Adding another answer here as many of the other resources I've found (here and elsewhere) are quite a bit outdated, and I think some of the steps can be simplified.
First, as mentioned in other answers, If you don't want to dual boot, simply choose the encryption option in the automated installer.
It is worth noting that this method doesn't encrypt
/boot. While there are valid reasons for encrypting
/boot, the graphical installer does not encrypt it when you do a graphical install with LUKS. As such, I'm matching that precedent, and keeping the simplicity of an unencrypted
Ubuntu 20.04 and Windows 10
Throughout this guide, I'm going to reference
/dev/sda. Yours might be different - in particular, it might be
/dev/nvme0n1. Simply make the substitutions as appropriate below, noting also that
/dev/sda1 would correspond to
Partitioning can be done with GParted, sgdisk, or gdisk. sgdisk is easiest to reference here as commands.
- Configure your BIOS for UEFI only. No MBR, no legacy boot.2
- Initialize the drive as a GPT drive and create a 550M EFI system partition formatted as FAT32 (as root).
# sgdisk --zap-all /dev/sda
# sgdisk --new=1:0:+550M /dev/sda
# sgdisk --change-name=1:EFI /dev/sda
# sgdisk --typecode=1:ef00 /dev/sda
# mkfs.fat -F 32 /dev/sda1
- Install Windows. In the installer, choose to create a new partition for Windows, and make this the appropriate size (roughly half your hard disk). Leave unallocated space to use later for Ubuntu. When you do this, the installer will actually make multiple partitions for Windows reasons.
- If desired, after Windows installation is complete, enable BitLocker on your
C: drive. This will make another partition.
- Make partitions for Ubuntu (as root). The 768M partition is for
/boot. The other is for Ubuntu and will be encrypted with LUKS and use LVM (similar to how the default installation process would set it up). (If you didn't set up BitLocker before, your partition numbers will be off by 1 from my example below (so my sda5 is your sda4).
# sgdisk --new=5:0:+768M /dev/sda
# sgdisk --new=6:0:0 /dev/sda
# sgdisk --change-name=5:/boot --change-name=6:rootfs /dev/sda
# sgdisk --typecode=5:8301 --typecode=6:8301 /dev/sda
# mkfs.ext4 -L boot /dev/sda5
- Set up LUKS and LVM (as root). I did 8G of swap space. A good rule of thumb is the amount of RAM in your system. Swap will be encrypted.
# cryptsetup luksFormat --type=luks1 /dev/sda6
# cryptsetup open /dev/sda6 sda6_crypt
# pvcreate /dev/mapper/sda6_crypt
# vgcreate ubuntu-vg /dev/mapper/sda6_crypt
# lvcreate -L 8G -n swap_1 ubuntu-vg
# lvcreate -l 100%FREE -n root ubuntu-vg
- Install Ubuntu using the graphical installer. Choose the partitions yourself.
- The bootloader device should be
- When the installer finishes, don't exit. We need to set up
/etc/crypttab (as root). This is what will trigger your passphrase prompt on boot. Replace the UUID in the file with the UUID of your drive, obtained from
sudo blkid /dev/sda6
# mount /dev/mapper/ubuntu--vg-root /target
# mount /dev/sda5 /target/boot
# for n in proc sys dev etc/resolv.conf; do mount --rbind /$n /target/$n; done
# chroot /target
# mount -a
# echo 'sda6_crypt UUID=abcdefgh-1234-5678-9012-abcdefghijklm none luks,tries=0,discard,loud' > /etc/crypttab
# update-initramfs -k all -c
Done! If you use BitLocker on Windows, it won't like being booted with grub. Instead, boot directly to Windows from your BIOS boot options.