How do I move/home folder to a luks encrypted external drive?

positivetypical

The current system would be full disk encrypted, and I want to move/map the /home folder to an external hard drive that is formatted with LUKS encryption as well. Is this possible?

Linux updates keep breaking everything for me. I think it might have something to do with the FDE. I just want to be able to have my /home data saved, encrypted and on another hard drive.

sudo lsblk

(sda1 in this case would be the external encrypted drive where /home would be)

NAME                                          MAJ:MIN RM   SIZE RO TYPE  MOUNTPOINT
sda                                             8:0    0 931.5G  0 disk  
└─sda1                                          8:1    0 931.5G  0 part  
  └─luks-39afxxxxxxxxxxxxxxxxxxxx 252:3    0 931.5G  0 crypt /media/user/My_external_drive
sdb                                             8:16   0 931.5G  0 disk  
├─sdb1                                          8:17   0   487M  0 part  /boot
├─sdb2                                          8:18   0     1K  0 part  
└─sdb5                                          8:21   0   931G  0 part  
  └─sda5_crypt                                252:0    0   931G  0 crypt 
    ├─xubuntu--vg-root                        252:1    0 919.1G  0 lvm   /
    └─xubuntu--vg-swap_1                      252:2    0  11.9G  0 lvm   [SWAP]
sr0                                            11:0    1  1024M  0 rom   

cat /etc/fstab

# /boot was on /dev/sda1 during installation
UUID=f2c4a3ef-xxxx-xxxx-xxxx-xxxx /boot           ext2    defaults        0       2
/dev/mapper/xubuntu--vg-swap_1 none            swap    sw              0       0

sudo cat /etc/crypttab

sda5_crypt UUID=4426b1a1-xxxx-xxxx-xxxx-xxxx none luks,discard

sudo blkid

/dev/mapper/sda5_crypt: UUID="NKYcrR-xxxx-xxxx-xxxx-xxx-xxxx-xxxx" TYPE="LVM2_member"
/dev/mapper/xubuntu--vg-root: UUID="fffe201d-xxxxxxxxxxx" TYPE="ext4"
/dev/sda1: UUID="39af7a74-xxxx" TYPE="crypto_LUKS" PARTUUID="04f839ad-xxxxxxxxxxxxxxxxxxxxxxx"
/dev/sdb1: UUID="f2c4a3ef-xxxx" TYPE="ext2" PARTUUID="df4931bf-01"
/dev/sdb5: UUID="4426b1a1-xxxxxx" TYPE="crypto_LUKS" PARTUUID="df4931bf-05"
/dev/mapper/xubuntu--vg-swap_1: UUID="2abaef03-xxxxxx" TYPE="swap"

***external luks encrypted drive I want to use as /home****

/dev/mapper/luks-39axxxxxxxxxxxx: LABEL="My_external_drive" UUID="d7f7xxxxxxxxxxxxxxxxxxx" TYPE="ext4"

b_laoshi

Migrating /home and other apparent issues

First of all, it would appear that your root partition at /dev/mapper/xubuntu--vg-root is not configured in /etc/fstab. That will need to be fixed. Second, your /boot partition is rather small. Be diligent about removing old kernels or you will have problems installing updates once your /boot partition gets filled to 100%. Creating a larger boot partition and putting home on a separate drive altogether can be easily accomplished with manual partitioning during install. See how to go about that in my post here if you're interested, but it only applies to new installations.

I should be able to help you with the migration and getting your root partition back into /etc/fstab. Since you've indicated that you've already made changes to one or more of these files, I'll assume that you already know how to edit files as root or with sudo. You'll need to make any file changes mentioned below in this way.

Grabbing a system image:
We're going to be making some significant system changes. If you have a "working" system right now, you should use a tool like Clonezilla to grab a system image to restore from in case anything gets really messed up! While this isn't absolutely necessary, I strongly advise it!

Fixing /etc/fstab:
Edit /etc/fstab and add a line at the top that reads as follows:
/dev/mapper/xubuntu--vg-root / ext4 errors=remount-ro 0 1
Without that line, your computer won't even boot.

Migrating /home:
There are a few parts to this. You must move all of your documents to the external drive. You must update your /etc/crypttab file so that your system can decrypt your external drive during boot. This means you're going to have to enter a password to decrypt your internal disk and then you'll have to enter another password to decrypt your external disk. There are ways to unlock two disks while providing only one password, but I won't get into that here. If you want to know more about that read here and here. You must also update /etc/fstab so that your system knows how to mount your home directory. Finally, you need to update your initramfs.

  1. Copy the contents of your home directory to the external drive. In a terminal, run the following, changing the path to the external drive as necessary. Each of these commands could take several minutes to run.
    • Create hashes to be used later for verifying integrity of copied files. It's not absolutely necessary, but it's nice to be able to confirm that nothing got corrupted while being copied.
      sudo find $HOME -type f -exec md5sum '{}' >> $HOME/checksums.md5 \;
    • Copy everything in your home directory to your external drive
      sudo cp -ar $HOME/. /media/$USER/My_external_drive
    • If you created checksums of all your files, go ahead and check them. If you were logged into your account, be aware that some files may naturally change between the point of creating checksums and checking the copied files. If there were any failures, just make sure they aren't important files.
      cd /media/$USER/My_external_drive
      sudo md5sum -c checksums.md5 | grep "FAILED"
    • You'll also need to delete everything from /home so it can be used as a mount point, but we don't want to do that from your local xubuntu install. We'll wait until we're ready to reboot and use a live CD/USB for that.
  2. Updating /etc/crypttab:
    Open /etc/crypttab for editing and add the following line, replacing the x's with the actual values of the UUID for your LUKS partition on your external drive.
    luks_home UUID=39af7a74-xxxx none luks,discard
  3. Updating /etc/fstab to include the new /home partition:
    Open /etc/fstab for editing and add the following line to the end
    /dev/mapper/luks_home /home ext4 defaults 0 2
  4. Update your initramfs
    sudo update-initramfs -k all -u

Things to check:
Your /etc/fstab file should now look something like this:

/dev/mapper/xubuntu--vg-root   /   ext4    errors=remount-ro   0   1
# /boot was on /dev/sda1 during installation
UUID=f2c4a3ef-longstringofnumbers /boot           ext2    defaults        0       2
/dev/mapper/xubuntu--vg-swap_1 none            swap    sw              0       0
/dev/mapper/luks_home  /home   ext4    defaults    0   2

Your /etc/crypttab file should now look something like this:

sda5_crypt UUID=4426b1a1-longstringofnumbers none luks,discard
luks_home  UUID=39af7a74-xxxx  none    luks,discard

If you find any problems with the /etc/crypttab file and you make changes, be sure to run the update-initramfs command again from point 4.

Reboot into live OS
Once you're sure you have everything you need copied over, it's time to erase everything from /home so it can be used as a mount point. Get your live CD/USB, and boot from it.

  • Once booted, you'll need to decrypt and mount the LUKS partition on your internal disk. Run the following commands to do so, entering your encryption password when prompted

    dev=$(sudo lsblk | grep -B1 "sda5_crypt" | grep -oP "sd[a-z]\d\b" | awk '{print "/dev/"$1}')
    sudo cryptsetup luksOpen $dev internal_crypt
    sudo mount /dev/mapper/xubuntu--vg-root /mnt
    

  • Now your old home partition should be located at /mnt/home. Let's delete everything inside
    sudo rm -fr /mnt/home/*

Reboot into local installation:
At this point, you're ready to reboot. With your old home directory emptied out, shutdown the live OS and reboot into your system. Your system should now ask for two passwords, one to decrypt the internal drive and one to decrypt the external drive. Assuming you enter both of these correctly, your system should boot up, and your home directory should reside on your external drive.

Verifying that the external drive is being used as /home:
If everything is pretty much where you left it in your home directory, you're golden. You can type mount | grep "/home" into a terminal window. It should show that your LUKS partition on your external drive is mounted at /home.

Collected from the Internet

Please contact [email protected] to delete if infringement.

edited at
0

Comments

0 comments
Login to comment

Related

From Dev

How to decrypt LUKS encrypted drive

From Dev

How do I preserve folder shares on a USB external drive?

From Dev

How do I find which external drive a folder is mounted from?

From Dev

How to recover LUKS encrypted hard drive?

From Dev

How can I decrypt a LUKS-encrypted ext4 drive by Windows based software?

From Dev

How do I wipe an encrypted USB flash drive?

From Dev

How can I keep a folder synchronized to an external USB hard drive?

From Dev

How can I keep a folder synchronized to an external USB hard drive?

From Dev

How do I get rid of old encrypted home folder?

From Dev

How do I delete an encrypted folder created with encfs?

From Dev

Do I need a keyring password on a luks encrypted single user machine?

From Dev

How to find UUID for setting up LUKS with keyfile protection for external drive

From Dev

LUKS storing keyfile in encrypted usb drive

From Dev

LUKS storing keyfile in encrypted usb drive

From Dev

LUKS encrypted flash drive: no partition table

From Dev

Installing Ubuntu on a LUKS encrypted USB thumb drive

From Dev

second hard drive, encrypted (LUKS, but mounts separately)

From Dev

LUKS Encrypted Hard Drive — Passphrase includes '£'

From Dev

How can I install Ubuntu encrypted with LUKS with dual-boot?

From Dev

How do I access an external hard drive plugged into my router?

From Dev

How do I access an external hard drive plugged into my router?

From Dev

How do I check if a user connected an external hard drive?

From Dev

how do i fix a mounting error with an external drive

From Dev

How do I find ‘foo’ on an external USB drive?

From Dev

How do I "clear" an External SMR WD Drive?

From Dev

How do I connect my external hard drive to Ubuntu?

From Dev

How to mount LUKS encrypted file?

From Dev

How secure is an encrypted LUKS filesystem?

From Dev

How to mount LUKS encrypted file?

Related Related

  1. 1

    How to decrypt LUKS encrypted drive

  2. 2

    How do I preserve folder shares on a USB external drive?

  3. 3

    How do I find which external drive a folder is mounted from?

  4. 4

    How to recover LUKS encrypted hard drive?

  5. 5

    How can I decrypt a LUKS-encrypted ext4 drive by Windows based software?

  6. 6

    How do I wipe an encrypted USB flash drive?

  7. 7

    How can I keep a folder synchronized to an external USB hard drive?

  8. 8

    How can I keep a folder synchronized to an external USB hard drive?

  9. 9

    How do I get rid of old encrypted home folder?

  10. 10

    How do I delete an encrypted folder created with encfs?

  11. 11

    Do I need a keyring password on a luks encrypted single user machine?

  12. 12

    How to find UUID for setting up LUKS with keyfile protection for external drive

  13. 13

    LUKS storing keyfile in encrypted usb drive

  14. 14

    LUKS storing keyfile in encrypted usb drive

  15. 15

    LUKS encrypted flash drive: no partition table

  16. 16

    Installing Ubuntu on a LUKS encrypted USB thumb drive

  17. 17

    second hard drive, encrypted (LUKS, but mounts separately)

  18. 18

    LUKS Encrypted Hard Drive — Passphrase includes '£'

  19. 19

    How can I install Ubuntu encrypted with LUKS with dual-boot?

  20. 20

    How do I access an external hard drive plugged into my router?

  21. 21

    How do I access an external hard drive plugged into my router?

  22. 22

    How do I check if a user connected an external hard drive?

  23. 23

    how do i fix a mounting error with an external drive

  24. 24

    How do I find ‘foo’ on an external USB drive?

  25. 25

    How do I "clear" an External SMR WD Drive?

  26. 26

    How do I connect my external hard drive to Ubuntu?

  27. 27

    How to mount LUKS encrypted file?

  28. 28

    How secure is an encrypted LUKS filesystem?

  29. 29

    How to mount LUKS encrypted file?

HotTag

Archive