Removal of pam_zfscrypt package

[gc-user]

I was wondering if that isn't an essential package if one has an encrypted home folder.

I have void installed via Project Trident and it uses encrypted home folder.

So I had to not only put that package on hold in order to not get it removed, but also rebuild it against the zfs 2.3.0 as the previous revision wouldn't work for the new zfs.

Now, I don't mind rebuilding the package myself - as long as the template still works that's an easy and quick task. But I probably wouldn't be able to "fix" the template should it stop working for future zfs versions.

But then I could just stay on the the current zfs main version.

So, not the biggest of problems, I guess - for now.

But I was wondering - how would decrypting and mounting an encrypted home folder work without this package? Especially if a graphical login is used (LightDM).

Do maybe the packages pam_mount and zfs-pam do the same as pam_zfscrypt and can be used as a replacement?

[ahesford]

I would assume that you anre able to use zfs-pam to replace the removed package. If not, you migrate your home directory to a form will work before you allow the removed module to be updated. Such is the nature of rolling releases.

[gc-user]

Thanks for the tip! I didn't know that package existed.

I did some testing, but so far have not been able to use zfs-pam. I modified the same files I did for pam_zfscrpt (namely /etc/pam.d/ passwd, system-auth and lightdm. But there's no way I can login. I always end up at lightdm(-greeter) again.

I'll do some more testing and searching.

But for now, there's no pressure because I have been re-compiling (and patching for build errors) pam_zfscrypt locally for every new zfs version since the package was officially removed.
Luckily for me (not being able to code), so far I was always able to get the packages build and running, i.e. decrypting my home directory at login.
And since I never updated the pool since install I should be able to access the data using a snapshot should some update lock me out.

[gc-user]

Ok, I finally figured out how to make zfs-pam working like pam-zfscrypt does.

First of all, as there is nothing in the openzfs docs / zfs man about zfs-pam (esp. on how to get it working) I was using the arch linux wiki as it is coming up for a number of searches and it is one of the best resources out there. And for pam-zfs it doesn't disappoint either.

Of course, I omitted all settings / edits regarding systemd for obvious reasons.

But for some reason, I couldn't get it to work, meaning the user's encrypted home dataset to be mounted. Hence there was a new (at first login only, of course) unencrypted home directory created. Only if I would mount the dataset manually, would I be able to login to that user with the correct home directory (i.e. the one in the encrypted dataset) being used.

Doing some digging on my system I could see a file in /run/pam_zfs_key by the name of the user-id that is logged in, with the content 2.
So, the general setup was somewhat recognized, but not (fully) working, yet.

As pam_zfscrypt only works if a property is added to the respective dataset, at first I was thinking something similar micht be necessary for zfs-pam as well. But as nothing of that sort is mentioned anywhere and logic "dictates" that it shouldn't be necessary as the module is included in zfs itself.

But, as it turns out, I wasn't far off regarding the reason why it didn't work on my system.
Doing some more searching, in the log files and online, I came across this error message:

pam_zfs_key(lightdm:session): canmount is not on for: [pool]/home/[user], skipping

So, the issue apparently is, for pam_zfscrypt the dataset property can be set to "noauto", for zfs-pam it has to be "on".

Once I made that change, the login with zfs-pam would work like I'm used to from pam_zfscrypt.

So simple - once noticed / found... :-)

[Edit]

My above victory lap was a bit premature.
It turns out that setting canmount=on on an encrypted dataset leads to the system asking for the password during boot. On arch that might be avoided by setting org.openzfs.systemd:ignore=on but that's no option here for obvious reasons.

So, I have more digging to do. And for now keep using pam_zfscrypt. :-)

[Edit 2]:

Found "a" solution / workaround to the above issue of the system asking for a password during boot for encrypted datasets.
I just removed the -l from the line zfs mount -a -l of the file /etc/runit/core-services/03-filesystems.sh. As I don't have root encrypted that works fine on my system. It would be nicer though if zfs-pam would be able to mount datasets with canmount set to noauto...