{"id":696,"date":"2009-07-18T14:59:43","date_gmt":"2009-07-18T19:59:43","guid":{"rendered":"http:\/\/www.summet.com\/blog\/?p=696"},"modified":"2009-08-15T15:26:56","modified_gmt":"2009-08-15T20:26:56","slug":"encrypted-home-partition-for-ubuntu-9-04","status":"publish","type":"post","link":"https:\/\/www.summet.com\/blog\/2009\/07\/18\/encrypted-home-partition-for-ubuntu-9-04\/","title":{"rendered":"Encrypted home partition for Ubuntu 9.04"},"content":{"rendered":"

Following the directions on Lars’ blog<\/a>, I set up an encrypted home directory on Ubuntu 9.04 using LUKS.<\/p>\n

The following commands were all executed with root permissions. Add “sudo” to the front of the commands if you are not running with root permissions. <\/p>\n


\napt-get install cryptsetup libpam-mount
\ncryptsetup -c aes-cbc-essiv:sha256 -y -s 256 luksFormat \/dev\/sda7
\n<\/code>
\nThe partition I used was \/dev\/sda7, replace that with the partition you created. It will ask you for a password, I suggest using the same password as your login.
\nThen, to map the encrypted partition to \/dev\/mapper\/cryptohome, do this:
\n
\ncryptsetup luksOpen \/dev\/sda7 cryptohome
\n<\/code>
\nThen create a (ext3) filesystem. You may substitute a file-system of your choice here, but ext3 is the most widely used, and therefore, tested.<\/p>\n


\nmkfs.ext3 -j -m 1 -O dir_index,filetype,sparse_super \/dev\/mapper\/cryptohome
\n<\/code> (-m 1 and sparse_super save space, and should be safe as this is not a root filesystem. Note that the O for options is capitalised, and you may NOT have spaces after the commas that separate the options.)<\/p>\n

To test that everything is working, unmount it, try to mount it again and make sure you can write a file to the partition and unmount\/close it!<\/p>\n

\n
\ncryptsetup luksClose cryptohome
\ncryptsetup luksOpen \/dev\/sda7 cryptohome
\nmkdir -p \/mnt\/test
\nsudo mount \/dev\/mapper\/cryptohome \/mnt\/test
\ntouch \/mnt\/test\/testfile
\nls \/mnt\/test
\numount \/mnt\/test
\ncryptsetup luksClose cryptohome
\n<\/code>\n<\/p><\/blockquote>\n

To make it mount automatically when you log in:
\nMake sure you do not have a partition listed for your home directory in \/etc\/fstab.<\/p>\n

Add a line in \/etc\/crypttab:
\ncryptohome \/dev\/sda7 noauto luks<\/code><\/p>\n

And configure pam_mount in \/etc\/security\/pam_mount.conf.xml to auto-load your encrypted home directory on login:
\n<volume user=\"summetj\" fstype=\"crypt\" path=\"\/dev\/sda7\" mountpoint=\"\/home\/summetj\" \/><\/code><\/p>\n

Note that initially the users home directory will be owned by root, and you will have to chown -R on the home directory to make things stop complaining. Doublecheck that the “testfile” you created earlier is in the users home directory.<\/p>\n

If you get an error message that says: pam_mount(pam_mount.c:100): unknown pam_mount option “use_first_pass” you can get rid of it by editing the \/etc\/pam.d\/common-pammount and \/etc\/pam.d\/common-auth files and removing the “use_first_pass” option from both of them.
\n<\/username><\/p>\n","protected":false},"excerpt":{"rendered":"

Following the directions on Lars’ blog, I set up an encrypted home directory on Ubuntu 9.04 using LUKS. The following commands were all executed with root permissions. Add “sudo” to the front of the commands if you are not running … Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8,3,13,12],"tags":[],"class_list":["post-696","post","type-post","status-publish","format-standard","hentry","category-commentary","category-linux","category-projects","category-goodlinks"],"_links":{"self":[{"href":"https:\/\/www.summet.com\/blog\/wp-json\/wp\/v2\/posts\/696","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.summet.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.summet.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.summet.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.summet.com\/blog\/wp-json\/wp\/v2\/comments?post=696"}],"version-history":[{"count":0,"href":"https:\/\/www.summet.com\/blog\/wp-json\/wp\/v2\/posts\/696\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.summet.com\/blog\/wp-json\/wp\/v2\/media?parent=696"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.summet.com\/blog\/wp-json\/wp\/v2\/categories?post=696"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.summet.com\/blog\/wp-json\/wp\/v2\/tags?post=696"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}