There are six steps:
1. Partition setup
2. Installation
3. Encrypt data partition
4. Create crypttab file; Edit fstab; Update initramfs
5. Create mount point and symlinks
6. Reboot to test
Partition setup. I do this with GParted in the live session, before running the installer. Main reason is that Step 3 is easier if the partition already exists. For illustration, I'm using a virtual machine (VirtualBox), BIOS boot, with two partitions: 30 GB each for System and Data partition. A real system might have an EFI parition, a larger system partition, a much larger data partition, and/or other partitions besides those three. The system and data partitions do not need to be on the same drive; for example, the system can be on an SSD and the data partiton on a separate HDD.
Installation. Same as usual, except need to use manual method (Customize the disk layout) to preserve the partition table. No home partition; will be a mere directory on the system partition. No need for a swap partition, though it's supported; if none, will get a swap file. I prefer to enable autologin on the user account screen, on the theory the data partition's LUKS password becomes, in effect, the login password.
Encrypt data partition. Shut down live session, then boot into installed system. Can do usual other steps first (e.g., update, setup, Timeshift) or wait until after have set up data partition. For the latter, open Terminal and run three commands in this form:
Code: Select all
sudo cryptsetup --cipher aes-xts-plain64 --key-size 512 --hash sha512 -v luksFormat /dev/sda2
sudo cryptsetup -v luksOpen /dev/sda2 Data
sudo mkfs -t ext4 -L Data /dev/mapper/DataCreate crypttab; Edit fstab; Update initramfs.
Code: Select all
lsblk -f
echo "Data UUID=<copy-from-lsblk> none luks,discard" | sudo tee -a /etc/crypttab
echo "/dev/mapper/Data /data ext4 defaults,noatime,nofail 0 2" | sudo tee -a /etc/fstab
sudo update-initramfs -uCreate mount point and symlinks.
Code: Select all
sudo mkdir /data ; sudo mount -a ; sudo chown -R $USER:$USER /data
mv $HOME/Documents /data ; sudo mv $HOME/Downloads /data ; sudo mv $HOME/Music /data ; sudo mv $HOME/Pictures /data ; sudo mv $HOME/Videos /data
ln -s /data/Documents $HOME ; ln -s /data/Downloads $HOME ; ln -s /data/Music $HOME ; ln -s /data/Pictures $HOME ; ln -s /data/Videos $HOME
sudo umount /data ; sudo chown root:root /dataReboot to test. Main thing we are testing is whether the LUKS password for the data partition (a) is required and (b) sufficient to reach the desktop. Also, open File Manager to make sure the Big Five folders show as symlinks.
Recap. I think it helps understand the process to see how things turn out in the end.
Code: Select all
lsblk -f
NAME FSTYPE FSVER LABEL UUID FSAVAIL FSUSE% MOUNTPOINTS
sda
├─sda1 ext4 1.0 System f18cdee9-912a-4a89-9015-5077287063b4 19.1G 30% /
└─sda2 crypto_LUKS 2 6bf7e64b-8c93-41ee-8072-3fbd7ff231c2
└─Data ext4 1.0 Data cac554cb-4d82-4a43-9388-a6bb18cf906f 27.8G 0% /data
sr0Code: Select all
cat /etc/crypttab
Data UUID=6bf7e64b-8c93-41ee-8072-3fbd7ff231c2 none luks,discardCode: Select all
cat /etc/fstab
# Pluggable devices are handled by uDev, they are not in fstab
UUID=f18cdee9-912a-4a89-9015-5077287063b4 / ext4 noatime 0 1
/swapfile swap swap defaults 0 0
/dev/mapper/Data /data ext4 defaults,noatime,nofail 0 2Other Notes:
If something bad happens to encrypted data, no form of data recovery can help. Don't be the person who says, "Yeah, yeah, I know I should have ... " The backup can be encrypted or not as appropriate under the circumstances.
Other folders in home can be moved to the data partition if you want them to be encrypted. Two likely candidates are .mozilla (for Firefox) and .thunderbird (especially if you like to archive emails). As with the regular Big Five, symlink the folders from the data partition back into home at their usual location.
VirtualBox access. Be aware, VBox's shared folder function cannot access files through symlinks. (This is true whether or not encryption is in play.) If you want guests to have access to the host's data partition, you must specify the mount point (or one-or-more of its sub-folders) as the shared folder. I don't know how other virtualization apps handle symlinks.
Backup LUKS header. The header is the Achilles heel of an encrypted volume. If it gets corrupted, the volume cannot be opened. To backup, sudo cryptsetup luksHeaderBackup /dev/sda2 --header-backup-file luksheader-data. Move from current directory (usually $HOME) to a location where it will be backed up as a matter of course. The header isn't sensitive (can't be read by a hacker), so doesn't need to be saved in an encrypted location. To restore, copy back to current directory and run sudo cryptsetup luksHeaderRestore /dev/sda2 --header-backup-file luksheader-data.
Encrypted system. The procedure described above works fine with system encryption (i.e., encrypting both partitions) if you don't mind entering two passwords (or the same password twice). You can boot with a single password, though, if you mount the data partition with a keyfile saved inside the encrypted system partition. After encrypting the data partition per Step 3, create the keyfile and add as an additional key:
Code: Select all
sudo dd if=/dev/urandom of=/root/.keyfile bs=1024 count=4
sudo chmod 0400 /root/.keyfile
sudo cryptsetup luksAddKey /dev/sda2 /root/.keyfilecryptsetup. If not familiar, start with the man page. Then, like most thing Linux, do some research on the internet.
. Two remarks:
). Not sure what the OOTB state is but in my case VBox has always accepted symlinks... but then again, my original install is many years old so I may well have fiddled with this.
