How to stop using built-in home directory encryption?

Question

I have a new Ubuntu 10.04 installation with encrypted home directory (using the built-in encryption offered by Ubuntu installer).

What's the easiest way to stop using encryption? (I.e., to decrypt my home directory permanently.)

(It's giving me problems with kernel updates, and I'd just like to cut down on all the hassle I'm having with this installation.)

score 79 · Accepted Answer · edited Dec 25 '12 at 10:58

79

Googling around, I found this post:

Not to bring up an old thread but in case anyone has errors trying to follow these instructions, here is what I did.

Backup the home directory while you are logged in sudo cp -rp /home/user /home/user.backup

1.1. Check that your home backup has everything!!!

reboot into root via grub

Delete your home directory rm -rf /home/user

Remove the packages apt-get remove ecryptfs-utils libecryptfs0

Restore your home directory mv /home/user.backup /home/user

reboot

Remove any of those .Private .ecryptfs folders rm -rf ~/.Private rm -rf ~/.ecryptfs

Yay!

This worked for me. Home folder file permissions stay intact and does not bugger up Dropbox or git repos. Some reason my fresh install on Ubuntu 9.10 would not do the first command. Just make sure you think the process through when using rm -rf. Just wanted to post this not only for my record, but anyone else who encounters problems.

Some notes

reboot into root via grub was a bit unclear to me; I didn't reboot, just switched to using root (another user account with sudo privileges would work equally well).
Before removing the packages ecryptfs-utils and libecryptfs0 would work, I needed to remove /home/.ecryptfs/<myusername>. (It complained that ecryptfs-utils was in use.)

Other than that, this worked for me. It's far from simple though, so feel free to post better solutions!

edited Dec 25 '12 at 10:58

Nikos Alexandris

149

answered Sep 30 '10 at 11:00

Jonik

7,178

I'll accept this as it worked for me, but like I said, feel free to post something simpler or better! – Jonik Oct 06 '10 at 13:33
3

This worked for me on 12.10 aswell. I also needed to delete /home/.ecryptfs/<myusername> first. Also, I had to remount / in the root console though, but I guess this is another story. Thanks! – Constantinius Nov 29 '12 at 09:41
1

Worked on 12.04 too. The only thing is if you switch to root (sudo su) instead of "rebooting to root via grub" it works but you need to move out of /home/user (cd /home for example) and issue umount /home/user to unmount the home dir before using the rm -rf. You also need to rm -rf /home/user.backup/.ecryptfs before removing the 2 packages. – laurent Dec 09 '12 at 21:35
3

+1 This is easier to do over SSH, no GRUB to deal with or trying to avoid any mounting. Just be careful deleting /home/.ecryptfs. Apparently it has a symlink pointing to /home/username. I lost all my data. – htoip Feb 17 '13 at 23:10
what's about this way? http://virtually-a-machine.blogspot.com/2010/08/howto-disable-ecryptfs.html – Tebe Jul 03 '14 at 16:35
2

For step 1, if you get an error: /home/<username>/.gvfs: Cannot stat: Permission denied you can always use rsync: rsync -avz --exclude '*.gvfs' /home/<username> /home/<username>.backup – tir38 Jul 26 '14 at 23:45
To reboot into root via grub, following these instructions: http://askubuntu.com/questions/92556/how-do-i-boot-into-a-root-shell – Theron Luhn Oct 22 '14 at 17:06
I had some trouble enabling networking (which is also read-write access to the file system), but the following worked: https://bugs.launchpad.net/ubuntu/+source/friendly-recovery/+bug/1061239/comments/5 – Theron Luhn Oct 22 '14 at 17:08
note that home directory encryption is separate from entire drive encryption, as least in server 16.04, and so you can safely remove ecryptfs-utils and libecryptfs0 without affecting whole disk encryption. – simpleuser May 15 '17 at 19:41
I had to do umount /home/myusername/.Private before I could remove my home dir. And to do that, I had to killall -u myusername. – sudo Aug 22 '17 at 18:08

score 49 · Answer 2 · edited Aug 24 '15 at 13:03

49

Here you are, hope this helps (see ecryptfs-setup-private(1)):

$ ecryptfs-setup-private --undo

The output claims:

In the event that you want to remove your eCryptfs Private Directory setup, you will need to very carefully perform the following actions manually:
Obtain your Private directory mountpoint
$ PRIVATE=`cat ~/.ecryptfs/Private.mnt 2>/dev/null || echo $HOME/Private`
Ensure that you have moved all relevant data out of your $PRIVATE directory
Unmount your encrypted private directory
$ ecryptfs-umount-private
Make your Private directory writable again
$ chmod 700 $PRIVATE
Remove $PRIVATE, ~/.Private, ~/.ecryptfs

Note: THIS IS VERY PERMANENT, BE VERY CAREFUL
$ rm -rf $PRIVATE ~/.Private ~/.ecryptfs
Uninstall the utilities (this is specific to your Linux distribution)
$ sudo apt-get remove ecryptfs-utils libecryptfs0

edited Aug 24 '15 at 13:03

lmeurs

207

answered Oct 20 '10 at 14:57

zuzust

683

Thanks. I already got it solved, but I guess this is useful for others. – Jonik Oct 21 '10 at 10:40
@Jonik Were you able to log into .ecryptfs/jonik/.Private properly after the kernel update, or did you back up and undo encryption? – isomorphismes Aug 13 '11 at 01:21
4

This only applies to an encrypted directory "~/Private" and not to an encrypted home directory as the OP stated. See https://help.ubuntu.com/community/EncryptedHome for the differences. – lmeurs Aug 24 '15 at 12:16

score 18 · Answer 3 · edited Jan 16 '22 at 06:30

1st thing to do: BACKUP YOUR HOME. I can't say it louder... basically undoing encryption is equivalent to resetting (rm -rf) your home, which is in fact hidden by a mount.

2nd step: log out of any desktop manager and go to a virtual console (Ctrl + Alt + F3)

Finally, for details:

ecryptfs-setup-private --undo

In the event that you want to remove your eCryptfs Private Directory setup, you will need to very carefully perform the following actions manually:

Obtain your Private directory mountpoint PRIVATE= cat ~/.ecryptfs/Private.mnt 2>/dev/null || echo $HOME/Private
Ensure that you have moved all relevant data out of your $PRIVATE directory
Unmount your encrypted private directory
```
ecryptfs-umount-private
```
Make your Private directory writable again
```
chmod 700 $PRIVATE
```
Remove $PRIVATE, ~/.Private, ~/.ecryptfs Note: This is very permanent, be very careful.
```
  rm -rf $PRIVATE ~/.Private ~/.ecryptfs
```

Uninstall the utilities

 sudo apt-get remove ecryptfs-utils libecryptfs0

I would say step 5 is a bit wrong : there's no need to delete $PRIVATE, which was for me my home....

After .Private and .ecryptfs deletion, just restore your home :]

What if you've encrypted more than half of your hard disk space? Is there any way out, without buying another drive? — isomorphismes, Aug 13 '11 at 01:17
@hhlp Interesting that you needed not delete your $PRIVATE. Isn't that your user home directory? Does it imply that one doesn't need to delete his/her own directory, save that a back-up is always important? — XavierStuvw, Dec 22 '16 at 11:56

score 11 · Answer 4 · edited Jan 16 '22 at 06:32

This steps will work in a server environment

Backup your home directory

sudo cp -rp /home/$USER /home/$USER.backup

Confirm whether everything is backup
```
sudo ls -al /home/$USER.backup
```
Umount the home folder, because the encryption program usually mounts it to mount point e.g /home/$USER,also known as $HOME. You can confirm your mount point by running df -h $HOME. You will have to cd /tmp (or some other non-$HOME directory) to be able to unmount $HOME.
```
cd /tmp
sudo umount /home/$USER
```
Delete the old home folder
```
sudo rm -rf /home/$USER
```

Remove encrytion program file

sudo rm -rf /home/$USER.backup/.ecryptfs

Remove encryption utillities from the system

sudo apt-get remove ecryptfs-utils libecryptfs0

Restore unencrypted home folder back to it original path
```
sudo mv /home/$USER.backup /home/$USER
```
Change ownership of the restored folder back to your user
```
sudo chown -R $(id -u):$(id -g) /home/$USER
```
Logout/Login, to be sure all user stuff gets restarted right (or that errors will occur while you remember what you're done).

Brilliant. Thank you for this clear and consise guide. Helped me out! — James Lalor, Mar 23 '17 at 20:21
I also cleaned up /home/.ecryptfs/$USER with sudo rm -rf /home/.ecryptfs/$USER — JimB, Oct 27 '18 at 14:07

Melebius · Answer 5 · 2017-05-25T17:28:52.193

Adding another guide to the long list after I realized that the most intrusive steps mentioned elsewhere are not necessary.

My guide needs no reboot and I have successfully finished it over SSH. It should also work if there are other eCryptfs mounts on the machine.

The only non-obvious requirement is to be able to login as another user with sudo access.

Login as the user with the encrypted home directory (called user in this guide).
Just to keep the paths in the following steps simple and symmetric:
```
cd /home
```
Duplicate the decrypted home folder contents to another directory.
```
sudo cp -rp user user.new
```
Logout (exit or logout). Login as another sudoer.
Check that the eCryptfs mount is unmounted. Do not umount it manually, it may lead to data loss! (Experienced myself. I was having another SSH session with user logged in.)
```
mount | grep ecryptfs
```
The output must be empty. Or, if there are any other eCryptfs mounts, it must not contain /home/user.
Just like step 2.
```
cd /home
```
Mark the duplicate as not being managed with eCryptfs. (There is no need to uninstall eCryptfs packages, especially when there are other eCryptfs mounts.)
```
sudo rm user.new/.ecryptfs user.new/.Private
```
Move the not encrypted home directory into place.
```
sudo mv user user.old && sudo mv user.new user
```
Login as user and check that everything works and eCryptfs does not kick in.
```
mount | grep ecryptfs
```
Remove the original contents of user’s home folder and the encrypted data.
```
rm -r /home/user.old
sudo rm -r /home/.ecryptfs/user
```

score 1 · Answer 6 · edited Dec 20 '16 at 09:45

1

Jonik’s explanation works well. But instead of step 2, I did:

Logout
Press Ctrl+F4. A command line interface should open.
Login as root
rm -rf .ecryptfs

Then, instead of step 6: Press Ctrl+F7. If your GUI login screen does not appear, press Ctrl+F8.

edited Dec 20 '16 at 09:45

Melebius

11,431
9
52
78

answered Mar 02 '14 at 11:22

Martin Thoma

19,277

score 1 · Answer 7 · answered May 16 '15 at 21:38

if you can backup to an external storage, do it. (Not directly needed, but always good before file manipulation.)
get familiar with tty, at least a little. (Press Ctrl Alt F7, Ctrl Alt F1 etc.) You will need to work with two tty-s. One root and one of your main user.

log in as root on a separate tty, create a new home directory

mkdir /home/user.newdir
chown user:user /home/user.newdir

log out of the graphical session. You can reboot to make sure no programs are working from under your normal user.
log in as your normal user on a separate tty, move all your files to the new destination:
```
mv ~/* /home/user.newdir/
```

using the root tty, rename the directories:

mv /home/user /home/user.encfs
mv /home/user.newdir /home/user

everything should work by now.:) Once you're ready, remove the old files /home/.encryptfs, /home/user.encfs, /home/user/.Private, /home/user/.encryptfs. If you want, you can rename them first and remove them later.

score 1 · Answer 8 · answered Mar 27 '16 at 20:42

I didn't use any of the answers here. Instead (in Ubuntu Studio 14.04):

I copied all the files I wanted to keep, especially all the .* files, into a directory outside $HOME.
I created a new user (System > Users and Groups) and added that user to the sudo group. I left the box "Encrypt home folder to protect sensitive data" unchecked.
I logged out and logged back in as the new user then deleted my original account, checking to see what the numerical UID was first (advanced options), selecting the option to delete the files in my original $HOME. This completed but with an "unknown error". Checking in /home I could see that my old $HOME was gone
I re-created my original user account checking to see that it was created with the original numerical UID, which it was, and being sure to leave the "Encrypt home folder to protect sensitive data" box unchecked.
I deleted the new, practically empty, version of my original $HOME directory and renamed my back-up of $HOME to my original $HOME and logged out.
I logged into my new original account and it was as if nothing had happened.
I checked /home to find a directory .ecryptfs which I removed with no ill effect.

I see no reason that removing the package which provides for encrypted home directories should not be optional, and I've deferred removing the new user account I created for this purpose since I think it might come in handy in future.

My reason for doing this? The old computer looks like it's failing. When it does fail, I want to be able to access the HD on another computer without any hassles.

Alex Ancco Cahuana · Answer 9 · 2021-01-26T18:46:48.123

-1

In Ubuntu 16.04 these steps were performed:

1:sudo cp -rp /home/USERNAME /home/USERNAME.backup

2:sudo -i

3: umount -fl /home/USERNAME

4:rm -rf /home/USERNAME

5:apt-get remove ecryptfs-utils libecryptfs0 -s

6:mv /home/USERNAME.backup /home/USERNAME && rm -rf /home/USERNAME/.Private && rm -rf /home/USERNAME/.ecryptfs

7:reboot now

edited Jan 26 '21 at 18:46

answered Jan 26 '21 at 18:36

Alex Ancco Cahuana

119

score -3 · Answer 10 · answered Aug 20 '16 at 20:18

-3

Simple solution which worked for me:

You should have another user with sudo access

Reboot
On login screen press CTRL+ALT+F1
Login as the other user (with sudo access)
sudo rm -rf /home/youruser/.ecryptfs
sudo rm /home/youruser/.Private
sudo apt-get remove --purge ecryptfs-utils libecryptfs1
sudo reboot
Login as your user and enjoy your home dir without encryption ;)

answered Aug 20 '16 at 20:18

Sycu

7

3

This would wipe all the modifications done after turning on the encryption. It’s probably OK for a system just installed but you must explicitly mention that. – Melebius Dec 05 '16 at 09:18

How to stop using built-in home directory encryption?

10 Answers10

Linked

Related