Christoffer Kjølbæk I have a blog, therefore I am…

Encrypted home partition, using LUKS in Ubuntu Feisty Fawn

This guide will very briefly describe how to setup an encrypted LUKS partition and mount it on log in.

Preparation
Start by installing the software needed:

sudo apt-get install libpam-mount cryptsetup

Add these line to /etc/initramfs-tools/modules

dm_mod
dm_crypt
sha256
aes_i586

and update the initrd-image with

sudo update-initramfs -u all

Making the encrypted partition
Remember to take BACKUP, because all data at /dev/sda6 will be lost!!!

Now we have to make the encrypted partition, in this example the devices name is /dev/sda6. First we load the needed modules

sudo modprobe dm_crypt
sudo modprobe sha256
sudo modprobe aes_i586

and the make the LUKS-partiton (use your log-in password):

sudo cryptsetup luksFormat /dev/sda6

Now /dev/sda6 has the LUKS format, and can be attached to /dev/mapper:

sudo cryptsetup luksOpen /dev/sda6 encrypted_home

And then we can make a file system on it, here ext3

sudo mkfs.ext3 -j -O dir_index -m 0 -v /dev/mapper/encrypted_home

Finally we can mount the partition, to see if it works

sudo mount /dev/mapper/encrypted_home /mnt

Unmount and close the LUKS partition:

sudo umount /mnt
sudo cryptsetup luksClose encrypted_home

Setting up pam_mount
Insert

auth optional /lib/security/pam_mount.so use_first_pass

into /etc/pam.d/common-auth

and

session optional /lib/security/pam_mount.so

into /etc/pam.d/common-session

Now create a mount point for the LUKS partition

sudo mkdir /encrypted_home
sudo chmod 777 /encrypted_home

And add

volume foo crypt - /dev/sda6 /encrypted_home cipher=aes - -

into /etc/security/pam_mount.conf

This means that every time the user foo logs in, the LUKS partition will be mounted on /encrypted_home, using the password foo entered. Therefor the LUKS password has to be the same as the log in password.

Log out, log in and see if it works :)

This is inspirited by:
http://thomasdamgaard.dk/blog/article/krypteret-swap-og-root-filsystem-med-luks-og-ubuntu