How to encrypt and automount a data partition (system not encrypted)
Posted: Fri Jul 21, 2023 11:57 pm
This is an alternative to full disk encryption. Frankly, I don't worry about someone tampering with the operating system. What I care about are data files. Meanwhile, repairing an encrypted system can be difficult. I encrypt a data partition rather than home because (a) it's easier to manage backups; (b) it's easier to share an encrypted data partition on a multi-boot system; and (c) any advantage at reinstall of recycling /home other than data (e.g., config files) can be captured easily by ordinary copy-and-paste. Main drawback of the strategy is that it isn't supported by the MX installer. Can be done manually, though, by anyone moderately comfortable with command line and editing config files.
There are six steps:
1. Partition setup
2. Installation
3. Encrypt data partition
4. Create crypttab file; Edit fstab; Update initramfs
5. Create mount point and symlinks
6. Reboot to test
Partition setup. I do this with GParted in the live session, before running the installer. Main reason is that Step 3 is easier if the partition already exists. For illustration, I'm using a virtual machine (VirtualBox), BIOS boot, with two partitions: 30 GB each for System and Data partition. A real system might have an EFI parition, a larger system partition, a much larger data partition, and/or other partitions besides those three. The system and data partitions do not need to be on the same drive; for example, the system can be on an SSD and the data partiton on a separate HDD.
Installation. Same as usual, except need to use manual method (Customize the disk layout) to preserve the partition table. No home partition; will be a mere directory on the system partition. No need for a swap partition, though it's supported; if none, will get a swap file. I prefer to enable autologin on the user account screen, on the theory the data partition's LUKS password becomes, in effect, the login password.
Encrypt data partition. Shut down live session, then boot into installed system. Can do usual other steps first (e.g., update, setup, Timeshift) or wait until after have set up data partition. For the latter, open Terminal and run three commands in this form:
Note: Modify /dev/sda2 if (as is likely) the data partition is located elsewhere. Another label may be used if preferred, e.g., Data-Files, but avoid spaces.
Create crypttab; Edit fstab; Update initramfs.
Note: The UUID to copy for crypttab is the LUKS container, in this case sda2, not the decrypted file system. A text editor could be used to create crypttab and edit fstab; tee just seems to me easier. The discard parameter for crypttab is only useful for an SSD (enables trim), but harmless for an HDD; can be omitted for the latter if you prefer things tidy. If using a different mount point (see next), modify the fstab command to match.
Create mount point and symlinks.
Note: These commands move the Big Five folders in Home to the data partition, then symlink them back. The upshot is that the folders are visible in Home, but actually located on the data partition. Mounting at /data is non-standard under the Filesystem Hierarchy Standard; /media and /mnt don't really fit either, though, so might as well use something clear and simple. If you prefer to mount in /media or /mnt, that works also; of course, modify the commands to match.
Reboot to test. Main thing we are testing is whether the LUKS password for the data partition (a) is required and (b) sufficient to reach the desktop. Also, open File Manager to make sure the Big Five folders show as symlinks.
Recap. I think it helps understand the process to see how things turn out in the end.
Note: During installation (MX-23), I modified /swap/swap to /swapfile, because that's the standard configuration and works fine with ext4. The change has no relevance to this tutorial; the installer's default would have worked just as well. Likewise, I've set the 'dump' parameter in fstab to zero, because that's what I'm used to; the MX default of '1' is harmless AFAIK.
Other Notes:
If something bad happens to encrypted data, no form of data recovery can help. Don't be the person who says, "Yeah, yeah, I know I should have ... " The backup can be encrypted or not as appropriate under the circumstances.
Other folders in home can be moved to the data partition if you want them to be encrypted. Two likely candidates are .mozilla (for Firefox) and .thunderbird (especially if you like to archive emails). As with the regular Big Five, symlink the folders from the data partition back into home at their usual location.
VirtualBox access. Be aware, VBox's shared folder function cannot access files through symlinks. (This is true whether or not encryption is in play.) If you want guests to have access to the host's data partition, you must specify the mount point (or one-or-more of its sub-folders) as the shared folder. I don't know how other virtualization apps handle symlinks.
Backup LUKS header. The header is the Achilles heel of an encrypted volume. If it gets corrupted, the volume cannot be opened. To backup, sudo cryptsetup luksHeaderBackup /dev/sda2 --header-backup-file luksheader-data. Move from current directory (usually $HOME) to a location where it will be backed up as a matter of course. The header isn't sensitive (can't be read by a hacker), so doesn't need to be saved in an encrypted location. To restore, copy back to current directory and run sudo cryptsetup luksHeaderRestore /dev/sda2 --header-backup-file luksheader-data.
Encrypted system. The procedure described above works fine with system encryption (i.e., encrypting both partitions) if you don't mind entering two passwords (or the same password twice). You can boot with a single password, though, if you mount the data partition with a keyfile saved inside the encrypted system partition. After encrypting the data partition per Step 3, create the keyfile and add as an additional key:
In Step 4, replace the crypttab command with echo "Data UUID=<copy-from-lsblk> /root/.keyfile luks,discard" | sudo tee -a /etc/crypttab. crypttab ends up with two lines, one for each partition.
cryptsetup. If not familiar, start with the man page. Then, like most thing Linux, do some research on the internet.
There are six steps:
1. Partition setup
2. Installation
3. Encrypt data partition
4. Create crypttab file; Edit fstab; Update initramfs
5. Create mount point and symlinks
6. Reboot to test
Partition setup. I do this with GParted in the live session, before running the installer. Main reason is that Step 3 is easier if the partition already exists. For illustration, I'm using a virtual machine (VirtualBox), BIOS boot, with two partitions: 30 GB each for System and Data partition. A real system might have an EFI parition, a larger system partition, a much larger data partition, and/or other partitions besides those three. The system and data partitions do not need to be on the same drive; for example, the system can be on an SSD and the data partiton on a separate HDD.
Installation. Same as usual, except need to use manual method (Customize the disk layout) to preserve the partition table. No home partition; will be a mere directory on the system partition. No need for a swap partition, though it's supported; if none, will get a swap file. I prefer to enable autologin on the user account screen, on the theory the data partition's LUKS password becomes, in effect, the login password.
Encrypt data partition. Shut down live session, then boot into installed system. Can do usual other steps first (e.g., update, setup, Timeshift) or wait until after have set up data partition. For the latter, open Terminal and run three commands in this form:
Code: Select all
sudo cryptsetup --cipher aes-xts-plain64 --key-size 512 --hash sha512 -v luksFormat /dev/sda2
sudo cryptsetup -v luksOpen /dev/sda2 Data
sudo mkfs -t ext4 -L Data /dev/mapper/DataCreate crypttab; Edit fstab; Update initramfs.
Code: Select all
lsblk -f
echo "Data UUID=<copy-from-lsblk> none luks,discard" | sudo tee -a /etc/crypttab
echo "/dev/mapper/Data /data ext4 defaults,noatime,nofail 0 2" | sudo tee -a /etc/fstab
sudo update-initramfs -uCreate mount point and symlinks.
Code: Select all
sudo mkdir /data ; sudo mount -a ; sudo chown -R $USER:$USER /data
mv $HOME/Documents /data ; sudo mv $HOME/Downloads /data ; sudo mv $HOME/Music /data ; sudo mv $HOME/Pictures /data ; sudo mv $HOME/Videos /data
ln -s /data/Documents $HOME ; ln -s /data/Downloads $HOME ; ln -s /data/Music $HOME ; ln -s /data/Pictures $HOME ; ln -s /data/Videos $HOME
sudo umount /data ; sudo chown root:root /dataReboot to test. Main thing we are testing is whether the LUKS password for the data partition (a) is required and (b) sufficient to reach the desktop. Also, open File Manager to make sure the Big Five folders show as symlinks.
Recap. I think it helps understand the process to see how things turn out in the end.
Code: Select all
lsblk -f
NAME FSTYPE FSVER LABEL UUID FSAVAIL FSUSE% MOUNTPOINTS
sda
├─sda1 ext4 1.0 System f18cdee9-912a-4a89-9015-5077287063b4 19.1G 30% /
└─sda2 crypto_LUKS 2 6bf7e64b-8c93-41ee-8072-3fbd7ff231c2
└─Data ext4 1.0 Data cac554cb-4d82-4a43-9388-a6bb18cf906f 27.8G 0% /data
sr0Code: Select all
cat /etc/crypttab
Data UUID=6bf7e64b-8c93-41ee-8072-3fbd7ff231c2 none luks,discardCode: Select all
cat /etc/fstab
# Pluggable devices are handled by uDev, they are not in fstab
UUID=f18cdee9-912a-4a89-9015-5077287063b4 / ext4 noatime 0 1
/swapfile swap swap defaults 0 0
/dev/mapper/Data /data ext4 defaults,noatime,nofail 0 2Other Notes:
If something bad happens to encrypted data, no form of data recovery can help. Don't be the person who says, "Yeah, yeah, I know I should have ... " The backup can be encrypted or not as appropriate under the circumstances.
Other folders in home can be moved to the data partition if you want them to be encrypted. Two likely candidates are .mozilla (for Firefox) and .thunderbird (especially if you like to archive emails). As with the regular Big Five, symlink the folders from the data partition back into home at their usual location.
VirtualBox access. Be aware, VBox's shared folder function cannot access files through symlinks. (This is true whether or not encryption is in play.) If you want guests to have access to the host's data partition, you must specify the mount point (or one-or-more of its sub-folders) as the shared folder. I don't know how other virtualization apps handle symlinks.
Backup LUKS header. The header is the Achilles heel of an encrypted volume. If it gets corrupted, the volume cannot be opened. To backup, sudo cryptsetup luksHeaderBackup /dev/sda2 --header-backup-file luksheader-data. Move from current directory (usually $HOME) to a location where it will be backed up as a matter of course. The header isn't sensitive (can't be read by a hacker), so doesn't need to be saved in an encrypted location. To restore, copy back to current directory and run sudo cryptsetup luksHeaderRestore /dev/sda2 --header-backup-file luksheader-data.
Encrypted system. The procedure described above works fine with system encryption (i.e., encrypting both partitions) if you don't mind entering two passwords (or the same password twice). You can boot with a single password, though, if you mount the data partition with a keyfile saved inside the encrypted system partition. After encrypting the data partition per Step 3, create the keyfile and add as an additional key:
Code: Select all
sudo dd if=/dev/urandom of=/root/.keyfile bs=1024 count=4
sudo chmod 0400 /root/.keyfile
sudo cryptsetup luksAddKey /dev/sda2 /root/.keyfilecryptsetup. If not familiar, start with the man page. Then, like most thing Linux, do some research on the internet.
. Two remarks:
). Not sure what the OOTB state is but in my case VBox has always accepted symlinks... but then again, my original install is many years old so I may well have fiddled with this.
