7

How do I automount a LUKS encrypted partition in a secure way? Ideally either when I log on (and therefore my password in at the log in screen), or once I get to desktop have Ubuntu ask for my password and then auto mount the partition?

The contents of my fdisk is below

The encrypted partition is /dev/sdb7, my root and home partition is /dev/sdb5 (which isn't encrypted).

Disk /dev/loop0: 14 MiB, 14647296 bytes, 28608 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes


Disk /dev/loop1: 81.7 MiB, 85692416 bytes, 167368 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes


Disk /dev/sda: 931.5 GiB, 1000204886016 bytes, 1953525168 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 4096 bytes
I/O size (minimum/optimal): 4096 bytes / 4096 bytes
Disklabel type: dos
Disk identifier: 0x0006d9d9

Device     Boot     Start        End    Sectors   Size Id Type
/dev/sda1            2048  524646399  524644352 250.2G  7 HPFS/NTFS/exFAT
/dev/sda2  *    524646400 1953523711 1428877312 681.4G 83 Linux


Disk /dev/sdb: 465.8 GiB, 500107862016 bytes, 976773168 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0x1ffae910

Device     Boot     Start       End   Sectors   Size Id Type
/dev/sdb1       214892542 976773119 761880578 363.3G  5 Extended
/dev/sdb2  *         2048   2150399   2148352     1G 83 Linux
/dev/sdb5       214892544 257558559  42666016  20.4G 83 Linux
/dev/sdb6       300716032 318294015  17577984   8.4G 82 Linux swap / Solaris
/dev/sdb7       318296064 976773119 658477056   314G 83 Linux

Partition table entries are not in disk order.
Improve this question

2 Answers 2

Reset to default
5

Using pam-mount

You can use pam-mount to do this. It will hook into the login process and thus be able to use the entered password for mounting a luks partition. Here's how to set it up:

Create a test luks image

Skip this section if you have a LUKS-encrypted partition or image already

Create a file called .priv in your home directory with size 1GB:

truncate -s 1G ~/.priv

Format the image using LUKS and set a password (use the same as your login password):

cryptsetup luksFormat ~/.priv

Enable the image:

sudo cryptsetup luksOpen ~/.priv priv

Create a file system on the new device:

sudo mkfs.ext4 /dev/mapper/priv

Disable the image again:

sudo cryptsetup luksClose priv

Install and set up pam-mount

Install the package:

sudo apt install libpam-mount

Edit the configuration file /etc/security/pam_mount.conf.xml and add the following line to it:

<volume path="~/.priv" mountpoint="~/priv" />

Add this right after where it says <!-- Volume definitions -->. Notice the subtle but important difference in the path and mountpoint arguments. In your particular case you would use path="/dev/sdb7".

Now login to your machine and you should notice that it takes a little longer than usual. After successful login you can check, using the mount command, that there is now a new file system mounted in your home. It should look similar to this:

/dev/mapper/_dev_loop3 on /home/seb/priv type ext4 (rw,relatime,data=ordered,helper=crypt)

Use for /home/USER

I am using this setup for mounting my home directory (/home/seb) from a LUKS encrypted image on Ubuntu 18.04. pam_mount will also take care of unmounting the image after I log out. As such it is a nice way to get at least some encryption if during installation you did not choose full disk encryption.

Improve this answer
8
  • 1
    Thanks for your help, that worked. I've tried to mount the encryped partition as: <volume path="/dev/sdb7" mountpoint="/home" />. However when I did that I couldn't log in until I booted into a LiveCD and fixed that conf file, do you know the reason why that didn't work?
    – Falc
    Mar 30, 2018 at 12:11
  • 1
    I don't see why this could not work, unless some pam module needs access to your home before it is available. But for full home encryption you should probably use ecryptfs like described in help.ubuntu.com/community/EncryptedHome
    – Sebastian Stark
    Mar 30, 2018 at 22:44
  • @SebastianStark Do you use the loop device as described here for home directory encryption or a separate partition? Thank you so much for this answer.
    – jbrock
    Jun 18, 2022 at 21:59
  • No partition. I am using an image in "/<myUID>-home.img", still using the same method. I migrated to another Linux distribution, luckily that doesn't change anything regarding this.
    – Sebastian Stark
    Jun 20, 2022 at 5:28
  • @SebastianStark I got mine all set up today on a separate partition. Works great. I am going to do the block file on my other install. Thank you so much for your awesome post.
    – jbrock
    Jun 20, 2022 at 21:55
1

To answer @Falc about why setting the mount point as <volume path="/dev/sdb7" mountpoint="/home" /> didn't work and instead prevented him from logging in. By setting the mount point as home you actually replaced your home directory with your encrypted partition. The reason why you could not log in is that the /home directory is needed by Linux to work. Whats more, the home directory contains many important hidden files such as .config, .bashrc, .profile and .bash_profile. These files and others in your home folder include gnome-session-properties which initiate programs to start when you log in. When you mount your encrypted drive on your home directory applications needed for the graphical session cannot start.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .