Home partition encryption with LUKS under Linux

December 25, 2008

I’m often asked how I crypt my notebooks. I normally crypt only my home partition and sometimes (more on servers in remote locations, than on notebooks) the swap partition. I use for this Linux Unified Key Setup (Luks), as it allows up to 8 passwords for a partition and you can change them without reformatting the partition. It also stores the used encryption method so you can use it also for encrypting external hard disks and you don’t need to keep track which encryption algorithms you used for it.

First you install your notebook with a swap and a root partition, but leave space for a /home partition. After the installation is finished you create the partition e.g. with cfdisk or fdisk. You need to restart your system after creating a new partition. In my example I call it /dev/sda3. Now you can tell cryptsetp (which you need to install on Ubuntu with apt-get install cryptsetup, reboot after installing it if the setup does not work) to create a container with following command

cryptsetup --cipher aes-cbc-essiv:sha256 --key-size 128 luksFormat /dev/sda3

After you did this, you need to open the container with

cryptsetup luksOpen /dev/sda3 home

Now you can format the container:

mkfs.ext3 -m 0 /dev/mapper/home

ps: -m 0 means that no blocks are reserved for root, as it is our home partition.

Now you need to go to the console of your system (ALT-CTRL-F1) and login there and stop the X server (log off before that 😉 ). On Ubuntu you do this by calling /etc/init.d/gdm stop on Kubuntu /etc/init.d/kdm stop.

Now you can mount the new partition on a temporary location and copy your home directory over.

mount /dev/mapper/home /mnt/ cp -a /home/* /mnt/.

Now we need to unmount it and close the crypto container.

umount /mnt/ cryptsetup luksClose home

Now we need to configure the system that it is launched at the boot time. Add following line to /etc/crypttab:

home /dev/sda3 none luks

and in your /etc/fstab you add following:

/dev/mapper/home /home ext3 noatime,nodiratime 0 0

Now everything is done. Reboot your system and you will be prompted for the password of your home partition. If you don’t enter it your system will use the “old” home directory.

In HowTo, IT Security, Linux | 6 Comments

6 Comments »

RSS feed for comments on this post. TrackBack URI

I like to encrypt swap and /home, but not do full disk encryption (encrypt the LVM partition) as I find it does degrade performance a little. And I also like to keep an unencrypted /data partition around.

I have found it useful to make a small luks partition, I mount it as /private, I then put the passwords for my other encrypted partitions in there. That way I’m only prompted once at boot for a password, instead of for each partition.

It also gives you a good place to drop files that have passwords in plain text that would otherwise be in /etc (pptp).

Comment by Jason — December 29, 2008 #
Thanks for your clear how-to. I used it to encrypt the SD card on my eeepc 900A as the home partition. Question: what do you think about using pam_mount?

Comment by Donnie Pennington — January 11, 2009 #
BTW the LUKS link you list doesn’t work. This one does (for now):

http://clemens.endorphin.org/LUKS

Comment by Donnie Pennington — January 11, 2009 #
@Jason: Ubuntu/Kubuntu does it your way if you choose it in the alternative install cd.

@Pennington: I use a default login if I’ve a luks home partition, as any attacker does not get to the real home directory and so I don’t need to enter the password two times. But pam_mount is also ok, just keep in mind that you don’t mount it 2 times (e.g. on every ssh login)

Comment by robert — June 18, 2009 #
[…] installation, but you can encrypt /home using cryptsetup in Synaptic post install, I think. Home partition encryption with LUKS under Linux | Robert Penz Blog There is also Truecrypt in Synaptic if you want to encrypt a partition. Anyway, I would advise […]

Pingback by WP GNU/Linux: Apartheid - Page 4 - Stormfront — March 22, 2011 #
[…] later with a bit of hard work. I've never tried it, but the information is (as ever) out there: http://robert.penz.name/145/home_par…s_under_linux/ […]

Pingback by Disk encryption — January 10, 2013 #

Home partition encryption with LUKS under Linux

6 Comments »

Leave a comment