0

Introduction

I have installed kubuntu 20.04.2 on my laptop using the excellent tutorial here: Encrypted custom install

This works fine so far, the system boots well and the decryption offers a nice level of security.

Now I would like to add another layer of data security by backing up the system on a SD card that would be encrypted as well, indeed. BackinTime is the perfect choice for backing up data incrementally, with versioning and automatically.

In principle, it would require the encrypted partition to be unlocked by the main system on boot, after the main partition is decrypted, then mount the file system to offer access to backin time (the backup software on linux).

Questions and considerations

Do you think it is technically doable? What would it take to make it happen? Can we make it in the way that the SD will be open by the host install? (e.i. no need to put a password) Can we also avoid the system to hanging up on boot if the SD had been removed? Thanks for reading. :)

Please used this variables to consider the following work:

Drive /dev/sda, sda1 being boot, sda2 being the LUKS system partition, containing /, /home and swap. SD Card /dev/mmcblk1 is the SD card entry

Tentative of answer (unfinished, non-functional, and to be updated)

  • Map your drives with lsblk and look for the number of the mmcblk# partition.

  • Create LUKS partition
    sudo cryptsetup luksFormat --hash=sha512 --key-size=512 --cipher=aes-xts-plain64 --verify-passphrase /dev/mmcblk1
    sudo cryptsetup luksOpen /dev/mmcblk1 CryptSD

While not necessary, it is a good idea to fill your LUKS partition with zeros so that the partition, in an encrypted state, is filled with random data.
sudo dd if=/dev/zero of=/dev/mapper/CryptDisk bs=4M
BEWARE, this could take a really long time!

  • Partition the SD card
    sudo pvcreate /dev/mapper/CryptSD
    sudo vgcreate vg1 /dev/mapper/CryptSD
    sudo lvcreate -n backup -l +100%FREE vg1

Configure the SD card

Simply use this technique that is only using GUI. https://askubuntu.com/a/1140296/1036035 But start by installing Gnome-disk that is the front-end of Disk management. It does not install additional gtk libraries, and it is well integrated to KDE plasma.

3
  • Why do you need the SD card to be unlocked on boot? Is BackInTime not only run on demand and would need the backup folder unlocked only then?
    – Sebastian
    May 3, 2021 at 17:12
  • Thanks Sebastian, I was thinking today to unlock it using kwallet manager. What would you advise on unlocking it only when backintime need it?
    – mateMat
    May 13, 2021 at 10:56
  • I don't know - apparently Backintime does not support manual backups, but it does allow to backup when a drive gets connected, so that's maybe the easiest to do. Also, I wouldn't bother with partioning or logical volume management on the SD card, just create a filesystem in the mapped LUKS device and be done with it.
    – Sebastian
    May 13, 2021 at 14:52

0

You must log in to answer this question.

Browse other questions tagged .