I have an extra ext4 formatted partition which I would like to ecrypt with ecryptfs. I have chosen not to go for home directory ecryption and having a encrypted private directory also hasn't helped me.

So, the remaining option for me is to encrypt the extra partition. So, I want to know what is the best way to achieve this. The drive should get mounted when I log in. And I should be able to move my Documents and other important folders in the home directory to the encrypted drive, and symlink them back to the home directory. As I save some passwords in firefox, should I move the hidden firefox folder in the home directory to the encrypted drive?

  • May I ask why do you want to do this, since you are trying to create exactly the same thing as encrypted home? Is it space? I would just move home to the other partition. – danizmax Dec 23 '10 at 19:23
  • I share my pc with my pals. And it is not possible to turn off automounting of home directory if I wanted it. If I have a ~/Private encrypted directory, I can turn off auto mounting If I wanted, but, the directory is visible so it can be easily deleted. If it is a drive it is more safer, and, as it is noticable during OS re-installs,so it's, according to me, a safer option. If I disable automounting, it is easy to convince my pals that it is a hidden OS backup drive. – nixnotwin Dec 25 '10 at 2:26

Probably the simplest way to do this is to use an "Encrypted Private" directory. This will make ~/Private encrypted, and you can move trees into there and symlink to them (for firefox, etc). It is very easy to set up:

sudo apt-get install ecryptfs-utils

Now just log out of your session and back in, and you'll have an encrypted ~/Private directory automounted. You can move things into it like this:

cd ~
mv .mozilla Private/
ln -s Private/.mozilla .

For more details, see "man ecryptfs-setup-private", or read the manpage online

| improve this answer | |

You should know that if a person has physical access to the machine, there is little thing you can do to prevent deletion or other evil actions, be it a directory or a partition: they can still boot with a CD if you put "passwords-everywhere".

For directories, you can also use encFS which is very nice.

For partition, if you want deniability (eg. possibility to deny it is no more than a spare partition), the only option you have is TrueCrypt. But if you automount it you'll loose deniability as a script can be found that mounts this partition.

So, to really "hide", you have to mount manually.

| improve this answer | |
  • plain dm-crypt has no header, and should in theroy be as deniable as TrueCrypt... maybe more so since I read about a TrueCrypt-finder once. And no encrypted data is really hidden since it's giant blocks of pseudo-random data, anyone who sees it knows something is going on. Also read that the "hidden container" feature in TrueCrypt really only puts you in danger of everyone automatically assuming that you do have a hidden container, so you'll be questioned/prosecuted/tortured even more if you actually don't have a hidden container. – Xen2050 Feb 29 '16 at 21:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.