Partner links

Home directory and full disk encryption in Ubuntu 11.04

Encrypt1

Disk encryption is one of several security features built into the Linux kernel that you may use to enhance the physical security rating and posture of a Linux installation. Disk encryption used to be widely recommended for notebook computers, and the reason is such mobile computers are more likely to be stolen than a desktop or server in a home or business. But that has changed. The general recommendation is this: Encrypt every disk. Whether it is in your notebook, desktop, or server. To paraphrase the late Johnny Cochran, If you have a disk, you must encrypt.

The primary purpose of disk encryption is to deny unauthorized (physical) access to your data. And the most effective method of enforcing that is to deny unauthorized persons from being able to boot your computer completely. In essence, deny such persons access to your login screen. When your computer boots, you want the person sitting in front of the keyboard to see something similar to this:
Passphrase before booting

No passphrase, no access. Keep in mind that the most effective encryption scheme entails encrypting everything but the boot partition. Which means that Swap must also be encrypted. If Swap is not encrypted, sensitive data written out to disk can be recovered by anybody with access to the disk. Such data might even be the encryption key or passphrase.

The problem on the Linux front is few distributions support disk encryption during installation. If you use Ubuntu, you are in luck because it supports it. You must know, however, that the Live CD version and the Alternate Installation version support different types of encryption. The former supports encryption of the home directory. As shown in the image below, you can enable encryption of your home directory during the user account setup step. That, however, does not very little to boost the physical security posture of the computer. And the reason is simple: Once you log in, your home directory is decrypted.

And that is the main reason why automatic login (“Log in automatically”) should not be enabled. It is a very convenient feature, but it comes with a hefty price tag. The gist here is if you want full disk encryption, do not install Ubuntu from a Live CD ISO image.
Encrypt

You should instead use an Alternate Installer ISO image. Aside from full disk encryption, it also supports LVM, the Linux Logical Volume Manager, and if you chose the option shown in the image below, the installer will set up two partitions. The first partition, used for /boot, will not be encrypted. The system needs an unencrypted boot partition to complete some preliminary boot steps. The second partition, which will be initialized for use by LVM, will be encrypted, and under it, the system sets up two logical volumes – one for the root directory, and the other for Swap. That is how full disk encryption should be configured. That, by the way, is how it is configured on Debian, Fedora, and Sabayon.
Encrypt1

If you do not want to use LVM, you can set up a non-LVM disk partitioning scheme and enable encryption for the partitions manually. However, because of the benefits of LVM, it is highly recommended that you use it. There is no downside. Or none that you will notice. An article, to be published by end of day tomorrow, will provide a step-by-step guide on how to install Ubuntu 11.04 on an encrypted LVM partitioning scheme. To have it delivered automatically to your Feed Reader or Inbox, subscribe via RSS or email.

Share:

Facebook
Twitter
Pinterest
LinkedIn

Partner links

Newsletter: Subscribe for updates

Subscribe
Notify of
guest
14 Comments
Inline Feedbacks
View all comments
chinachubby
chinachubby
11 years ago

Ubuntu now has the option to encrypt the whole disk or the home folder from the installation process on the live CD as of 12.10. If you have already setup and want some tools to encrypt partitions or other folders you can do so from gnome-disk-utility which is a handy GUI frontend for formatting disks, this allows you to encrypt partitions in ext4 during format. If you prefer folders then install encfs and cryptkeeper, or gnome-encfs-manager, which will allow you to encrypt hidden folders and mount them when decrypted. Encfs and cryptkeeper work very well with dropbox and Ubuntu one.

Rodolpho
11 years ago

I have installed 12.04 on my laptop and marked the option to encrypt my home folder. After reading you post, the immediate question in my mind is: when I’m logged in using my computer, if somebody gains access to it via network and decide to download my files, are they going to be encrypted or decrypted?

Suraj
Suraj
12 years ago

I have already setup my laptop with ubuntu 11.10.

Can I now encrypt the whole hard disk , so the next time I reboot , it should ask me for a password ,akin to the screen shot you have above. ?

Ryan
Ryan
12 years ago

This article is extremely inaccurate and misinformed.

ari
ari
12 years ago

Hi, if i already have a windows partition on my hard drive.
How should i set up ubuntu on another partition with encryption so i can dualboot.

p4u1
p4u1
12 years ago

10000000 de gracias por los artículos sobre ubuntu =)

Get the latest

On social media

Security distros

Hacker
Linux distros for hacking and pentesting

Crypto mining OS

Bitcoin
Distros for mining bitcoin and other cryptocurrencies

Crypto hardware

MSI GeForce GTX 1070
Installing Nvidia GTX 1070 GPU drivers on Ubuntu

Disk guide

LVM
Beginner's guide to disks & disk partitions in Linux

Bash guide

Bash shell terminal
How to set the PATH variable in Bash
Categories
Archives
14
0
Hya, what do you think? Please comment.x
()
x