Unable to decrypt user after firmware update Pi v4

[helpmepi]

Hi,

This morning I did an sudo apt update and sudo apt full-upgrade and rebooted my Pi v4. Some of the upgrades were for the kernal and firmware..

After it had rebooted, I've been unable to log in as my Pi user. This user had an encrypted user profile and it seems I'm now unable to log in. I am putting in the correct password, but if I try via VNC, the screen just flashes and goes back to the login prompt. If I put the wrong password in as a test, I get a banner message, so I know it's not this. If I connect via SSH, it also doesn't decrypt properly.

I have found this in my syslog, could this mean anything?
Jan 23 06:43:28 raspberrypiv4 systemd[1]: Started Session c7 of user pi.
Jan 23 06:43:28 raspberrypiv4 lightdm[874]: mount: No such device
Jan 23 06:43:28 raspberrypiv4 lightdm[874]: Error writing X authority: Failed to open X authority /home/pi/.Xauthority: Permission denied
Jan 23 06:43:28 raspberrypiv4 systemd[1]: session-c7.scope: Succeeded.
Jan 23 06:43:28 raspberrypiv4 vncserver-x11-serviced[834]: XIO: fatal IO error 11 (Resource temporarily unavailable) on X server ":0"
Jan 23 06:43:28 raspberrypiv4 vncserver-x11-serviced[834]: after 670 requests (670 known processed) with 0 events remaining.
Jan 23 06:43:28 raspberrypiv4 vncserver-x11[851,root]: SPrintConnMgr: Failed to set allowed users: server-error-service-unavailable
Jan 23 06:43:29 raspberrypiv4 lightdm[4371]: Error getting user list from org.freedesktop.Accounts: GDBus.Error:org.freedesktop.DBus.Error.ServiceUnknown: The name org.freedes$
Jan 23 06:43:29 raspberrypiv4 systemd[1]: Started Session c8 of user lightdm.
Jan 23 06:43:31 raspberrypiv4 vncserver-x11[851,root]: ConsoleDisplay: Found running X server (pid=4361, binary=/usr/lib/xorg/Xorg)
Jan 23 06:43:31 raspberrypiv4 vncserver-x11[851,root]: SPrintConnMgr: Failed to set allowed users: server-error-service-unavailable

Since the upgrade, I've also been getting this:
Jan 23 06:44:00 raspberrypiv4 systemd[1]: openvpn@server.service: Scheduled restart job, restart counter is at 95.
Jan 23 06:44:00 raspberrypiv4 systemd[1]: Stopped OpenVPN connection to server.
Jan 23 06:44:00 raspberrypiv4 systemd[1]: Couldn't stat device /dev/net/tun: No such file or directory
Jan 23 06:44:00 raspberrypiv4 systemd[1]: Starting OpenVPN connection to server...
Jan 23 06:44:00 raspberrypiv4 systemd[1]: Started OpenVPN connection to server.
Jan 23 06:44:00 raspberrypiv4 systemd[1]: openvpn@server.service: Main process exited, code=exited, status=1/FAILURE
Jan 23 06:44:00 raspberrypiv4 systemd[1]: openvpn@server.service: Failed with result 'exit-code'.


Or is there anywhere else I can look to help?

I am able to log in as a different user on the Pi that doesn't have an encrypted file system.


Any help, commands or pointers would be appreciated!

[lingon]

It might be that you suffer from the side effects of the update discussed in this thread https://www.raspberrypi.org/forums/view ... 8&t=262649.

[helpmepi]

I've tried a few things, but unless I'm doing something wrong, this doesn't seem good...

root@raspberrypiv4:/home/pi# ecryptfs-unwrap-passphrase /home/.ecryptfs/pi/.ecryptfs/wrapped-passphrase - | ecryptfs-add-passphrase --fnek -
Error: Your kernel does not support filename encryption

[helpmepi]

I have ran sudo rpi-update 46d179597370c5145c7452796acbee0f1ff93392 to downgrade to a previous Kernal version and I'm now able to log in correctly.

Is there any more testing I can do or does it seem there is a problem with the newer kernal and file name encryption?

EDIT:

I've now ran sudo rpi-update 993f47507f287f5da56495f718c2d0cd05ccbc19 and this also seems to be working now?

One question I have now though, since I've used rpi-update, will I continue to get kernal updates via apt update?

[jamesh]

We've had a ponder, and not sure what might have happened. We haven't disabled any encryption etc.

How did you set this encrypted account up in the first place? Is this replicable on a new SD card with the latest Raspbian?

[trejan]

We've had a ponder, and not sure what might have happened. We haven't disabled any encryption etc.

How did you set this encrypted account up in the first place? Is this replicable on a new SD card with the latest Raspbian?

The encryption is a red herring I think. There is an "mount: No such device" error in their log and then it complains about not being able to access files in their home directory. Reverting the firmware fixed it so it sounds like it is this USB issue which is affecting their external USB drive.

[jamesh]

We've had a ponder, and not sure what might have happened. We haven't disabled any encryption etc.

How did you set this encrypted account up in the first place? Is this replicable on a new SD card with the latest Raspbian?

The encryption is a red herring I think. There is an "mount: No such device" error in their log and then it complains about not being able to access files in their home directory. Reverting the firmware fixed it so it sounds like it is this USB issue which is affecting their external USB drive.

Could be, but OP didn't mention data was on a USB attached device.

OP, what system setup do you have?

[helpmepi]

Thanks for the help.

The user account that was encrypted was on the microSD card, not on the seperate USB storage.

To encrypt it in the first place, I think I used the command sudo ecryptfs-migrate-home -u pi and then migrated the docs across.

I'm not sure if it's replicable on a new version of Raspbian, but I had a backup from last week from before I did the sudo apt update etc and that booted first time without a problem.

When I reverted back to the upgraded image I had that wouldn't properly work, it would try to log in but wouldn't unlock the account. That's when I tried to downgrade the kernel using rpi-update.

I'm not 100% sure, but I don't know if the header when logging into the Pi actually changed when the kernel was supposed to be updated ("Linux raspberrypiv4 4.19.97-v7l+ #1293 SMP Wed Jan 22 17:16:14 GMT 2020 armv7l") so could it have been that the update on my Pi didn't properly work? I think it may have said "Linux raspberrypiv4 4.19.75-v7l+ #1270 SMP Tue Sep 24 18:51:41 BST 2019 armv7l" even after running the update, but as I say I'm not 100% sure.

I have since upgraded the kernel to the latest on Github, but I'm happy to give any version a try when I've got a minute if it would help? Also, could I have caused any upgrading problems in the future by manually running rpi-update?

Thanks again.

[helpmepi]

So, I've just ran a
sudo apt update
sudo apt install --reinstall raspberrypi-bootloader raspberrypi-kernel

To revert back to the stable firmware and the pi is still working correctly. It is now running "Linux raspberrypiv4 4.19.93-v7l+ #1290 SMP Fri Jan 10 16:45:11 GMT 2020 armv7l"

I have a feeling that for some reason my pi might have not done the initial upgrade correctly as I seem to think the header didn't change when it should have done. It all seems to be working ok now though and think it may have just been a strange case or something weird on my pi.