57

Disappointed to see that the 18.04 installer no longer offers the option to encrypt the home directory. According to this bug report referenced in the installer, the recommended method for encryption these days is full-disk with LUKS, or fscrypt for directories. Full-disk encryption seems a bit overkill for my needs, and all the bugs and caveats mentioned on the Wiki don't make it a very attractive option. All I really want is to protect my home directory from someone accessing my documents, photos, etc. if my laptop were to get stolen, making fscrypt the option for me.

The fscrypt GitHub page has some examples on how to set it up, but I can't find any documentation aimed at encrypting the home directory on Ubuntu. The old ecryptfs tool is still available, but after setting it up Ubuntu would sometimes freeze at the login screen.

So my question is: How do I setup fscrypt to encrypt my /home directory and decrypt when I log in? I also liked how ecryptfs allowed decrypting the folder manually (eg. from disk images).

(A similar question was posted here and was unfortunately closed for being an "off-topic" bug report. To clarify, this is not a bug report. The fact that the encrypt home directory option was removed from the installer was intentional. All I'm asking here is how to setup fscrypt.)

  • 2
    @Panther Does LUKS allow for decrypting files stored on a backup drive? The reason I ask is because I make my full system backups from Windows with Macrium Reflect. If I need to pull out a few files from the backup, I would need a way to decrypt the backed up files. With ecryptfs, all I had to do was plug in my drive and run the script stored in the encrypted folder. – elight24 Apr 28 '18 at 19:33
  • 7
    So how about those of us that have our home folder encrypted from 16.04, but can't mount it new because the "encrypt home folder" option is gone now from the installer? We can't even log in. It's ridiculous. – SunnyDaze Apr 28 '18 at 23:16
  • 2
    @SunnyDaze It's been awhile since I've had to mount my data manually, but I believe the command for that was "ecryptfs-mount-private". – elight24 Apr 28 '18 at 23:21
  • 3
    You may be confusing using LUKS on the entire disc, this will not work with dual booting windows, vs using LUKS on the Ubuntu partition, works fine dual booting with windows. I have not read the wiki page – Panther May 4 '18 at 3:04
  • 2
    Full disk encryption is great and does the job. But it's enough only if it is you personal computer and you are the only user. If someone is wondering why encrypt the home?, when there are many users it's useful. When you log in, only your home is decrypted but not the other ones – AnthonyB May 10 '18 at 17:00
25

Update 2019-07

I'm running multiple encrypted homes with fscrypt. Install your system without encryption and use this guide to implement fscrypt on your home.

Be sure to chmod 700 your home and/or use umask 077 because fscrypt does not automatically set permissions like ecryptfs used to do.

The API to fscrypt might change in the future, so make sure to back up your important files if you attempt to upgrade your system.

(This feature is not widely used on Desktop. Use at your own risk.)

Update 2018-11

TL:DR; You can try fscrypt in Ubuntu 18.10+ or Linux Mint 19.1+

Looks like this was finally fixed. Here's a pre-emptive guide: http://tlbdk.github.io/ubuntu/2018/10/22/fscrypt.html

I'm not quoting instructions here because it does require some hacks and you can end up losing your home data.

Warning: A warning from user @dpg: "BE CAREFUL:I followed instructions from that "pre-emptive guide" (did it under tty), and got infinite login loop."

Consider this guide for educational purposes only.

Next is my original answer:

Original Answer 2018-05

TL;DR: Use classic home encryption with Linux Mint 19 Tara.

fscrypt for home encryption is still broken.


How do I setup fscrypt to encrypt my /home directory and decrypt when I log in?

This is something a lot of us want. It appears the Ubuntu team couldn't get ecryptfs to work bug-free on Ubuntu 18.04, and couldn't fix the bugs in fscrypt for a home-encryption option in time for the scheduled Ubuntu 18.04 release either.

For fscrypt, is at least one critical bug that makes it unusable for home encryption at the moment:

Furthermore, we'd need a transparent way of authenticating/unlocking before it's a realistic alternative to the "old" ecryptfs-type home encryption. This is tracked here:

With these issues open, you can consider home encryption broken at this point. With that, my colleagues and I consider Ubuntu 18.04 18.04.1 unfinished at the moment, and hope that home-encryption will be brought back (using the new and much better fscrypt method) in Ubuntu 18.04.1 18.04.2.

Until such time, we're sticking with Ubuntu 16.04. We have switched all our machines to Linux Mint 19 Tara with the classic home encryption using ecryptfs. Read the "known issues" section in the Release Notes for Linux Mint 19 Tara about the ecryptfs limitations, and see if this is acceptable to you:

(...) please be aware that in Mint 19 and newer releases, your encrypted home directory is no longer unmounted on logout.

If you have tried fscrypt and found it to be broken for your usage, you can vote "this bug affects me too" at the following launchpad bug:


Note that fscrypt/ext4-crypt (future "encrypt home") is the fastest option, and ecryptfs (old "encrypt home") is the slowest option. LUKS ("encrypt entire drive") is in the middle.

For this reason, entire disk encryption is 'conveniently' recommended. Because if you have very big projects with many small files, use revision management a lot, make big compiles, etcetera, you'll find that the overkill of encrypting your entire drive is actually worth it compared to the slowness of the old ecryptfs-type home encryption.

In the end, encrypting the entire drive has multiple drawbacks:

  • Guest account
  • Family laptop with private accounts
  • Using PREY-like anti-theft software

It's puzzling that Canonical decided that "we don't need this anymore" on their LTS version, which has come to be known as their more "serious" distribution.

  • 2
    Ubuntu 18.04.1 was released today, with both bugs still standing. I hope to see fscrypt in 18.04.2, but I'm a little less optimistic now. Please update! – Nonny Moose Jul 26 '18 at 18:12
  • 2
    @NonnyMoose updated - see the bold section halfway down my post. – Redsandro Jul 31 '18 at 8:51
  • 3
    wow! when people upgrade from 16.04 to 18.04, what happens to their ~ !? – MaxB Sep 12 '18 at 19:38
  • 2
    BE CAREFUL:I followed instructions from that "pre-emptive guide" (did it under tty), and got infinite login loop. Tried it twice on fresh 18.10 installation with the same result. – PetroCliff Dec 14 '18 at 3:59
  • 2
    In case someone got into infinite login loop after encryption, but can login in tty. In my case, it was caused by wrong owner of /home/myuser directory. It was root for some reason, so changing owner to my user solved the issue. – PetroCliff Dec 20 '18 at 2:12
8

From Panther's answer here Full disk encryption encrypts everything including /home while encrypting only a specific dir such as /home is only encypted when you not logged in.

To encrypting an existing users home dir:

First logout of that account and log into an admin account:

install the encryption utilities for the job:

 sudo apt install ecryptfs-utils cryptsetup

from that launchpad bug ecryptfs-utils is now in the universe repo.

migrate the home folder of that user:

sudo ecryptfs-migrate-home -u <user>

followed by user password of that account

Then logout and login into the encrypted users account – before a reboot! to complete the encryption process

Inside the account print and record the recovery passphrase:

ecryptfs-unwrap-passphrase

You can now reboot and login. Once you are satisfied you can delete the backup home folder.

Also if you want to create a new user with encrypted home dir:

sudo adduser --encrypt-home <user>

For more info: man ecryptfs-migrate-home; man ecryptfs-setup-private

  • 2
    Thanks for the answer, ptetteh. I tried that method the other day, but it seemed to cause issues when logging in. It would sometimes freeze on the login screen and cause me to have to reboot. I reinstalled 18.04 just to make sure that it wasn't something else causing the issue, and so far everything seems to be fine. If ecryptfs is now deemed unfit to be included by default, I think the best thing would be for me to use LUKS or fscrypt. – elight24 Apr 28 '18 at 19:30
  • 1
    It worked for me in a clean installation (18.04.1). I had to do it in "recovery mode". Unwrap was not required as when you login, it will notify you about it and request you to write down the generated passphrase. Thanks! – lepe Sep 2 '18 at 9:50
  • 2
    ecryptfs will not work if you have some longer path names (>~140 characters) in your home directory. See unix.stackexchange.com/questions/32795/… – Sebastian Stark Sep 11 '18 at 9:00
  • What if I have no space for backup? Would it get succeeded? – 4xy Nov 9 at 14:19
1

Personally, I would almost never recommend using File System Encryption (FSE) to anyone, for most use cases. There are several reasons, not the least of which is the fact of existing, and more effective alternatives. You all talk like there are only two options, either FSE or FDE (Full Disk Encryption). However, that is simply not the case. In fact, there are two other options which would both benefit the OP far greater, those being File Container Encryption and Encrypted Archives.

File container encryption is what software like Veracrypt, and the now defunct Truecrypt are written for. Container encryption is built into most file compression archive software like Winzip and 7zip, as an option when creating such an archive.

The two both have many advantages over FSE, the most obvious being that you don't need to leave them mounted while you're not working with your encrypted files. That prevents anyone from being able to access who is able to override the protections of the user profile key, and screen lock. Also, you might do something stupid, like step away from your computer, but forget to lock the screen, or allow someone to use the computer, and hoping they won't peek at your hidden directories. Also, you can easily move large amounts of files at a time, without needing to encrypt them another way, since the containers are portable.

One advantage that Veracrypt containers are so useful is the fact that they can be mounted as a drive, and that allows you to format them with a separate file system, preferably a non-journaling file system, like EXT2 or FAT32. Journaling files system could potentially leak information to an attacker. However, if all you're doing is hiding your personal photos, this might not be all that relevant to you. If, on the other hand, you have state secrets or legally protected data, then it might. You can also set them to automatically mount at boot up, if using a key file. However, that is not recommended, since the key file would need to be stored somewhere less secure than where FSE stores the user profile key.

Both offer the ability to use file compression. You can also hide file names, although, not always the case when using compressed archives, depending on certain compression algorithm used.

Personally, I use container encryption for files which will not be moved, and encrypted archives for files which will be moved or stored in the cloud, since it's a smaller file size.

Encrypting a Home directory is still possible with container encryption. Maybe store your encryption key on a YubiKey?

Anyways, I just wanted to offer you all some alternatives which weren't getting a mention by the other posters. Feel free to agree, or disagree with anything I've said.

  • 8
    Hi. I have some comments about your "babysitter" example: - firstly, in many places people may expect the average babysitter to be a teenager by default, which makes it a bit of a disturbing analogy to drop in to a thread like this. Secondly, I just want to affirm that there are much better use cases for encryption than hiding a guilty secret. – mwfearnley Jul 28 '18 at 16:56
  • Containers are a fixed size, filesystem encryption (fscrypt, eCryptfs, EncFS, etc) only take up as much space as the files, and can grow & shrink accordingly. QED. PS you seem unaware that eCryptfs can encrypt only a single directory in home, decrypted only at whim. – Xen2050 Sep 14 '18 at 2:27
  • 3
    Honestly, this answer is useful, but the content is offensive. Simply due to associating encryption with criminal activity, as if there isnt enough of that in the media. Encryption is for protection from criminal activity. I cant upvote due to this. Ill delete this comment once an edit occurs. – Todd Dec 15 '18 at 20:31
  • 1
    Note that if you cannot trust root (uid:0), then you cannot use system for any encryption (be it FSE, container or archive). All encryption systems are vulnerable if you open the encryption and walk away from the system without locking it safe. Also, if you don't encrypt your whole filesystem, you have to understand that potentially all applications that touch the secret files will potentially make unencrypted copies outside your secure partition. – Mikko Rantalainen Jan 10 at 5:39
0

If you, like I was, are doing a fresh installation of Ubuntu 18.04 over Ubuntu 16.04 and you have previously encrypted your /home, you will see that you are unable to login after the installation. All you need to do is to install the ecryptfs related packages: sudo apt install ecryptfs-utils cryptsetup, reboot and login.

To install those packages you can either login in a spare tty once budgie has loaded (Cntrl + Alt + F1) or enter in the linux recovery mode and install it from there.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.