Arch Linux

BåGan

Member

From: Norway

Registered: 2008-09-06

Posts: 6

Encryption on /home and /swap

Hello everyone!

I'm soon converting to the Linux world from Vista fulltime. And to prep myself for future disasters I'm writing step-by-step doc from /arch/setup to fully functional OS so that I wont have to rely on having another pc with internett access if something goes wrong and if I ever need to reinstall Arch. And over to my question:

I've read LUKS wiki about system encryption, but I really dont see the need to encrypt the root. Either I'm blind or it isnt metioned how to encrypt only /home and how this will work in practise(how will the /home be mounted? On login or a password phrase on the bootup?)? I guess I can follow the wiki on the swap?

Thanks for all the help in advance

Odd-rationale

Member

Registered: 2008-02-05

Posts: 102

Re: Encryption on /home and /swap

I believe that it will be mounted by using the passphrase/file given in /etc/crypttab

cameron122000

Member

Registered: 2008-03-02

Posts: 30

Re: Encryption on /home and /swap

Encryption is only useful if you don't mount the filesystem on boot. In order for the point of encryption to work, you need to manually mount it so that if somebody were to gain access to your computer, they would have to know the password in order to mount the partition to see the contents.

arch0r

Member

From: From the Chron-o-John

Registered: 2008-05-13

Posts: 597

Re: Encryption on /home and /swap

imho it makes no sense only to encrypt home because the password is saved in /etc/crypttab which is on anoterh partition (u can also use a key eg a usb stick for decryption)

Last edited by arch0r (2008-12-29 22:16:04)

sirius

Member

From: Norway

Registered: 2008-12-25

Posts: 68

Re: Encryption on /home and /swap

I use pam_mount to luksOpen and mount the LUKS partition over my /home/$USER on login, and unmount and luksClose when I log out. I've set my login password equal to my encryption password, however, so it's not as secure as having different passwords for login and LUKS, but it works well for me. You may use different passwords, but then you'll have to patch XDM/KDM/GDM (I think) - works in vc, though.

A different solution is to not store the password in /etc/crypttab, only partition and mountpoint. Upon boot you'll have to enter a password to decrypt and mount the partition, or not entering the passord and continue booting without decrypting and mounting.

kludge

Member

Registered: 2008-08-03

Posts: 294

Re: Encryption on /home and /swap

Encryption is only useful if you don't mount the filesystem on boot. In order for the point of encryption to work, you need to manually mount it so that if somebody were to gain access to your computer, they would have to know the password in order to mount the partition to see the contents.

not necessarily, as you can set crypttab to 'ASK' for a passphrase at boot.  it's right there in the /etc/crypttab file.  that's for mounting at boot time.

that said, i'm pretty sure the wiki page on system encryption includes some instructions for setting up non-root encrypted partitions and /etc/crypttab.  and if it isn't in the archwiki, there are quite a few threads on this forum about it.  and failing that, i know i found lots of good info with google when i first set-up my system.

BaGan: use the goog, and may the goog be with you!

Last edited by kludge (2008-12-29 23:28:30)

---

[23:00:16]    dr_kludge | i want to invent an olfactory human-computer interface, integrate it into the web standards, then produce my own forked browser.
[23:00:32]    dr_kludge | can you guess what i'd call it?
[23:01:16]    dr_kludge | nosilla.
[23:01:32]    dr_kludge | i really should be going to bed.  i'm giggling madly about that.