecrypted volume (when you fail to provide passphrase for zfs, the system mounts home folder volume which is unencrypted).