6

When I boot from an USB stick into my laptop I am able to mount and connect through chroot to the my hard drive and browse my files without a problem, while this has been something very very useful in times, I figure it would also be way to easy to access my files and installation for someone else.

What alternatives do I have to secure my hard drive?

4
  • I see you've put a bounty on this question, why don't you give LUKS a go?
    – Lekensteyn
    May 24, 2011 at 14:46
  • Hey @legensteyn thanks for the answer, LUKS seems nice but i want to see if there are any other alternatives. If there are not i will go with LUKS
    – amosrivera
    May 24, 2011 at 15:06
  • You misspelled my name, thus preventing from getting notified ;) There is an other encryption solution for encryption of your home directory only (see this question for a comparison of full vs home-only). AFAIK LUKS is the only full disk-encryption method that is free, secure and relatively easy to setup.
    – Lekensteyn
    May 24, 2011 at 16:51
  • sorry about the name, thanks for the link i will check it out
    – amosrivera
    May 24, 2011 at 16:56

2 Answers 2

10
+100

One word: LUKS

LUKS is a full-disk encryption method. At boot-time, you have to enter a passphrase. With the given passphrase, a key slot is unlocked and the actual key for encrypting the data is retrieved. LUKS can be seen as a encrypted partition which holds another partition.

Because most users have multiple partitions (the / partition and swap), it's often used with LVM to avoid having to enter a password for each LUKS encrypted partition. LVM can be seen as a special partition holding multiple partitions (simplified). The structure would look like this:

Disk
+-LUKS partition
  +-LVM partition
    +-/
    +-/home
    +-swap

Using the alternate CD, you can create a new installation using LVM + LUKS. Within the disk partitioning step, an option is visible for copying data from another partition. If you do not mind reinstalling the whole system, backup your files and settings and do a new installation using the alternate CD.

For a more correct documentation of LUKS (cryptsetup), see Cryptsetup FAQ.

2

I am aware of two solutions: LUKS and Truecrypt (discontinued).

Truecrypt is generally used for encrypting part of your hard disk or an external disk. It is possible to encrypt entire hard disks with Truecrypt, with a small unencrypted partition for pre-boot authentication and decryption. However, this only works with Windows systems. I would only use Truecrypt for non-bootable disks. Truecrypt's source code is publicly available, it's free of charge and it's reliably cross-platform. It's not included in Ubuntu's repositories because it's not strictly open source.

Update: The TrueCrypt developers have mysteriously discontinued it and now recommend other solutions.

LUKS/cryptsetup is better integrated with Ubuntu, specifically Nautilus and Disk Utility. If you're installing a fresh system, it's very easy to encrypt the entire hard drive using the alternate CD. There's an option in the install process that does it all for you automatically. I would definitely recommend using LUKS unless you have to use Truecrypt.

I'm currently multi-booting an unencrypted Windows system, an unencrypted Debian system and a LUKS encrypted Ubuntu system (which includes both the root partition and swap). Getting this set up was complicated, but there are guides online. One thing to be aware of is that LUKS LVMs cannot be resized to the left, and resizing to the right is complicated.

4
  • 1
    Truecrypt has a restricted license, even if it's source is openly available, the development looks closed.
    – Lekensteyn
    May 24, 2011 at 17:07
  • Hence "almost open source". My edit makes this even clearer.
    – Flimm
    May 24, 2011 at 17:17
  • I edited your question, because I think "publicly available source code" hits the nail on the head together with "ugly licensing". If you don't like it, roll it back or re-edit it. Jan 24, 2015 at 11:22
  • 1
    @DavidFoerster: Cool, thanks. I also added the update about TrueCrypt being discontinued.
    – Flimm
    Jan 26, 2015 at 10:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .