This is a great howto, thanks.

But it misses one important information, which is what happens when the user changes his password. As the login password is used to decrypt the encfs files, it will no more possible to decrypt them at the next login.

To avoid that, we should use encfsctl, which is provided with encfs, to reencrypt the files with the new password. This can not be done with pam_script without modifying it to manage event like onpasswdchange for example, but we can rename the binary passwd in passwd.bin and add a new shell passwd which will ask twice the password, call passwd.bin to update the user password and if the last call succeed, call encfsctl to reencrypt the files as well as update the reference to the password file password.tmp.