I'd like to use TrueCrypt to encrypt my SSD (which has my / Ubuntu installation on one partition and some other things on another), and both of my HDDs (one has /home for Ubuntu and all of Windows, the other has other random stuff), but I'm worried that GRUB isn't going to behave nicely with encrypting entire partitions. Can anyone tell me about their experiences with doing this sort of thing or provide a good answer to whether it's safe or not.
3 Answers
TrueCrypt does not support full system drive encryption on Linux. If you want full drive encryption on Linux you'll want to use something like ecryptfs
or dm-crypt
. However, full drive encryption on Linux may be a bit too much; you really need to only encrypt the /home
, /var
and /opt
directories.
TrueCrypt system encryption: http://www.truecrypt.org/docs/?s=system-encryption
The Arch docs are the best docs for setting up ecryptfs
and/or dm-crypt
: https://wiki.archlinux.org/index.php/ECryptfs
Personally, I recommend dm-crypt
because you can configure linux to mount encrypted disks upon bootup or prompt for a password.
-
Full encryption uses LUKS by default (and not ecryptfs). ecryptfs is used (by default) for your home directory. The installer will do encryption for you, it varies a little depending on what version of Ubutnu you are installing. Either way, your /boot partition is NOT encrypted. grub will boot a non-encrypted /boot and decrytption is then managed in the initramfs.– PantherMay 20, 2013 at 2:19
I have Ubuntu 13.04 installed on an encrypted /
filesystem using dm-crypt. I tried several times with the installers, but was unsuccessful with setting up a dual boot. I finally succeeded by following these instructions.
Basically, the configuration needs to be updated so that the initramfs
at boot time knows that it needs to mount the encrypted volume (and logical volume).
The Ubuntu alternate installer in 12.04 will do that for you as well as the newer installers in 12.10 and 13.04 during install of the OS.