I've recently enabled Ubuntu's encrypted /home/ directory features and I was asked to remember a passphrase in case I would need to recover the data manually.
What is the best way to store this passphrase without compromising security?
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It only takes a minute to sign up.Sign up to join this community
Write it down, on a bit of paper. Put that paper somewhere safe, like where you put your passports and important papers.
Encryption keys should be copied onto a USB stick and put into the same place.
I use Password Gorilla and PasswordSafe for everyday password storage and have the password to that in my brain (its complex, the only one I have to remember and used daily) and on a safe bit of paper (in case that fabled bus hits me).
Excellent tool not just for passhrases, but for any login/password you have to store.
I personally use for all my passwords for all on line services I use.
Some of its features:
you can use the linux native KeepassX
sudo apt-get install keepassx
Personally I prefer to use the original Keepass, since I can run it from my thumb drive on any system I have to use. But KeepassX is fine if you intend to use it only on your personal computer.
PS: You can install Mono, KeepassX and Wine from the Software Center if don't already have them.
As of Ubuntu 11.04 (at least that's when I noticed), you can install Keepass 2 from the Software Center or
sudo apt-get install keepass2
You shouldn't be using software to store the recovery passphrase for your encrypted home directory. If you store the passphrase in an application, it would get stored in your home directory and wouldn't be available when your encrypted home directory is the very thing you are trying to recover!
Writing it down on a piece of paper, or storing it on a usb key in a physical secure location such as a safe would be the best way to store your encrypted home directory passphrase.
Write it on the wall, hidden in a little corner of your house.
But, also, an excellent idea is to write it wherever you choose but do not write it down literally; use a mnemonic system.
For example, write: "dumbest_commander+my_nr", if your password is "gwbush3355" and 3355 is a number you know and remember well; or write down: "little love+yr", if the password is the first person you fell in love with followed by the year that happened; or write down: "colourcitysport", if your password is "greencalcuttatennis" because your favourite colour, city and sport are: green, calcutta and tennis; or write: "pornstr + b-yr", if you want to use your favourite pornstar's name followed by her/his birthyear as a password, etc., etc. It is up to your imagination.
This is good for personal use when you have many different passwords and/or don't use them very often. This is the intelligent way to do this kind of things.
I just heard of passwordcard.org from Planet Ubuntu .. it's a pretty genius system for creating strong passwords, and saving them for later. You essentially make a card at the site using some hexidecimal number, and you get a card full of random passwords. You then determine a way to get a password from the card (for instance, for your encrypted partition, choose the smiley face column, blue row, all the way to the end). Check it out at passwordcard.org
As some others recommended here writing the password down is a good idea. However I want to add some points:
There are other ways of storing your password. You should thing about some short term strategy until you have memorised your password. Later you should switch to some long term strategy with higher security requirements.