December 25, 2008
I’m often asked how I crypt my notebooks. I normally crypt only my home partition and sometimes (more on servers in remote locations, than on notebooks) the swap partition. I use for this Linux Unified Key Setup (Luks), as it allows up to 8 passwords for a partition and you can change them without reformatting the partition. It also stores the used encryption method so you can use it also for encrypting external hard disks and you don’t need to keep track which encryption algorithms you used for it.
First you install your notebook with a swap and a root partition, but leave space for a /home partition. After the installation is finished you create the partition e.g. with cfdisk or fdisk. You need to restart your system after creating a new partition. In my example I call it /dev/sda3. Now you can tell cryptsetp (which you need to install on Ubuntu with apt-get install cryptsetup, reboot after installing it if the setup does not work) to create a container with following command
cryptsetup --cipher aes-cbc-essiv:sha256 --key-size 128 luksFormat /dev/sda3
After you did this, you need to open the container with
cryptsetup luksOpen /dev/sda3 home
Now you can format the container:
mkfs.ext3 -m 0 /dev/mapper/home
ps: -m 0 means that no blocks are reserved for root, as it is our home partition.
Now you need to go to the console of your system (
ALT-CTRL-F1) and login there and stop the X server (log off before that 😉 ). On Ubuntu you do this by calling
/etc/init.d/gdm stop on Kubuntu
Now you can mount the new partition on a temporary location and copy your home directory over.
mount /dev/mapper/home /mnt/
cp -a /home/* /mnt/.
Now we need to unmount it and close the crypto container.
cryptsetup luksClose home
Now we need to configure the system that it is launched at the boot time. Add following line to
home /dev/sda3 none luks
and in your
/etc/fstab you add following:
/dev/mapper/home /home ext3 noatime,nodiratime 0 0
Now everything is done. Reboot your system and you will be prompted for the password of your home partition. If you don’t enter it your system will use the “old” home directory.