What is the recommended method to encrypt the home directory in Ubuntu 21.04?

Question

Installing Ubuntu to a new Notebook, I was surprised that I wasn't offered the option to encrypt the home directory any more.

I found some vague information that Ubuntu dropped ecryptfs support a while ago in favor of complete disc encryption with LUKS. For my use case it isn't desirable to encrypt the whole device as I aiming only to protect the data for unauthorized access in case the machine gets lost or stolen. No super sensitive data are involved and no hostile government agency (as far as I know) and I cant afford an extra password dialog.

So my question is simple: What is the recommended method to encrypt home directory in Ubuntu 21.04?

Am I for some reason discouraged to use ecryptfs?

Can I safely use the old method described bellow?

First install the packages ecryptfs-utils and rsync:

sudo apt install ecryptfs-utils rsync lsof

Then load the ecryptfs kernel module:

sudo modprobe ecryptfs

The user whose home directory you want to encrypt MUST NOT be logged in. For example, you can be logged as root in a tty.

Then run as root:

ecryptfs-migrate-home -u <username>

Answer 1

The recommended way to encrypt on Ubuntu/Linux these days is indeed LUKS, whether for separate containers or whole partitions.

I am doing exactly what you want to do, encrypting and mounting a separate partition as my /home/username ($HOME, /home/$USER) drive. Below are the steps involved.

WARNING: Doing this will destroy any data on the partition you use!

1. Create the encrypted partition:

   sudo cryptsetup luksFormat /dev/sdXX
   

   where you replace sdXX with the actual device number of the partition you want to encrypt. Choose your password when prompted. This will create the LUKS header at the beginning of the partiton, nothing else. You can verify that the header has been correctly formatted by LUKS by doing

   sudo cryptsetup luksDump /dev/sdXX
   

2. Map the encrypted container:

   You can replace c1 by whatever name you want:

   sudo cryptsetup luksOpen /dev/sdXX c1
   

   Optional: Wipe the partition:

   sudo cat /dev/zero > /dev/mapper/c1
   

   will wipe the partition with random data, making sure nothing that may have been on it before can be reconstructed. This may take a while.

3. Create a filesystem in the mapped container:

   Here I use ext4:

   sudo mkfs.ext4 /dev/mapper/c1
   

4. Update your /etc/crypttab file:

   Your crypttab should contain a line like

   cryptHome     UUID=12345678-abcd-1234-5678-1234567890ab    none    luks,timeout=30
   

   with the UUID of the device you just encrypted above (i.e. the /dev/sdXX device). You can find it out by using e.g. lsblk -f (it should say "crypto_LUKS" under FSTYPE in the output).

5. Update your /etc/fstab file:

   Finally, your fstab should contain a line like

   /dev/mapper/cryptHome         /home/username    ext4   defaults    0    2
   

   to mount the decrypted partition in your filesystem. The mapped name (cryptHome) must match the one you defined in the crypttab. Replace username by the name of the actual user.

   You could also mount it under /home, but then you will have all user's home directories in one encrypted drive - that means all of them need to know the partition's password to open it on boot.

Final remarks

With these steps Ubuntu will ask you to unlock the partition on every boot, before the login screen for the user.

There is no problem to set up the system with a default /home/username directory, and then mount an encrypted partition over it. To migrate an existing home directory, mount the mapped drive (/dev/mapper/c1 in this example) somewhere temporary after Step 3 and copy over the data before rebooting.

This is an excellent resource if you want to know more about how LUKS works.

Answer 2

encrypt the whole disk with LUKS

LUKS is the recommended method these days. And it is not recommended to ony encrypt the home directory, but instead the whole disk:

1. During the installation (from the USB stick) you get to choose if you want to install on the whole harddrive or not, you can choose the option "something else" where you can choose which partitions you want to use.

2. In the partitioning dialog, you must create a small 800MB partition for /boot that must be formatted in ext2

3. Then create another partition of the type "Physical Volume for Encryption".

   Make sure, you have another USB-Stick or such, where you can store the encryption-recovery-Key during the install process.

4. inside the encrypted container you can then create a root partition for your whole system /.

(I am not sure, how to create a swap partition there as well as recommended, since there is no option to create new partitions inside the encrypted container)