Difference between revisions of "setting up an encrypted home directory (on gentoo)"
Line 15: | Line 15: | ||
mybox ~ # '''fdisk /dev/sdb''' | mybox ~ # '''fdisk /dev/sdb''' | ||
− | + | mine looked like this... | |
− | Command (m for help): p | + | Command (m for help): p<br> |
− | + | Device Boot Start End Blocks Id System | |
− | + | /dev/sdb1 2048 41943039 20970496 83 Linux | |
− | + | ||
encrypt the partition, set the passphrase (used to unlock it) | encrypt the partition, set the passphrase (used to unlock it) |
Revision as of 17:40, 12 April 2013
This procedure was performed using a newly added virtual hard drive (/dev/sdb) in a VM. Substitute your device and number where appropriate.
Identify my newly added drive (sbb)
mybox ~ # ls /dev/sd* /dev/sda /dev/sda1 /dev/sda2 /dev/sdb
Install a kernel with needed dev mapper / crypto support (steps not covered here). If you are using a distro other than gentoo then your kernel will most likely already have the needed support.
Install the cryptsetup package
mybox ~ # emerge -av --quiet cryptsetup
create a linux partition to encrypt
mybox ~ # fdisk /dev/sdb
mine looked like this...
Command (m for help): p
Device Boot Start End Blocks Id System /dev/sdb1 2048 41943039 20970496 83 Linux
encrypt the partition, set the passphrase (used to unlock it)
mybox ~ # cryptsetup -c aes-xts-plain -s 512 -v -y luksFormat /dev/sdb1
WARNING! ======== This will overwrite data on /dev/sdb1 irrevocably.
Are you sure? (Type uppercase yes): YES Enter LUKS passphrase: Verify passphrase: Command successful.
move your home directory. I did this on a running system without X11. If you are root, stop X, and drop to into one of the psuedo terminals, this should work for you just fine.
mybox home # mv /home/ /home_backup/
open the encrypted partition and create dev mapper entry
mybox home # cryptsetup luksOpen /dev/sdb1 home Enter passphrase for /dev/sdb1:
make your filesystem
mybox home # mkfs.ext4 /dev/mapper/home
now you can mount it :)
mybox home # mount /dev/mapper/home /home
copy your saved home dir data to the new encrypted home partition
mybox home # rsync -pav /home_backup/ /home/
configure you box to open the new home drive on boot. You will be prompted for the password set above on every boot.
mybox home # vi /etc/conf.d/dmcrypt
added lines...
target=home source='/dev/sdb1'
configure dmcrypt service to load on boot
mybox home # rc-update add dmcrypt boot * service dmcrypt added to runlevel boot
configure fstab to mount home on boot
mybox home # vi /etc/fstab
added or alter home line...
/dev/mapper/home /home ext4 noatime 0 0
All done! enjoy your new, secure computing environment.
mybox home # reboot