Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I would like to set up disk encryption on Ubuntu 13.10 such that I have

  • plain /
  • encrypted /home partition
  • encrypted swap partition
  • working hibernation and resume

As these requirements suggest, this is to protect me from a potential laptop thief reading my personal data. With / being unencrypted, it does not protect from somebody taking the laptop, installing a keylogger, and giving it back to me.

I have read EnableHibernateWithEncryptedSwap but it's written for Ubuntu 12.04, and I'm not confident that it still works or that it's the recommended way.

What would be up-to-date setup?

share|improve this question

1 Answer 1

I managed to set up an encrypted home and encrypted swap with working hibernate.

I use uswsusp and largely followed this article - still works for Ubuntu 13.10.

  • On boot, I get two password prompts (one for home and one for swap) under the Ubuntu logo.
  • With apt-get install uswsusp, Ubuntu automatically switched pm-hibernate to use uswsusp, so all GUI tools use it as well.
  • On resume from hibernate, I get one password prompt as expected.

Some parts of my setup:

Creating the encrypted partitions

# For /home
sudo cryptsetup --cipher aes-xts-plain --key-size 256 --hash sha512 --use-random --verify-passphrase luksFormat /dev/sdb2
# For swap
sudo cryptsetup --cipher aes-xts-plain --key-size 256 --hash sha512 --use-random --verify-passphrase luksFormat /dev/sdb3
  • I use aes-xts-plain because it is the fastest in cryptsetup benchmark (only works with cryptsetup >= 1.6). Many guides uses aes-cbc-essiv, but from what I've read so far, xts protects against watermarking just as well as cbc-essiv. If you use partitions >= 2TB, you should use aes-xts-plain64 instead of -plain. More info about these options and choices can be found here.

/etc/crypttab

cryptohome   /dev/disk/by-uuid/8cef7fd1-cceb-4a4a-9902-cb9a5805643c   none   luks,discard
cryptoswap   /dev/disk/by-uuid/a99c196d-55df-460f-a162-00c4ea6d46e6   none   luks,discard

/etc/fstab

UUID=a4a2187d-a2d2-4a4c-9746-be511c151296  /       ext4   errors=remount-ro  0  1
/dev/mapper/cryptoswap                     none    swap   sw,discard         0  0
/dev/mapper/cryptohome                     /home   ext4   discard            0  2
  • I use the discard option in boths crypttab and fstab to enable TRIM for the SSD I'm using.
  • I had to adjust /etc/initramfs-tools/conf.d/resume away from the old swap UUID to the new /dev/mapper/cryptoswap to get rid of a warning at update-initramfs -u -k all.

This is still very similar to EnableHibernateWithEncryptedSwap, but it looks like I didn't have to edit /usr/share/initramfs-tools/scripts/local-top/cryptroot, /etc/acpi/hibernate.sh (if you have a hint why it was needed, please leave a comment - maybe the difference is that this setup uses uswsusp?).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.