How to configure a passfile for fstab?

[psxvoid]

Hi,

Probably a dumb question, but how can I properly configure the passfile for fstab? The docs say:

Adding this line to /etc/fstab will mount /tmp/cipher to /tmp/plain on boot, using the password in /tmp/passfile. Use sudo mount -av > to test the line without having to reboot. Adjust the gocryptfs path acc. to the output of the command which gocryptfs. Do use the nofail option to prevent an unbootable system if the gocryptfs mount fails (see the -nofail option for details).

/tmp/cipher /tmp/plain fuse./usr/local/bin/gocryptfs nofail,allow_other,passfile=/tmp/password 0 0

I do understand everything except passfile=/tmp/password. How to securely generate /tmp/password?

P.S.: I'm using Ubuntu 22 on ARM.

[rfjakob]

This, for example, is bulletproof:

openssl rand -base64 32

[psxvoid]

Thanks, guess generating a password is an easy part.

This, for example, is bulletproof:

openssl rand -base64 32

But how to put the generated password into /tmp/password SECURELY? Should I mount a kind of an image containing the password in a file callded password into tmpfs volume mounted as /tmp/?

To add a bit of context: I'm using a raspberry pi 4 as a server booted from a non-encrypted sdcard. And for this reason I would like to use gocryptfs to secure some directories in case the PI itself gets stolen physically. That's why I'm trying to find ways to NOT just put a plain password on a non-encrypted volume, but somehow make it more secure than the rest of the system.

[rfjakob]

I believe the only secure way to do this is to enter (or copy) the password every time the server is rebooted.

That's how full-disk encryption (like LUKS) works, too.