Introduction
I have installed kubuntu 20.04.2 on my laptop using the excellent tutorial here: Encrypted custom install
This works fine so far, the system boots well and the decryption offers a nice level of security.
Now I would like to add another layer of data security by backing up the system on a SD card that would be encrypted as well, indeed. BackinTime is the perfect choice for backing up data incrementally, with versioning and automatically.
In principle, it would require the encrypted partition to be unlocked by the main system on boot, after the main partition is decrypted, then mount the file system to offer access to backin time (the backup software on linux).
Questions and considerations
Do you think it is technically doable? What would it take to make it happen? Can we make it in the way that the SD will be open by the host install? (e.i. no need to put a password) Can we also avoid the system to hanging up on boot if the SD had been removed? Thanks for reading. :)
Please used this variables to consider the following work:
Drive /dev/sda, sda1 being boot, sda2 being the LUKS system partition, containing /, /home and swap. SD Card /dev/mmcblk1 is the SD card entry
Tentative of answer (unfinished, non-functional, and to be updated)
Map your drives with
lsblk
and look for the number of the mmcblk# partition.Create LUKS partition
sudo cryptsetup luksFormat --hash=sha512 --key-size=512 --cipher=aes-xts-plain64 --verify-passphrase /dev/mmcblk1
sudo cryptsetup luksOpen /dev/mmcblk1 CryptSD
While not necessary, it is a good idea to fill your LUKS partition with zeros so that the partition, in an encrypted state, is filled with random data.
sudo dd if=/dev/zero of=/dev/mapper/CryptDisk bs=4M
BEWARE, this could take a really long time!
- Partition the SD card
sudo pvcreate /dev/mapper/CryptSD
sudo vgcreate vg1 /dev/mapper/CryptSD
sudo lvcreate -n backup -l +100%FREE vg1
Configure the SD card
Simply use this technique that is only using GUI. https://askubuntu.com/a/1140296/1036035 But start by installing Gnome-disk that is the front-end of Disk management. It does not install additional gtk libraries, and it is well integrated to KDE plasma.