In this lesson, you will learn how to automate the decryption and mounting of an encrypted home directory the moment a user logs in using the pam_mount module.
Understanding pam_mount
While systemd-homed offers native encryption, there are scenarios where you need to manage custom encrypted volumes (such as LUKS partitions or network shares) that must be mounted only when a specific user authenticates. pam_mount acts as a middleware in the PAM stack; it intercepts the session opening process, prompts for necessary credentials, and executes the mount command before the user shell is initialized.
Configuring the Integration
To implement this, you must first install the libpam-mount package. Once installed, the primary configuration file is /etc/security/pam_mount.conf.xml. This file allows you to define the volume, the device path, and the mount point.
A typical entry for an encrypted LUKS volume looks like this:
<volume fstype="crypt" path="/dev/sdb1" mountpoint="/home/users/username" />
After defining the volume, you must update your PAM configuration files (typically /etc/pam.d/common-session or a specific service file like /etc/pam.d/login). You need to add pam_mount.so to the session stack:
# Add this line to /etc/pam.d/common-session
session optional pam_mount.so
How it Works
When the user enters their password, the pam_mount module receives the cleartext password from the PAM stack. If the fstype is set to crypt, the module uses that same password to unlock the encrypted volume. Because this occurs within the session phase of the PAM lifecycle, the volume is ready and mounted by the time the user’s environment variables are loaded and their shell is presented.
If the user logs out, pam_mount automatically unmounts the volume, ensuring that sensitive data is not left accessible in the file system once the session terminates. This provides a transparent, secure experience that bridges the gap between authentication and storage access.
Key Takeaway: By integrating pam_mount into the PAM session stack, you can securely tie the unlocking and mounting of encrypted volumes directly to the user’s authentication event, ensuring data is only accessible while an active session exists.