Encrypt non-root devices (LUKS)
If you have more than one hard disk that you need to encrypt (e.g. SSD as main disk, HDD as data disk) there are a few things to keep in mind to ensure continued smooth operation without any loss of convenience.
The layout is as follows:
| Type | File System | Description |
|---|---|---|
| Home File System | LUKS2 | Stores user home directories and personal files |
Preparing the disk
Determine the disks that are installed on your system. This can easily be done with fdisk:
fdisk -l
Start partitioning the disk with cfdisk:
WARNING: Make sure you are modifying the correct device, else you will lose data!
cfdisk /dev/sda
If the disk has no partition table yet, cfdisk will ask you to specify one. The default partition table format for UEFI systems is gpt. Create a layout to your liking, e.g.:
| Size | FS Type |
|---|---|
| (disk size) | Linux home |
Formatting partitions
Before writing a file system to the disk a LUKS container needs to be created with the cryptsetup utility:
WARNING: Do NOT forget your passphrase! In case of loss you won't be able to access the data inside the container anymore!
NOTE: Using /dev/sda as an example of a SATA HDD that is intended to be mounted at /home.
cryptsetup luksFormat --label crypthome /dev/sda1
Open the newly created LUKS container and supply the passphrase you just set:
NOTE: If you want to enable TRIM support you can use cryptsetup open --allow-discards <device> <mappername>; this comes at a slight security/confidentiality penalty, as it allows insights into file system structures by monitoring which parts were deleted. Additionally passing --persistent will add it to the flags section of the LUKS metadata and apply the flag automatically on every cryptsetup operation.
cryptsetup open /dev/disk/by-label/crypthome home
Create a file system for the home file system:
mkfs.ext4 -L home /dev/mapper/home
Mount the file systems:
mount --mkdir /dev/mapper/home -o noatime /mnt/home