The recommended way to encrypt on Ubuntu/Linux these days is indeed LUKS, whether for separate containers or whole partitions.
I am doing exactly what you want to do, encrypting and mounting a separate partition as my /home/$USERNAME% drive. Below are the steps involved.
WARNING: Doing this will destroy any data on the partition you use!
1. Create the encrypted partition:
sudo cryptsetup luksFormat /dev/sdXX
where you replace sdXX with the actual device number of the partition you want to encrypt. Choose your password when prompted. This will create the LUKS header at the beginning of the partiton, nothing else. You can verify that the header has been correctly formatted by LUKS by doing
sudo cryptsetup luksDump /dev/sdXX
2. Map the encrypted container:
You can replace
c1 by whatever name you want:
sudo cryptsetup luksOpen /dev/sdXX c1
2a. Wipe the partition (optional):
sudo cat /dev/zero > /dev/mapper/c1
will wipe the partition with random data, making sure nothing that may have been on it before can be reconstructed. This may take a while.
3. Create a filesystem in the mapped container:
Here I use ext4:
sudo mkfs.ext4 /dev/mapper/c1
4. Update your /etc/crypttab file:
Your crypttab should contain a line like
cryptHome UUID=12345678-abcd-1234-5678-1234567890ab none luks,timeout=30
with the UUID of the device you just encrypted above (i.e. the
/dev/sdXX device). You can find it out by using e.g.
lsblk -f (it should say "crypto_LUKS" under FSTYPE in the output).
5. Update your /etc/fstab file:
Finally, your fstab should contain a line like
/dev/mapper/cryptHome /home/username ext4 defaults 0 2
to mount the decrypted partition in your filesystem. The mapped name (cryptHome) must match the one you defined in the crypttab. Replace
username by the name of the actual user.
You could also mount it under /home, but then you will have all user's home directories in one encrypted drive - that means all of them need to know the partition's password to open it on boot.
With these steps Ubuntu will ask you to unlock the partion on every boot, before the login screen for the user.
There is no problem to set up the system with a default /home/username directory, and then mount an encrypted partition over it. To migrate an existing home directory, mount the mapped drive (/dev/mapper/c1 in this example) somewhere temporary after Step 3 and copy over the data before rebooting.
This is an excellent resource if you want to know more about how LUKS works.