Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I have an unencrypted $HOME (I used the very basic installation with no further partitioning and no encryption at all). Now I want to move my $HOME to an encrypted partition on an external drive (or move it there first and encrypt it later, doesn't matter). What are the steps I have to do assuming I have an unpartitioned drive? What I think is the main problem here for me: how do I mount the encrypted $HOME on login or startup?

Thanks in advance.

EDIT: This blog post is about the ecryptfs-migrate-home command. But now there is the problem: will it work for a user's home directory on an external drive mounted in /home?

share|improve this question

2 Answers 2

There are two popular options to encrypt the data in your home folder:

  1. using an encrypted block device between the physical disk and your filesystem: This method is known as encrypted partition, (full) disk encryption, LUKS or dm-crypt.

    The filesystem /home, /home/user or /path/to/sensitive/data will be stored in the encrypted block device. Before mounting the filesystem, typically early in the boot process, the system will ask for the password.

    This method typically requires to change the partition layout and is often used with LVM. If you want to go this route, I recommend finding a good tutorial (up-to-date with your Ubuntu version).

  2. using an encrypted filesystem on top of your normal filesystem. This method is known as ecryptfs or "Private" directory.

    For this setup, the existing partition table and filesystems are left untouched. The data, which should be encrypted, will be routed through the ecryptfs filesystem driver.

    Your system should already feature a Private directory, which works like this.

    Typically, your login password is used to generate the encryption password. In this case, you only have to type in the password once at the normal login prompt. The encryption "just works" transparently.

    You can use ecryptfs for your whole home directory. It's straightforward if you create a new user at the command line.

    adduser --encrypt-home newusername
    

    creates an encrypted home directory for newusername.

    The wiki provides more information on this method.

    As @dAnjou realized, there exists a script to enable ecryptfs for an existing user.

    Since ecryptfs works upon a filesystem, it does not matter, where the data is physically stored. Depending on the Ubuntu version or setup procedure, some ecryptfs meta data resides in /var/lib/ecryptfs. Mounting /home on external storage is possible and compatible with ecryptfs.

share|improve this answer
    
Sorry, but this doesn't answer the main question. @peck has already linked to the same wiki page as you did. And I there is a link to a blog which has this post. I just didn't have the time to respond here. –  dAnjou Aug 20 '11 at 0:52
    
@dAnjou I think you have all the information that you need, now. Rewrite the answer if you want to. –  Jan Aug 20 '11 at 18:29

If you have a fresh install it will make this easier for you. A good question is do you want encrypt your personal home folder or the whole home folder? You can mount the drive as the whole home or /home/user. I personally would set it up as a home/user. Use this video to set up the drive encryption. http://www.youtube.com/watch?v=M4JYkZxnhJw One thing I noted in the video is the encryption is created when the partition is created. So any data is lost on that partition.

You can also encrypt the partiton following the information here. https://help.ubuntu.com/community/EncryptedHome

share|improve this answer
    
Thanks for your answer but it doesn't answer the main question. At least I found this blog post because of your link to the wiki. –  dAnjou Aug 20 '11 at 0:54
    
I try to answer the best I can and appreciate your comment. –  peck Aug 20 '11 at 5:02

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.