[SOLVED] Creating a separate encrypted /home partition?

saturnalia0 · Apprentice Joined: 13 Oct 2016 Posts: 158

Given recent events in my country, I believe it to be in my best interest to have my devices encrypted. My first instinct was to go with FDE, but AFAIK that would require a fresh install and has its own set of pitfalls. So I'm thinking about creating a separate partition for my /home and have only that encrypted. Maybe it's not the best, and I accept any comments on that, but I think it would fit my threat model of having things like the browser folder encrypted when I turn off my device. That being said, I found the following wiki page:

https://wiki.gentoo.org/wiki/Encrypt_a_home_directory_with_ECryptfs

As far as I understand, this does not create a new encrypted partition for /home, rather, it just creates an encrypted mount point. Which may be fine, but I wonder if a separate partition wouldn't be better? In the sense that things are then truly isolated. Sorry but I'm a bit of a noob when it comes to anything but file-level encryption. Any guidance is appreciated.

pietinger · Posted: Sat Aug 31, 2024 1:40 am Post subject:

Maybe read this thread
https://forums.gentoo.org/viewtopic-t-1169021.html

I am using fscrypt as mentionend in my post there. fscrypt also has the great advantage that it comes with a pam_fscrypt.so, which ensures that the /home directory (or every directory you want = you have encrypted) is also unlocked at the same time as the login (so you don't need two logins/password inputs).
_________________
https://wiki.gentoo.org/wiki/User:Pietinger

saturnalia0 · Apprentice Joined: 13 Oct 2016 Posts: 158

Thanks, I'll review that. I actually suggested some file-level encryption there myself, but I didn't remember the thread. I'll review your suggestion

arran4 · Posted: Sat Aug 31, 2024 2:15 am Post subject:

There seems to be work on per-file / folder encryption going, I was watching https://www.youtube.com/watch?v=6YIc2fVLVPU talk about it. I believe homed can do this on btrfs (using fscrypt.)

mega_flow · Posted: Sat Aug 31, 2024 9:12 am Post subject:

Or Systemd homeD . that 1 can encrypt too .Using for more ten a year now and work fine for me
_________________
default/linux/amd64/23.0/no-multilib/gnome/systemd gnome:46

lars_the_bear · Guru Joined: 05 Jun 2024 Posts: 517

I'm a long-term user of ecryptfs and, while I'm aware of problems with it, it's hugely convenient.

In my view, anything short of whole-disk encryption of all storage devices runs the risk of a false sense of security. You need to keep track of every place that sensitive content might be written, and ensure that's in an encrypted container of some sort. Many applications write temporary and working files in all sorts of places -- /tmp, hidden directories under $HOME, and so on. And, if you're really paranoid, you need to wonder about what's going into the swap partition, if you have one.

I believe that all forms of per-directory or per-partition encryption are quite weak. But they're strong enough for the threats I believe I face in my personal use of a computer. For business I always use whole-disk encryption. I'd do the same for my home computers, if I felt that I was genuinely exposed to governmental or military threats.

BR, Lars.

saturnalia0 · Apprentice Joined: 13 Oct 2016 Posts: 158

So, my understanding is fscrypt is file-level encryption using the crypto support from the kernel.

This section from Arch wiki on fscrypt seems insightful:

simplycorbett · n00b Joined: 14 Mar 2024 Posts: 27

I would personally just encrypt the entire drive or at least the / partition with /home.

If you want to encrypt just /home, my recommendation:

1) create a separate /home partition on a LUKS encrypted device
2) on boot when you get to the login screen change your terminal/monitor tty so you get a text session. Login as root (not the user and make sure root can be logged into).
3) unlock the encrypted home partition and mount it. Logout.
4) change your tty back to the login screen and proceed to login as normal.

You're done.

If you don't care about encrypting /boot, you can encrypted / as well. GRUB is able to unlock it. Make sure you make changes to your use flags so the system builds with support for this.

If you also want to encrypt /boot and the swap partition, it's a bit more complicated.

simplycorbett · n00b Joined: 14 Mar 2024 Posts: 27

As a side note if you boot up a livecd you can backup the entire home directory with this:

Hu · Administrator Joined: 06 Mar 2007 Posts: 22619

Rather than create the file on the partition and then move it, why not create it where you want it to be? Likewise, there is no need to move the tar file back onto the encrypted partition before unpacking it.

simplycorbett · n00b Joined: 14 Mar 2024 Posts: 27

saturnalia0 · Apprentice Joined: 13 Oct 2016 Posts: 158

Just in case it's useful for anyone finding themselves here through a web search, this is what I ended up doing and worked well for me:

1. Create a /home partition in a new drive

For this just follow the handbook: https://wiki.gentoo.org/wiki/Handbook:AMD64/Installation/Disks#Partitioning_the_disk_with_GPT_for_UEFI

Create the partition but not the filesystem.

2. Setup encrypted storage for the partition

Basically follow the wiki: https://wiki.gentoo.org/wiki/Dm-crypt

I've upgraded the wiki page with some details that I found useful.

3. Move to the new home

With the encrypted partition created, manually opened, and mounted to /mnt/home, copy the files to the encrypted home: