Results 1 to 6 of 6

Thread: Home partition on separate encrypted drive

  1. #1
    Join Date
    Oct 2011
    Beans
    15

    Home partition on separate encrypted drive

    I'm trying to do an encrypted install of Server 12.04 with /home on a second encrypted drive.

    I can't select 'use as: physical volume for encryption' but there's no prompt for either the passphrase or keyfile (I want a keyfile, the passphrase was just a test attempt). The partition keeps saying it's not active, even after I try to activate encrypted volumes. I don't get any options to pick a filesystem or mount point either.

    How do I get the second encrypted drive to activate?

  2. #2
    Join Date
    Mar 2007
    Location
    Denver, CO
    Beans
    7,605
    Distro
    Ubuntu 12.04 Precise Pangolin

    Re: Home partition on separate encrypted drive

    I can't say I've done exactly what you want to do, however are you trying to set this up manually or during the installation process. And if I understand you correctly you want the /home partition on a separate hard drive as compared to the rest of the system.

  3. #3
    Join Date
    Oct 2011
    Beans
    15

    Re: Home partition on separate encrypted drive

    Yes, the /home directory is to be on a separate physical drive.

    I gave up trying to set this up during the install, I couldn't get it to work. I made the appropriate entries in crypttab and fstab, changed the default home path in default/useradd, copied my files over, rebooted, and everything works great.

    Still not sure if I was doing something wrong during the install or if it's a bug.

  4. #4
    Join Date
    Mar 2007
    Location
    Denver, CO
    Beans
    7,605
    Distro
    Ubuntu 12.04 Precise Pangolin

    Re: Home partition on separate encrypted drive

    Sounds like you should write a quick tutorial on the matter.

  5. #5
    Join Date
    Apr 2006
    Location
    Montana
    Beans
    Hidden!
    Distro
    Kubuntu Development Release

    Re: Home partition on separate encrypted drive

    You used to be able to do what you want during partitioning from the alternate CD, but you had to understand what you were doing.

    You might need to do this post-install manually.

    The ubuntu wiki seems outdated, try the arch wiki

    https://wiki.archlinux.org/index.php/Dm-crypt_with_LUKS
    There are two mistakes one can make along the road to truth...not going all the way, and not starting.
    --Prince Gautama Siddharta

    #ubuntuforums web interface

  6. #6
    Join Date
    Oct 2011
    Beans
    15

    Re: Home partition on separate encrypted drive

    How to setup a second encrypted hard drive and move your home directory to it:

    Let's make a keyfile for it second drive, which I'll be calling cryptextra.

    Code:
    sudo dd if=/dev/urandom of=/etc/keys/cryptextra bs=2048 count=1
    Restrict access to root

    Code:
    sudo chmod 600 /etc/keys/cryptextra
    Setup LUKS on second drive. Be absolutely sure you have the right drive! If you get it wrong there is NO undo!

    Code:
    sudo cryptsetup luksFormat /dev/sdb1 /etc/keys/cryptextra
    Open cryptextra and make a filesystem.

    Code:
    sudo cryptsetup --key-file /etc/keys/cryptextra /dev/sdb1 cryptextra
    sudo mkfs.ext4 /dev/mapper/cryptextra
    Time to setup some config files to auto mount. First, put an appropriate entry in /etc/fstab

    Code:
    UUID=abcdef.... /mnt/cryptextra ext4 defaults 0 2
    And /etc/crypttab. 'noearly' is optional, but you will get a prompt to skip mounting or recover manually on boot if you don't have it.

    Code:
    cryptextra UUID=123456 /etc/keys/cryptextra luks,noearly
    Use 'blkid' to get the UUIDs above. IMPORTANT: The LUKS device UUID goes in crypttab, the UUID for the actual filesystem goes in fstab!

    You should reboot at this point to make sure everything works correctly up to this point.

    It's time to start moving our home directory.

    Code:
    sudo mkdir -p /mnt/cryptextra/home/user
    sudo chown user:user /mnt/cryptextra/home/user
    I had trouble with the next part. Supposedly, all you have to move is the .ecryptfs and .Private folder. That didn't work for me, I had to move the files separately of them. Copy everything in your home directory besides to two ecryptfs files somewhere safe.

    Code:
    ecryptfs-unmount-private
    rsync -avP .ecryptfs .Private /mnt/cryptextra/home/user
    Change your home directory in /etc/passwd. The file is quite simple and this should be obvious.

    Log out and log back in.

    If you want to permanently set the home directory for all new users you create later, edit /etc/default/useradd.

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •