10

How do I create a separate /home partition in the Ubuntu 12.10 graphical installer after selecting the full disk encryption option? I would like to ensure that the contents of the entire disk including all partitions are encrypted as well.

3
  • Just to clarify: would you like to have the separate /home to be encrypted as well? And would you like a real new partition or would a separate logical volume suffice too?
    – gertvdijk
    Jan 31, 2013 at 22:43
  • > Files on '/' will not need to be encrypted. These files start up the system, > applications and system wide configuration. It will be unnecessary to hide > them, because they come with every distro. Well, as it's a corporate requirement, the choices are either do "full-disk encryption" under Linux, or chose another OS or distro that does support FDE. No excuses, no trying to talk logic. And perhaps they're right anyway.
    – user141254
    Mar 18, 2013 at 3:11
  • @jelabarre There are reasons one might want to encrypt /. Mar 19, 2013 at 14:01

2 Answers 2

0

This works on Mint 17.2 as well. It's hard to believe this still hasn't been fixed.

Partitioning

Boot to install disk, and open terminal. Assuming you want to use GPT, without UEFI, partition your disk with gdisk.

gdisk /dev/sda

In gdisk:

  • Create a new GUID partition table
  • Create a 1M bios boot partition (partition type ef02). Start=0, End=+1M.
  • Create a grub partition (partition type 8300). At lease 256 MB.
  • Create a LUKS crypt partition (partition type 8E00). Keep the suggested Start/End to use the rest of the disk.
  • Press 'w' to write to disk.

Now create the LUKS container on the partition you just created, and call it "lvm" (or whatever you want):

cryptsetup luksFormat /dev/sda3
cryptsetup luksOpen /dev/sda3 lvm

Create the physical volume for LVM in the LUKS container, and then the volume group:

pvcreate /dev/mapper/lvm
vgcreate lvmgrp /dev/mapper/lvm

Create your logical volumes (your sizes may vary):

lvcreate -L 4G lvmgrp -n swapvol
lvcreate -L 20G lvmgrp -n rootvol
lvcreate -l +100%FREE lvmgrp -n homevol

Install Ubuntu/Mint

Now start the installer, leaving the terminal open. At the partitioning step, select "Something Else". Set the mount points for the following, checking the "format" box where applicable:

  • mount /dev/sda2 on /boot
  • mount homevol on /home
  • mount rootvol on /
  • Set swapvol to be a swap space.

Now continue installation, but at the end of the installation click "Continue trying."

Before Rebooting

Back in your terminal, mount your new system in a chroot:

mount /dev/mapper/lvmgrp-rootvol /mnt
mount /dev/sda2 /mnt/boot
cd /mnt
mount /dev --bind dev
chroot .
mount proc
mount sysfs
mount devpts
mount tmpfs

Run blkid to get the UUID of the LUKS container (/dev/sda3).

Edit or create /etc/crypttab, with the following line:

lvm UUID=8f379863-d591-4101-9251-70ae8a34ad02 none luks

your UUID will be different, of course. This will cause the system to try to open the LUKS container at boot, with the name "lvm".

It's the initial RAM image that will actually do this, so we need to update it:

update-initramfs -u

This will read from the crypttab file and make the necessary changes to the initram image. Now you'll get a prompt to enter your passphrase at boot.

Unmount everything, just to be safe:

umount tmpfs
umount devpts
umount sysfs
umount proc
exit
umount dev
umount boot
cd
umount /mnt

Now reboot, and remove the install disk.

Explanation

So here's what happens at boot:

  • BIOS gives control to GRUB, which loads the kernel and executes the initram image, located in your /boot partition.
  • The initram is configured to unlock the LUKS container, so it will do this next.
  • Now the root file system (in rootvol) is accessible, so the kernel can finish loading the system.

Here's a good reference.

0

Warning: Keep in mind what you are doing has to be done right or you may potentially destroy other systems on your hard drive or data on other partitions. If you are installing to the entire hard drive and want to overwrite the entire disk, no worries.

When you are installing, when you see this screen:

enter image description here

Choose Something else.

You will need to create the minimum of two partitions (three if you want a swap).

Create one partition for you system and set it's mount point to '/'

Create another partition for your home directory and set it's mount point to '/home'

Create a swap partition as well if you need one.

When you are asked to encrypt the /home directory, choose that option.

See this tutorial before you start this process. If you have another system installed already and want it to install beside it, make sure you back it up with remastersys or just back up your files.

6
  • 1
    I want to fully encrypt the hard disk including / and also have separate /home partition not just encrypt /home directory.
    – Islam
    Dec 27, 2012 at 16:25
  • Files on '/' will not need to be encrypted. These files start up the system, applications and system wide configuration. It will be unnecessary to hide them, because they come with every distro. System configuration is more than likely harmless for people to view. If you don't want people to see your applications, then do not install them from the repos, instead install the executable to your home directory and they will be encrypted. If you do that you may have to get the source code, and compile them on your own. Little learning to do there,but not too difficult.
    – cxx6xxc
    Dec 28, 2012 at 0:59
  • @cxx6xxc Actually, there are benefits to encrypting /. Information about how the system is used can be discovered by reading files in / that are not in anyone's home directory. Mar 18, 2013 at 3:39
  • @cxx6xxc There might be confidential data on the swap partition, and at least in /tmp and /var (log files or data from a mysql etc). Also, there might be non standard software writing into other directories. If you want to be safe, full disk encryption is very useful.
    – iGEL
    Feb 3, 2014 at 22:00
  • @EliahKagan Is it possible to encrypt /?
    – Tim
    Apr 27, 2015 at 13:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .