4

I have a huge number of photos, and I want to move just my /Pictures folder to a second SATA drive in my computer for performance reasons. I want everything to work as it is now, except that /Pictures will be by itself on the second drive.

/Home (sda) and the second drive(sdb) are encrypted. For the primary drive, I chose the encrypted home option at install. Later, I added the second drive. I formatted it and chose encryption using the Disk Utility. I can reinstall if this all has to be done at once.

What I tried so far was adding a symlink to the new drive from inside /Pictures, and using PySDM (to modify Fstab) to auto-mount the second drive at boot. Since the second drive is encrypted, this didn't work. It can't be mounted until I login and unlock the keychain with my password.

Also, the symlink added an extra step in the file paths, which broke some custom links.
ln -s /media/Pix /home/tom/Pictures and all variations of this with and without trailing slashes give me either a link inside /Pictures, or no link at all. (possibly missing something simple here?) Drive 2 (sdb) is /Pix, and all my pictures are in folders at its root directory. I want to click on Pictures from my home folder in Nautilus, and be taken directly to the root directory of the second drive. This just isn't happening. I either get a new link inside /Pictures, or I'm taken to the empty /Pictures folder (on sda)

What's the best way to do this? It's important to keep everything encrypted, and have /Pictures work just like if it was in /home. I also need my automatic backups to be collecting the photos in their new location.

****Edits** I tried following RAOF's answer but I'm stuck now. Here's how far I got:

cryptsetup was already installed, I edited it and copied the suggestion exactly, it now looks like this:

# <target name> <source device>     <key file>  <options>
cryptswap1 /dev/sda2 /dev/urandom swap,cipher=aes-cbc-essiv:sha256
sdb_crypt UUID=<redacted>-4ef3-a4ff-7c9db92025d7 none luks  

I have an encrypted /home obviously, that's the other entry.

ls -lah /dev/disks/by-uuid

simply didn't work, I get "ls: cannot access /dev/disks/by-uuid: No such file or directory"

ls -l /dev/disk/by-uuid/

does work, it's the method here on the Ubuntu help page That gives me the following:

ls -l /dev/disk/by-uuid/
total 0
lrwxrwxrwx 1 root root 10 2012-02-06 08:15 <redacted>-40ba-be89-9591daf722c9 -> ../../sdd1
lrwxrwxrwx 1 root root 10 2012-02-06 08:15 <redacted>-4ef3-a4ff-7c9db92025d7 -> ../../sdb1
lrwxrwxrwx 1 root root 10 2012-02-06 08:15 <redacted>-49da-bcca-879e44afe63c -> ../../sda1
lrwxrwxrwx 1 root root 10 2012-02-06 08:15 <redacted>-4cee-9ef7-c745ee596438 -> ../../dm-1
lrwxrwxrwx 1 root root 10 2012-02-06 08:15 <redacted>-48ed-9725-5179cd588c28 -> ../../dm-0
lrwxrwxrwx 1 root root 10 2012-02-06 08:15 <redacted>-4bb6-bf6e-197af4d6afdc -> ../../sdc1

The problem now is with fstab. I have tried several variations, and none work so far. Here's what I started with:

UUID=<redacted>-4bb6-bf6e-197af4d6afdc /home ext4 defaults 0 2
UUID=<redacted>-4ef3-a4ff-7c9db92025d7 /media/sdb1 crypto_LUKS noauto 0 0
UUID=<redacted>-49da-bcca-879e44afe63c / ext4 defaults 0 1
UUID=<redacted>-4cee-9ef7-c745ee596438 /media/Pix ext4 noauto 0 0

which tries to mount the encrypted partition at boot, which is too early since I haven't entered my password yet. I removed the last line and changed the second entry to auto, like below.

UUID=<redacted>-4bb6-bf6e-197af4d6afdc /home ext4 defaults 0 2
UUID=<redacted>-4ef3-a4ff-7c9db92025d7 /media/sdb1 crypto_LUKS auto 0 0
UUID=<redacted>-49da-bcca-879e44afe63c / ext4 defaults 0 1

This asked me for my passphrase for /sdb_crypt (with UUID) at GRUB, before I can even login.
enter image description here

I entered the password for the drive but I guess passphrase=/=password, this failed. I restored the backup fstab from a live cd, but now but I don't understand how to "edit /etc/fstab so that it mounts /dev/mapper/sdb_crypt in the right place." from RAOF's answer. Any ideas? And now I suspect I have more entries than I need in fstab, which to remove?

6
  • You've not specified how the second drive is encrypted; I presume you've used the Alternate installer and set it up as an encrypted partition (in which case it will be using dm-crypt)?
    – RAOF
    Feb 2, 2012 at 1:00
  • Good point, I'll edit the question. Feb 2, 2012 at 8:05
  • Why can't you get ~/Pictures to link to the drive? What's the error message?
    – krlmlr
    Feb 3, 2012 at 21:06
  • I edited again with my symlink problems. I'm wondering if I may have to undo any steps I took so far now, like fstab edits or the /etc/crypttab one. I've got multiple good backups so I plan to keep trying until I learn how to do this, or completely break my install, whichever comes first. Thanks for the help so far. Feb 3, 2012 at 23:33
  • Ah. That screen is the behaviour I expected - it's asking you for the passphrase during boot, rather than when (or after) you log in. If this is not what you're after I'll need to rework the answer to do it after login.
    – RAOF
    Feb 7, 2012 at 6:41

2 Answers 2

3
+150

If you want to set up the second drive at boot time then you can use cryptsetup to mount it as a part of the boot process. That will prompt for the drive's passphrase during boot. To do this, you should apt-get install cryptsetup (if it's not already installed), and then edit /etc/crypttab; it should look something like this:

sdb_crypt /dev/sdb none luks

Although, since the /dev/sd x names are not necessarily stable over hardware changes, I'd find out what the UUID of the drive is and use that. You can find the UUID in /dev by running ls -lah /dev/disks/by-uuid. You'll get output that includes something like:

lrwxrwxrwx 1 root root  10 Feb  2 17:30 deadbeef-baea-9233-1828-ae12b3ed4ff3e -> ../../sdb

and from that you would add the following to /etc/crypttab:

sdb_crypt UUID=deadbeef-baea-9233-1828-ae12b3ed4ff3e none luks

Having done that you'd edit /etc/fstab so that it mounts /dev/mapper/sdb_crypt in the right place.

Once you've got that set up, I'd just symlink ~/Pictures to wherever you've mounted sdb_crypt. There's no need to put a symlink in the existing Pictures directory. You'll need to move all the existing files into your crypted directory, remove the existing Pictures directory, and then ln -s /where/you/mounted/sdb_crypt ~/Pictures to create the symlink.

The reason this is difficult is that this whole thing is basically a missing feature. What you really want to do is to tell the desktop that it should auto-mount your drive when you log in - that would mean that you could easily do the same sort of thing with any gvfs-able mount: SMB, ssh, etc. I guess patches would be welcome ☺.

2
  • Sorry for the late reply, but I'm having problems following this. Cryptsetup was already installed. I was able to edit /etc/crypttab like you showed, but the example command to get the UUID only gives me 'cannot access...no such file or directory' errors. Further, I cannot get /Pictures to link to the drive. Best I can do is have a link to the other drive inside /Pictures, not sure why. I haven't tried to edit fstab again yet. I'll keep reading the man pages but this may just be way past my skill level. Feb 3, 2012 at 16:02
  • I did the bounty so it wouldn't expire and be wasted. If you have any more advice on the fstab edit to mount 'dev/mapper/sdb_crypt' please add it when you have time. I'm not able to get this working yet. Feb 8, 2012 at 10:49
1

Have you tried turning the Pictures directory into a symlink to the new location? This saves the extra step in the file paths, everything stays in place.

Also, encrypted or not, I don't see why the second drive must be mounted at boot time. Wouldn't it be enough to have it mounted at login? To achieve this, the same procedure like mounting the home must be followed. The symlink ~/Pictures will be dead before the mount completes, but this is (given a correct implementation of the mount process) just during login, after mounting ~ and before mounting the second drive. Do you consider this an issue?

The ecryptfs PAM documentation might contain some relevant pointers.

3
  • The linked documentation refers to a '~/.bash_profile' script (or file), which does not exist in my home directory. Also, a '~/Confidential/' directory is referenced, also not present on my machine. Is the documentation out of date? All I found so far is a .ecryptfs folder with 'Private.mnt' pointing to my home. I'm not able to translate the documentation into something useful given the differences present. Can you point me in the right direction please? Mar 7, 2012 at 10:12
  • See this explanation about the difference between .bashrc and .bash_profile (which actually doesn't even have to exist). I understand that Confidential is created by the user and hosts all, well, confidential data. You didn't comment on my answer, though.
    – krlmlr
    Mar 7, 2012 at 12:38
  • Sorry I should have upvoted and commented earlier. You make a good point about mounting at login vs boot, I broke it off as a new question here. I am struggling to understand all this but it's a good learning experience. I will read the info at your new link and give it a try soon. When I get this all working I will follow up again. I'm certain this can be done. Haven't figured it all out yet though. Mar 7, 2012 at 16:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .