1

The current system would be full disk encrypted, and I want to move/map the /home folder to an external hard drive that is formatted with LUKS encryption as well. Is this possible?

Linux updates keep breaking everything for me. I think it might have something to do with the FDE. I just want to be able to have my /home data saved, encrypted and on another hard drive.

sudo lsblk

(sda1 in this case would be the external encrypted drive where /home would be)

NAME                                          MAJ:MIN RM   SIZE RO TYPE  MOUNTPOINT
sda                                             8:0    0 931.5G  0 disk  
└─sda1                                          8:1    0 931.5G  0 part  
  └─luks-39afxxxxxxxxxxxxxxxxxxxx 252:3    0 931.5G  0 crypt /media/user/My_external_drive
sdb                                             8:16   0 931.5G  0 disk  
├─sdb1                                          8:17   0   487M  0 part  /boot
├─sdb2                                          8:18   0     1K  0 part  
└─sdb5                                          8:21   0   931G  0 part  
  └─sda5_crypt                                252:0    0   931G  0 crypt 
    ├─xubuntu--vg-root                        252:1    0 919.1G  0 lvm   /
    └─xubuntu--vg-swap_1                      252:2    0  11.9G  0 lvm   [SWAP]
sr0                                            11:0    1  1024M  0 rom   

cat /etc/fstab

# /boot was on /dev/sda1 during installation
UUID=f2c4a3ef-xxxx-xxxx-xxxx-xxxx /boot           ext2    defaults        0       2
/dev/mapper/xubuntu--vg-swap_1 none            swap    sw              0       0

sudo cat /etc/crypttab

sda5_crypt UUID=4426b1a1-xxxx-xxxx-xxxx-xxxx none luks,discard

sudo blkid

/dev/mapper/sda5_crypt: UUID="NKYcrR-xxxx-xxxx-xxxx-xxx-xxxx-xxxx" TYPE="LVM2_member"
/dev/mapper/xubuntu--vg-root: UUID="fffe201d-xxxxxxxxxxx" TYPE="ext4"
/dev/sda1: UUID="39af7a74-xxxx" TYPE="crypto_LUKS" PARTUUID="04f839ad-xxxxxxxxxxxxxxxxxxxxxxx"
/dev/sdb1: UUID="f2c4a3ef-xxxx" TYPE="ext2" PARTUUID="df4931bf-01"
/dev/sdb5: UUID="4426b1a1-xxxxxx" TYPE="crypto_LUKS" PARTUUID="df4931bf-05"
/dev/mapper/xubuntu--vg-swap_1: UUID="2abaef03-xxxxxx" TYPE="swap"

***external luks encrypted drive I want to use as /home****

/dev/mapper/luks-39axxxxxxxxxxxx: LABEL="My_external_drive" UUID="d7f7xxxxxxxxxxxxxxxxxxx" TYPE="ext4"

  • I do this frequently to an external HDD encrypted with Trucrypt. But the same should work for you. Mount the luks encrypted HDD. Since you are already logged in, your /home file structure is already decrypted. Just use your favorite backup/copy scheme to update a /home directory you created on your HDD. – jones0610 Jul 12 '17 at 4:13
  • Thanks for the reply. I was thinking more along the lines of keeping the /home folder on the external luks encrypted hard drive instead of having to copy all of it over. There quite a bit to copy. Like have it automatically mount that folder on the external encrypted drive on start up etc. Does anyone know if this is possible? Or wait are you talking about something like rsync to copy the internal /home to the external /home? – positivetypical Jul 12 '17 at 5:21
  • I believe he was recommending that you copy from the internal storage to the external storage. You would have to update your /etc/crypttab to include the external disk, and you would have to update /etc/fstab so that it mounts your /home directory from the external disk. Once all of that is done, you should probably run sudo update-initramfs -k all -u. If you don't know how to do all of this, update your question with the output of sudo lsblk, cat /etc/fstab, sudo cat /etc/crypttab, and sudo blkid, and I or someone else might be able to provide more detailed steps. – b_laoshi Jul 14 '17 at 6:27
  • Yes please. I'm new to ask ubuntu, how do you change the output of my original question? Is this done with tags or do I simply include those words in my text? I would love to know how to do this correctly. I edited /etc/fstab suggested by another post but I clearly did it wrong. If you'd be so kind to help that would be greatly appreciated. – positivetypical Jul 14 '17 at 22:23
  • Sorry for the delay, I'm currently on vacation. Use the "edit" link to modify the content of your question. Then put the output of those commands inside <pre></pre> tags. – b_laoshi Jul 19 '17 at 6:56
1

Migrating /home and other apparent issues

First of all, it would appear that your root partition at /dev/mapper/xubuntu--vg-root is not configured in /etc/fstab. That will need to be fixed. Second, your /boot partition is rather small. Be diligent about removing old kernels or you will have problems installing updates once your /boot partition gets filled to 100%. Creating a larger boot partition and putting home on a separate drive altogether can be easily accomplished with manual partitioning during install. See how to go about that in my post here if you're interested, but it only applies to new installations.

I should be able to help you with the migration and getting your root partition back into /etc/fstab. Since you've indicated that you've already made changes to one or more of these files, I'll assume that you already know how to edit files as root or with sudo. You'll need to make any file changes mentioned below in this way.

Grabbing a system image:
We're going to be making some significant system changes. If you have a "working" system right now, you should use a tool like Clonezilla to grab a system image to restore from in case anything gets really messed up! While this isn't absolutely necessary, I strongly advise it!

Fixing /etc/fstab:
Edit /etc/fstab and add a line at the top that reads as follows:
/dev/mapper/xubuntu--vg-root / ext4 errors=remount-ro 0 1
Without that line, your computer won't even boot.

Migrating /home:
There are a few parts to this. You must move all of your documents to the external drive. You must update your /etc/crypttab file so that your system can decrypt your external drive during boot. This means you're going to have to enter a password to decrypt your internal disk and then you'll have to enter another password to decrypt your external disk. There are ways to unlock two disks while providing only one password, but I won't get into that here. If you want to know more about that read here and here. You must also update /etc/fstab so that your system knows how to mount your home directory. Finally, you need to update your initramfs.

  1. Copy the contents of your home directory to the external drive. In a terminal, run the following, changing the path to the external drive as necessary. Each of these commands could take several minutes to run.
    • Create hashes to be used later for verifying integrity of copied files. It's not absolutely necessary, but it's nice to be able to confirm that nothing got corrupted while being copied.
      sudo find $HOME -type f -exec md5sum '{}' >> $HOME/checksums.md5 \;
    • Copy everything in your home directory to your external drive
      sudo cp -ar $HOME/. /media/$USER/My_external_drive
    • If you created checksums of all your files, go ahead and check them. If you were logged into your account, be aware that some files may naturally change between the point of creating checksums and checking the copied files. If there were any failures, just make sure they aren't important files.
      cd /media/$USER/My_external_drive
      sudo md5sum -c checksums.md5 | grep "FAILED"
    • You'll also need to delete everything from /home so it can be used as a mount point, but we don't want to do that from your local xubuntu install. We'll wait until we're ready to reboot and use a live CD/USB for that.
  2. Updating /etc/crypttab:
    Open /etc/crypttab for editing and add the following line, replacing the x's with the actual values of the UUID for your LUKS partition on your external drive.
    luks_home UUID=39af7a74-xxxx none luks,discard
  3. Updating /etc/fstab to include the new /home partition:
    Open /etc/fstab for editing and add the following line to the end
    /dev/mapper/luks_home /home ext4 defaults 0 2
  4. Update your initramfs
    sudo update-initramfs -k all -u

Things to check:
Your /etc/fstab file should now look something like this:

/dev/mapper/xubuntu--vg-root   /   ext4    errors=remount-ro   0   1
# /boot was on /dev/sda1 during installation
UUID=f2c4a3ef-longstringofnumbers /boot           ext2    defaults        0       2
/dev/mapper/xubuntu--vg-swap_1 none            swap    sw              0       0
/dev/mapper/luks_home  /home   ext4    defaults    0   2

Your /etc/crypttab file should now look something like this:

sda5_crypt UUID=4426b1a1-longstringofnumbers none luks,discard
luks_home  UUID=39af7a74-xxxx  none    luks,discard

If you find any problems with the /etc/crypttab file and you make changes, be sure to run the update-initramfs command again from point 4.

Reboot into live OS
Once you're sure you have everything you need copied over, it's time to erase everything from /home so it can be used as a mount point. Get your live CD/USB, and boot from it.

  • Once booted, you'll need to decrypt and mount the LUKS partition on your internal disk. Run the following commands to do so, entering your encryption password when prompted

    dev=$(sudo lsblk | grep -B1 "sda5_crypt" | grep -oP "sd[a-z]\d\b" | awk '{print "/dev/"$1}')
    sudo cryptsetup luksOpen $dev internal_crypt
    sudo mount /dev/mapper/xubuntu--vg-root /mnt
    

  • Now your old home partition should be located at /mnt/home. Let's delete everything inside
    sudo rm -fr /mnt/home/*

Reboot into local installation:
At this point, you're ready to reboot. With your old home directory emptied out, shutdown the live OS and reboot into your system. Your system should now ask for two passwords, one to decrypt the internal drive and one to decrypt the external drive. Assuming you enter both of these correctly, your system should boot up, and your home directory should reside on your external drive.

Verifying that the external drive is being used as /home:
If everything is pretty much where you left it in your home directory, you're golden. You can type mount | grep "/home" into a terminal window. It should show that your LUKS partition on your external drive is mounted at /home.

  • Hmm thank you for that thorough post. I'm getting a log in loop. I log in and it presents me with the login prompt again and again. This is what i did so far, I didn't want to mess with my current set up so i rsync'd /home to the external drive and used virtualbox to install xubuntu (this time I used xubuntu 17, don't know if that effects anything) onto USB drive. Made the edits to fstab and crypttab and ran sudo update-initramfs -k all -u per your instructions. Then I booted live usb and through the GUI desktop removed users in /home. Not sure what I'm doing wrong. – positivetypical Jul 28 '17 at 10:23
  • I'll keep messing with it on my chromebook with 2 usb drives, one for the install and the other as a token /home folder just to see if I cant get it to decrypt and mount as home. Oh btw you are right I accidentally omitted that line in my fstab, I thought it was part of the comment block. It does look like how you posted. – positivetypical Jul 28 '17 at 10:23
  • I tried again with my laptop this time, using the two USBs - one the install and the other luks encrypted external /home. This time I actually the 2nd luks login for the external /home. How exciting. But it's still looping the log in prompt. An error shows during boot, something about can't map dmari or something like that. So close yet so far lol. – positivetypical Jul 28 '17 at 13:24
  • I got it to work! i had the whole folder /home/users in there. I did a <pre>mv myuser ..</pre> and deleted the home folder and it worked perfectly!! I guess I missed the part about just the contents inside home to be synced. Thank you very much b_laoshi!!! – positivetypical Jul 28 '17 at 14:12
  • Glad it worked for you. You can designate that this answered your question by clicking on the check mark beside the answer (at the top). – b_laoshi Jul 29 '17 at 4:31

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.