Why do I need my admin password AND the encryption password when mounting a Veracrypt encrypted partition but not when mounting a LUKS encrypted USB?

Question

This doesn't matter much but I'd like to understand why: I have an encrypted partition on my internal SSDs (laptop and dekstop), encrypted with Veracrypt (the GUI version).

I also use a LUKS encrypted external drive to sync between my laptop and desktop; I created that a long time ago and can't remember exactly how I did it but I don't think I did anything exotic and it works fine - if that's important I can try to elaborate.

When I open Veracrypt and select to mount the partition, it prompts me for the encryption password as expected; if I type the correct password I then have to enter my Ubuntu user password.

When on the other hand I decrypt the LUKS encrypted external drive, it asks me for the encryption password but then just opens - I don't have to enter a second password.

It's not that the system remembers that I've typed in my password for a bit as it will behave like this even if I do it the other way round, ie the USB never asks for anything other than the decryption password, the Veracrypt one always asks for 2 passwords (unless I've recently decrypted it).

So - why do I need an administrator password for one but not the other? Is it treating an internal disk differently, is it something to do with how Veracrypt works, or is it something about how I've set those up (or something completely different)?

System: Ubuntu 22.04.3LTS Desktop Veracrypt: 1.25.9 (GUI version)

The Veracrypt partition mounts at /media/Veracrypt1 The USB mounts at /media/will/Lsync

Both have me as the owner (ie not root)

Full output of ll: USB drive: drwxr-xr-x 8 will will 4096 Sep 23 17:17 Lsync/

Veracrypt partition: drwxrwxrwx 19 will will 4096 Oct 1 20:18 veracrypt1/

Thank you!

Answer 1

You have to be an admin to mount internal partitions

Mounting an internal partition always requires admin privileges (AKA sudo if you use the terminal), unless the internal partition is mounted automatically at boot (using fstab for example). Even if you use a GUI, you will still be asked for the admin password when you mount an internal partition.

This is a security measure.

Anyone can use an USB drive (you don't have to be an admin)

Mounting an external USB drive does not require any admin privileges. Basically you plug in an USB drive and all its partitions are automatically mounted. This is how Ubuntu and other popular OSes behave by default. Whether the partitions are encrypted or not and by which app is secondary.

You can test is out with unencrypted internal partitions and unencrypted USB drives.

Hope this helps