I have a RHEL5 server running with the ecryptfs utilities installed. Here is what I am trying to do: Hopefully someone can help me. I've beat myself a few hours already but I do have ideas and want to make sure I'm on the right boat. I want the following to occur if possible. Either using PAM or AUTOFS.
PAM:
1. Remote user logs via FTP and PAM picks this up and mounts their encrypted home directory.
2. User uploads/downloads patient files
3. User exits and PAM unmounts the encrypted home directory until further use.

AUTOFS:
1. User logs in via FTP and AUTOFS automatically mounts encrypted /home/USER ecryptfs stack over the /home/USER ext3 version.
2. User uploads/downloads files
3. User logs out, autofs timeout is set to 1 second so it will auto unmount the encrypted stack from the lower level file system thus making the uploaded files unreadable unless the proper key is supplied.

Can i make any of the above mentioned work? AUTOFS doesn't seem to work correctly with fstype=ecryptfs but does work for the solution i want with other file system types. I'm running kernel 2.6.18-128 PAE on RHEL5 and ecryptfs-utils-56-8 and devel tools as well.
Thanks for any help

I don't follow. Your thread title reads something about "FTP login security". But your post is referring to filesystem security. Which do you need help with?

If i can get AUTOFS to work, it will also work for users that login VIA FTP to my system! The point of autofs is so that a user that FTP into the system, gets his directory auto mounted with ecryptfs, uploads data which is getting written encrypted, logs off, and after a 1 second time out the ecryptfs unmounts (Autofs) and everyone is happy because the data is encrypnted as opposed to leaving the ecryptfs mount on all the time which is readable. That's why it says FTP login security Any ideas? And yes I am already using CHROOT and our network has very good firewalls but you know how the people upstairs are!

Not to distract from the restated question, but the process you're describing still means authentication credentials are sent in clear text, right? Is that OK?

To further expound on this:

Those files are transmitted in the clear as well... is this ok?