Creating a separate encrypted /home partition?

[saturnalia0]

Given recent events in my country, I believe it to be in my best interest to have my devices encrypted. My first instinct was to go with FDE, but AFAIK that would require a fresh install and has its own set of pitfalls. So I'm thinking about creating a separate partition for my /home and have only that encrypted. Maybe it's not the best, and I accept any comments on that, but I think it would fit my threat model of having things like the browser folder encrypted when I turn off my device. That being said, I found the following wiki page:

https://wiki.gentoo.org/wiki/Encrypt_a_home_directory_with_ECryptfs

As far as I understand, this does not create a new encrypted partition for /home, rather, it just creates an encrypted mount point. Which may be fine, but I wonder if a separate partition wouldn't be better? In the sense that things are then truly isolated. Sorry but I'm a bit of a noob when it comes to anything but file-level encryption. Any guidance is appreciated.

[pietinger]

Maybe read this thread
https://forums.gentoo.org/viewtopic-t-1169021.html

I am using fscrypt as mentionend in my post there. fscrypt also has the great advantage that it comes with a pam_fscrypt.so, which ensures that the /home directory (or every directory you want = you have encrypted) is also unlocked at the same time as the login (so you don't need two logins/password inputs).
_________________
https://wiki.gentoo.org/wiki/User:Pietinger

[saturnalia0]

Thanks, I'll review that. I actually suggested some file-level encryption there myself, but I didn't remember the thread. I'll review your suggestion

[arran4]

There seems to be work on per-file / folder encryption going, I was watching https://www.youtube.com/watch?v=6YIc2fVLVPU talk about it. I believe homed can do this on btrfs (using fscrypt.)

[mega_flow]

Or Systemd homeD . that 1 can encrypt too .Using for more ten a year now and work fine for me
_________________
default/linux/amd64/23.0/no-multilib/llvm/gnome/systemd gnome:46

[lars_the_bear]

I'm a long-term user of ecryptfs and, while I'm aware of problems with it, it's hugely convenient.

In my view, anything short of whole-disk encryption of all storage devices runs the risk of a false sense of security. You need to keep track of every place that sensitive content might be written, and ensure that's in an encrypted container of some sort. Many applications write temporary and working files in all sorts of places -- /tmp, hidden directories under $HOME, and so on. And, if you're really paranoid, you need to wonder about what's going into the swap partition, if you have one.

I believe that all forms of per-directory or per-partition encryption are quite weak. But they're strong enough for the threats I believe I face in my personal use of a computer. For business I always use whole-disk encryption. I'd do the same for my home computers, if I felt that I was genuinely exposed to governmental or military threats.

BR, Lars.

[saturnalia0]

So, my understanding is fscrypt is file-level encryption using the crypto support from the kernel.

This section from Arch wiki on fscrypt seems insightful:

[simplycorbett]

I would personally just encrypt the entire drive or at least the / partition with /home.

If you want to encrypt just /home, my recommendation:

1) create a separate /home partition on a LUKS encrypted device
2) on boot when you get to the login screen change your terminal/monitor tty so you get a text session. Login as root (not the user and make sure root can be logged into).
3) unlock the encrypted home partition and mount it. Logout.
4) change your tty back to the login screen and proceed to login as normal.

You're done.

If you don't care about encrypting /boot, you can encrypted / as well. GRUB is able to unlock it. Make sure you make changes to your use flags so the system builds with support for this.

If you also want to encrypt /boot and the swap partition, it's a bit more complicated.

[simplycorbett]

As a side note if you boot up a livecd you can backup the entire home directory with this:

[Hu]

Rather than create the file on the partition and then move it, why not create it where you want it to be? Likewise, there is no need to move the tar file back onto the encrypted partition before unpacking it.

[simplycorbett]