Arch Linux

rootpeer

Member

Registered: 2019-04-07

Posts: 45

1.) Moving from partitions to LVM and 2.) encrypting sensitive data

Hi. I am currently running my first Arch install that uses disk partitions and no encryption. Unfortunately, I didn't know any better when installing.

At first, I wanted to move to LVM and full disk encryption but I need to be able to wake-on-lan the computer from remote locations, so that idea is scrapped.

I want my home partition to be encrypted, so anyone with physical access to my Arch drive cannot access my data. I am not worried about evil maid attacks, kernels with keyloggers etc, I just want to prevent anyone from freely reading my data off the disk.

1.) Is there an easy way to "convert" my setup to LVM?

2.) Is there an easy way to encrypt my home "partition" on LVM and will it work with WoL? Do I have to store my data on a "partition" different than home in order to be able to boot the system from afar and then have to decrypt the "partition" with a password?

Thanks

sabroad

Member

Registered: 2015-05-24

Posts: 242

Re: 1.) Moving from partitions to LVM and 2.) encrypting sensitive data

ext4 supports file-based encryption. In a directory tree marked for encryption, file contents, filenames, and symbolic link targets are all encrypted.
To enable the encryption feature flag on the filesystem:

# tune2fs -O encrypt /dev/device

For PAM integration to unlock a [home] directory on login, try fscrypt.

---

--
saint_abroad

frostschutz

Member

Registered: 2013-11-15

Posts: 1,658

Re: 1.) Moving from partitions to LVM and 2.) encrypting sensitive data

1.) Is there an easy way to "convert" my setup to LVM?

for in-place conversion to LVM, there is `blocks to-lvm` ( https://github.com/g2p/blocks )

and cryptsetup-reencrypt could LUKS it

on both accounts the filesystem has to shrink a bit (or the partition grow a bit) to make room for LVM / LUKS metadata. For LUKS1 2MiB, LUKS2  16MiB and for LVM it used to be 1MiB but has also grown to 2MiB or 4MiB I don't remember...

edit: as always with inplace operations: make a backup first

Last edited by frostschutz (2019-06-15 11:32:10)