How can I have two Ubuntu installations, one with full disk encryption?

Question

I want to fully segregate my work and personal OS, so I have installed two disks in my PC, because my work demands full disk encryption.

I have successfully installed Windows and Kubuntu on the one drive, but can't seem to install an encrypted Ubuntu (whatever spin) on the other drive.

I have tried two things. Just telling the installer to use the whole disk with encrypted LVM, and manually setting up the partitions and installing to it.

When I just tell it to use the whole disk for an encrypted LVM guided installation, it tells me An error occurred while configuring encrypted volumes. The syslog contains this whole mess, of which I'm not exactly sure where the problem is. Drive 0 is the unencrypted one with Windows and my personal install, drive 1 is what I'm installing to here.

Oct 30 08:32:19 kubuntu ubiquity: /var/lib/partman/devices/=dev=nvme1n1
Oct 30 08:32:20 kubuntu systemd-udevd[142246]: nvme1n1p3: Process '/usr/bin/unshare -m /usr/bin/snap auto-import --mount=/dev/nvme1n1p3' failed with exit code 1.
Oct 30 08:32:20 kubuntu systemd-udevd[142243]: nvme1n1p1: Process '/usr/bin/unshare -m /usr/bin/snap auto-import --mount=/dev/nvme1n1p1' failed with exit code 1.
Oct 30 08:32:20 kubuntu systemd-udevd[142245]: nvme1n1p2: Process '/usr/bin/unshare -m /usr/bin/snap auto-import --mount=/dev/nvme1n1p2' failed with exit code 1.
Oct 30 08:32:20 kubuntu kernel: [ 3067.145760]  nvme1n1: p1 p2 p3
Oct 30 08:32:20 kubuntu systemd-udevd[142275]: nvme1n1p1: Process '/usr/bin/unshare -m /usr/bin/snap auto-import --mount=/dev/nvme1n1p1' failed with exit code 1.
Oct 30 08:32:20 kubuntu systemd-udevd[142278]: nvme1n1p3: Process '/usr/bin/unshare -m /usr/bin/snap auto-import --mount=/dev/nvme1n1p3' failed with exit code 1.
Oct 30 08:32:20 kubuntu systemd-udevd[142277]: nvme1n1p2: Process '/usr/bin/unshare -m /usr/bin/snap auto-import --mount=/dev/nvme1n1p2' failed with exit code 1.
Oct 30 08:32:20 kubuntu kernel: [ 3067.998718]  nvme1n1: p1 p2 p3
Oct 30 08:32:21 kubuntu systemd-udevd[142275]: nvme1n1p3: Process '/usr/bin/unshare -m /usr/bin/snap auto-import --mount=/dev/nvme1n1p3' failed with exit code 1.
Oct 30 08:32:21 kubuntu systemd-udevd[142277]: nvme1n1p2: Process '/usr/bin/unshare -m /usr/bin/snap auto-import --mount=/dev/nvme1n1p2' failed with exit code 1.
Oct 30 08:32:21 kubuntu systemd-udevd[142278]: nvme1n1p1: Process '/usr/bin/unshare -m /usr/bin/snap auto-import --mount=/dev/nvme1n1p1' failed with exit code 1.
Oct 30 08:32:21 kubuntu partman: mke2fs 1.46.5 (30-Dec-2021)
Oct 30 08:32:21 kubuntu partman-crypto: kernel entropy_avail: 256 bits
Oct 30 08:32:30 kubuntu partman-crypto: WARNING: Device /dev/nvme1n1p3 already contains a 'crypto_LUKS' superblock signature.
Oct 30 08:32:32 kubuntu partman-crypto: No key available with this passphrase.
Oct 30 08:32:40 kubuntu kwin_x11[12890]: kwin_core: XCB error: 152 (BadDamage), sequence: 59632, resource id: 14716285, major code: 143 (DAMAGE), minor code: 3 (Subtract)
Oct 30 08:32:40 kubuntu kernel: [ 3087.751753]  nvme0n1: p1 p2 p3 p4 p5
Oct 30 08:32:40 kubuntu ubiquity: NTFS signature is missing.
Oct 30 08:32:40 kubuntu ubiquity: Failed to mount '/dev/nvme0n1p2'
Oct 30 08:32:40 kubuntu ubiquity: : Invalid argument
Oct 30 08:32:40 kubuntu ubiquity: The device '/dev/nvme0n1p2' doesn't seem to have a valid NTFS.
Oct 30 08:32:40 kubuntu ubiquity: Maybe the wrong device is used? Or the whole disk instead of a
Oct 30 08:32:40 kubuntu ubiquity: partition (e.g. /dev/sda, not /dev/sda1)? Or the other way around?
Oct 30 08:32:40 kubuntu systemd-udevd[144979]: nvme0n1p2: Process '/usr/bin/unshare -m /usr/bin/snap auto-import --mount=/dev/nvme0n1p2' failed with exit code 1.
Oct 30 08:32:40 kubuntu systemd-udevd[144980]: nvme0n1p4: Process '/usr/bin/unshare -m /usr/bin/snap auto-import --mount=/dev/nvme0n1p4' failed with exit code 1.
Oct 30 08:32:40 kubuntu systemd-udevd[144978]: nvme0n1p5: Process '/usr/bin/unshare -m /usr/bin/snap auto-import --mount=/dev/nvme0n1p5' failed with exit code 1.
Oct 30 08:32:40 kubuntu systemd[1]: tmp-tmp.xhYzjKQpjU.mount: Deactivated successfully.
Oct 30 08:32:40 kubuntu systemd-udevd[144977]: nvme0n1p1: Process '/usr/bin/unshare -m /usr/bin/snap auto-import --mount=/dev/nvme0n1p1' failed with exit code 1.
Oct 30 08:32:40 kubuntu systemd-udevd[144981]: nvme0n1p3: Process '/usr/bin/unshare -m /usr/bin/snap auto-import --mount=/dev/nvme0n1p3' failed with exit code 1.
Oct 30 08:32:40 kubuntu systemd[1]: tmp-tmp.xhYzjKQpjU.mount: Deactivated successfully.
Oct 30 08:32:40 kubuntu ubiquity: mount: /tmp/tmp.xhYzjKQpjU: unknown filesystem type 'crypto_LUKS'.
Oct 30 08:32:40 kubuntu ubiquity:        dmesg(1) may have more information after failed mount system call.
Oct 30 08:32:40 kubuntu ubiquity: NTFS signature is missing.
Oct 30 08:32:40 kubuntu ubiquity: Failed to mount '/dev/nvme0n1p2'
Oct 30 08:32:40 kubuntu ubiquity: : Invalid argument
Oct 30 08:32:40 kubuntu ubiquity: The device '/dev/nvme0n1p2' doesn't seem to have a valid NTFS.
Oct 30 08:32:40 kubuntu ubiquity: Maybe the wrong device is used? Or the whole disk instead of a
Oct 30 08:32:40 kubuntu ubiquity: partition (e.g. /dev/sda, not /dev/sda1)? Or the other way around?
Oct 30 08:32:40 kubuntu ubiquity: mount: /tmp/tmp.lZXCXAPqpp: unknown filesystem type 'crypto_LUKS'.
Oct 30 08:32:40 kubuntu ubiquity:        dmesg(1) may have more information after failed mount system call.
Oct 30 08:32:40 kubuntu kernel: [ 3088.011850]  nvme0n1: p1 p2 p3 p4 p5
Oct 30 08:32:40 kubuntu kernel: [ 3088.034833]  nvme1n1: p1 p2 p3
Oct 30 08:32:41 kubuntu ubiquity: NTFS signature is missing.
Oct 30 08:32:41 kubuntu ubiquity: Failed to mount '/dev/nvme0n1p2'
Oct 30 08:32:41 kubuntu ubiquity: : Invalid argument
Oct 30 08:32:41 kubuntu ubiquity: The device '/dev/nvme0n1p2' doesn't seem to have a valid NTFS.
Oct 30 08:32:41 kubuntu ubiquity: Maybe the wrong device is used? Or the whole disk instead of a
Oct 30 08:32:41 kubuntu ubiquity: partition (e.g. /dev/sda, not /dev/sda1)? Or the other way around?
Oct 30 08:32:41 kubuntu systemd-udevd[144979]: nvme0n1p2: Process '/usr/bin/unshare -m /usr/bin/snap auto-import --mount=/dev/nvme0n1p2' failed with exit code 1.
Oct 30 08:32:41 kubuntu systemd-udevd[144980]: nvme0n1p4: Process '/usr/bin/unshare -m /usr/bin/snap auto-import --mount=/dev/nvme0n1p4' failed with exit code 1.
Oct 30 08:32:41 kubuntu systemd-udevd[145030]: nvme0n1p5: Process '/usr/bin/unshare -m /usr/bin/snap auto-import --mount=/dev/nvme0n1p5' failed with exit code 1.
Oct 30 08:32:41 kubuntu systemd-udevd[144981]: nvme0n1p3: Process '/usr/bin/unshare -m /usr/bin/snap auto-import --mount=/dev/nvme0n1p3' failed with exit code 1.
Oct 30 08:32:41 kubuntu systemd-udevd[144977]: nvme0n1p1: Process '/usr/bin/unshare -m /usr/bin/snap auto-import --mount=/dev/nvme0n1p1' failed with exit code 1.
Oct 30 08:32:41 kubuntu ubiquity: mount: /tmp/tmp.G7NB4dtY8C: unknown filesystem type 'crypto_LUKS'.
Oct 30 08:32:41 kubuntu ubiquity:        dmesg(1) may have more information after failed mount system call.
Oct 30 08:32:41 kubuntu systemd-udevd[144978]: nvme1n1p3: Process '/usr/bin/unshare -m /usr/bin/snap auto-import --mount=/dev/nvme1n1p3' failed with exit code 1.
Oct 30 08:32:41 kubuntu systemd-udevd[145029]: nvme1n1p2: Process '/usr/bin/unshare -m /usr/bin/snap auto-import --mount=/dev/nvme1n1p2' failed with exit code 1.
Oct 30 08:32:41 kubuntu systemd-udevd[145031]: nvme1n1p1: Process '/usr/bin/unshare -m /usr/bin/snap auto-import --mount=/dev/nvme1n1p1' failed with exit code 1.
Oct 30 08:32:41 kubuntu ubiquity: NTFS signature is missing.
Oct 30 08:32:41 kubuntu ubiquity: Failed to mount '/dev/nvme0n1p2'
Oct 30 08:32:41 kubuntu ubiquity: : Invalid argument
Oct 30 08:32:41 kubuntu ubiquity: The device '/dev/nvme0n1p2' doesn't seem to have a valid NTFS.
Oct 30 08:32:41 kubuntu ubiquity: Maybe the wrong device is used? Or the whole disk instead of a
Oct 30 08:32:41 kubuntu ubiquity: partition (e.g. /dev/sda, not /dev/sda1)? Or the other way around?
Oct 30 08:32:41 kubuntu ubiquity: mount: /tmp/tmp.pNOkIfiSWm: unknown filesystem type 'crypto_LUKS'.
Oct 30 08:32:41 kubuntu ubiquity:        dmesg(1) may have more information after failed mount system call.
Oct 30 08:32:41 kubuntu kernel: [ 3088.208138]  nvme0n1: p1 p2 p3 p4 p5
Oct 30 08:32:41 kubuntu ubiquity: NTFS signature is missing.
Oct 30 08:32:41 kubuntu ubiquity: Failed to mount '/dev/nvme0n1p2'
Oct 30 08:32:41 kubuntu ubiquity: : Invalid argument
Oct 30 08:32:41 kubuntu ubiquity: The device '/dev/nvme0n1p2' doesn't seem to have a valid NTFS.
Oct 30 08:32:41 kubuntu ubiquity: Maybe the wrong device is used? Or the whole disk instead of a
Oct 30 08:32:41 kubuntu ubiquity: partition (e.g. /dev/sda, not /dev/sda1)? Or the other way around?
Oct 30 08:32:41 kubuntu systemd-udevd[144979]: nvme0n1p2: Process '/usr/bin/unshare -m /usr/bin/snap auto-import --mount=/dev/nvme0n1p2' failed with exit code 1.
Oct 30 08:32:41 kubuntu systemd-udevd[145796]: nvme0n1p5: Process '/usr/bin/unshare -m /usr/bin/snap auto-import --mount=/dev/nvme0n1p5' failed with exit code 1.
Oct 30 08:32:41 kubuntu systemd-udevd[144980]: nvme0n1p4: Process '/usr/bin/unshare -m /usr/bin/snap auto-import --mount=/dev/nvme0n1p4' failed with exit code 1.
Oct 30 08:32:41 kubuntu ubiquity: mount: /tmp/tmp.tTk52jqdMM: unknown filesystem type 'crypto_LUKS'.
Oct 30 08:32:41 kubuntu ubiquity:        dmesg(1) may have more information after failed mount system call.
Oct 30 08:32:41 kubuntu systemd-udevd[144981]: nvme0n1p3: Process '/usr/bin/unshare -m /usr/bin/snap auto-import --mount=/dev/nvme0n1p3' failed with exit code 1.
Oct 30 08:32:41 kubuntu systemd-udevd[144977]: nvme0n1p1: Process '/usr/bin/unshare -m /usr/bin/snap auto-import --mount=/dev/nvme0n1p1' failed with exit code 1.
Oct 30 08:32:41 kubuntu ubiquity: NTFS signature is missing.
Oct 30 08:32:41 kubuntu ubiquity: Failed to mount '/dev/nvme0n1p2'
Oct 30 08:32:41 kubuntu ubiquity: : Invalid argument
Oct 30 08:32:41 kubuntu ubiquity: The device '/dev/nvme0n1p2' doesn't seem to have a valid NTFS.
Oct 30 08:32:41 kubuntu ubiquity: Maybe the wrong device is used? Or the whole disk instead of a
Oct 30 08:32:41 kubuntu ubiquity: partition (e.g. /dev/sda, not /dev/sda1)? Or the other way around?
Oct 30 08:32:41 kubuntu ubiquity: mount: /tmp/tmp.7U9XGuZFRp: unknown filesystem type 'crypto_LUKS'.
Oct 30 08:32:41 kubuntu ubiquity:        dmesg(1) may have more information after failed mount system call.

Then I tried manually making the partitions first and then installing to them.

First I opened the partition editor, made a LVM volume with LUKS, added a volume group, and added an ext4 partition to it. This almost worked except grub install failed with the following message in the syslog

grub-install: error: attempt to install to encrypted disk without cryptodisk enabled. Set `GRUB_ENABLE_CRYPTODISK=y' in file `/etc/default/grub'.

I tried googling this error a bit but can't really make sense of the results. I think the tricky part is where you put grub in this case. Obviously the personal Ubuntu install already installed it to the UEFI system partition of drive 0, but telling the encrypted install to do that fails. Note that I don't want to decrypt the work partition to boot my personal OS.

Answer 1

I had this ventoy drive that happened to contain a Lubuntu iso for my Chromebook, and I figured, why not. Turns out that for whatever reason the Lubuntu installer does not have this bug, and will happily install an encrypted Lubuntu. I had to take two steps to make everything work the way I like it.

First, I don't want Lubuntu. This can be easily fixed by installing ubuntu-desktop or kubuntu-desktop and then removing lubuntu-desktop and any other leftovers. I went for Kubuntu, which already uses SDDM. You need to switch the theme to the KDE one in the system settings or weird things happen.

Then, there is the problem of grub. I now have an encrypted grub which can boot all OSes but requires a password regardless. And I have the unencrypted grub, which can't see the encrypted install. I ended up adding a custom menu entry to /etc/grub.d/40-custom:

menuentry "Work Linux" {
    insmod part_gpt
    insmod search_fs_uuid
    insmod chain
    search --fs-uuid --no-floppy --set=root 6CB2-14E8
    chainloader ($root)/efi/ubuntu/grubx64.efi
}

and then just run sudo update-grub. So now the unencrypted grub detects its own installation, Windows, and can chainload into the encrypted disk, which will then prompt for a password.

Note: the UUID was obtained from ls -l /dev/disk/by-uuid

If it wasn't for this Lubuntu luck, I would probably have removed the other drive. But that would still leave the chainloading issue. Anyway, everything seems to work now.