The current system would be full disk encrypted, and I want to move/map the /home
folder to an external hard drive that is formatted with LUKS encryption as well. Is this possible?
Linux updates keep breaking everything for me. I think it might have something to do with the FDE. I just want to be able to have my /home
data saved, encrypted and on another hard drive.
sudo lsblk
(sda1 in this case would be the external encrypted drive where /home would be)
NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT sda 8:0 0 931.5G 0 disk └─sda1 8:1 0 931.5G 0 part └─luks-39afxxxxxxxxxxxxxxxxxxxx 252:3 0 931.5G 0 crypt /media/user/My_external_drive sdb 8:16 0 931.5G 0 disk ├─sdb1 8:17 0 487M 0 part /boot ├─sdb2 8:18 0 1K 0 part └─sdb5 8:21 0 931G 0 part └─sda5_crypt 252:0 0 931G 0 crypt ├─xubuntu--vg-root 252:1 0 919.1G 0 lvm / └─xubuntu--vg-swap_1 252:2 0 11.9G 0 lvm [SWAP] sr0 11:0 1 1024M 0 rom
cat /etc/fstab
# /boot was on /dev/sda1 during installation UUID=f2c4a3ef-xxxx-xxxx-xxxx-xxxx /boot ext2 defaults 0 2 /dev/mapper/xubuntu--vg-swap_1 none swap sw 0 0
sudo cat /etc/crypttab
sda5_crypt UUID=4426b1a1-xxxx-xxxx-xxxx-xxxx none luks,discard
sudo blkid
/dev/mapper/sda5_crypt: UUID="NKYcrR-xxxx-xxxx-xxxx-xxx-xxxx-xxxx" TYPE="LVM2_member" /dev/mapper/xubuntu--vg-root: UUID="fffe201d-xxxxxxxxxxx" TYPE="ext4" /dev/sda1: UUID="39af7a74-xxxx" TYPE="crypto_LUKS" PARTUUID="04f839ad-xxxxxxxxxxxxxxxxxxxxxxx" /dev/sdb1: UUID="f2c4a3ef-xxxx" TYPE="ext2" PARTUUID="df4931bf-01" /dev/sdb5: UUID="4426b1a1-xxxxxx" TYPE="crypto_LUKS" PARTUUID="df4931bf-05" /dev/mapper/xubuntu--vg-swap_1: UUID="2abaef03-xxxxxx" TYPE="swap" ***external luks encrypted drive I want to use as /home**** /dev/mapper/luks-39axxxxxxxxxxxx: LABEL="My_external_drive" UUID="d7f7xxxxxxxxxxxxxxxxxxx" TYPE="ext4"
First of all, it would appear that your root partition at /dev/mapper/xubuntu--vg-root
is not configured in /etc/fstab
. That will need to be fixed. Second, your /boot
partition is rather small. Be diligent about removing old kernels or you will have problems installing updates once your /boot
partition gets filled to 100%. Creating a larger boot partition and putting home on a separate drive altogether can be easily accomplished with manual partitioning during install. See how to go about that in my post here if you're interested, but it only applies to new installations.
I should be able to help you with the migration and getting your root partition back into /etc/fstab
. Since you've indicated that you've already made changes to one or more of these files, I'll assume that you already know how to edit files as root or with sudo. You'll need to make any file changes mentioned below in this way.
Grabbing a system image:
We're going to be making some significant system changes. If you have a "working" system right now, you should use a tool like Clonezilla to grab a system image to restore from in case anything gets really messed up! While this isn't absolutely necessary, I strongly advise it!
Fixing /etc/fstab
:
Edit /etc/fstab
and add a line at the top that reads as follows:
/dev/mapper/xubuntu--vg-root / ext4 errors=remount-ro 0 1
Without that line, your computer won't even boot.
Migrating /home
:
There are a few parts to this. You must move all of your documents to the external drive. You must update your /etc/crypttab
file so that your system can decrypt your external drive during boot. This means you're going to have to enter a password to decrypt your internal disk and then you'll have to enter another password to decrypt your external disk. There are ways to unlock two disks while providing only one password, but I won't get into that here. If you want to know more about that read here and here. You must also update /etc/fstab
so that your system knows how to mount your home directory. Finally, you need to update your initramfs.
sudo find $HOME -type f -exec md5sum '{}' >> $HOME/checksums.md5 \;
sudo cp -ar $HOME/. /media/$USER/My_external_drive
cd /media/$USER/My_external_drive
sudo md5sum -c checksums.md5 | grep "FAILED"
/home
so it can be used as a mount point, but we don't want to do that from your local xubuntu install. We'll wait until we're ready to reboot and use a live CD/USB for that./etc/crypttab
:/etc/crypttab
for editing and add the following line, replacing the x's with the actual values of the UUID for your LUKS partition on your external drive.luks_home UUID=39af7a74-xxxx none luks,discard
/etc/fstab
to include the new /home
partition:/etc/fstab
for editing and add the following line to the end/dev/mapper/luks_home /home ext4 defaults 0 2
sudo update-initramfs -k all -u
Things to check:
Your /etc/fstab
file should now look something like this:
/dev/mapper/xubuntu--vg-root / ext4 errors=remount-ro 0 1 # /boot was on /dev/sda1 during installation UUID=f2c4a3ef-longstringofnumbers /boot ext2 defaults 0 2 /dev/mapper/xubuntu--vg-swap_1 none swap sw 0 0 /dev/mapper/luks_home /home ext4 defaults 0 2
Your /etc/crypttab
file should now look something like this:
sda5_crypt UUID=4426b1a1-longstringofnumbers none luks,discard luks_home UUID=39af7a74-xxxx none luks,discard
If you find any problems with the /etc/crypttab
file and you make changes, be sure to run the update-initramfs
command again from point 4.
Reboot into live OS
Once you're sure you have everything you need copied over, it's time to erase everything from /home
so it can be used as a mount point. Get your live CD/USB, and boot from it.
Once booted, you'll need to decrypt and mount the LUKS partition on your internal disk. Run the following commands to do so, entering your encryption password when prompted
dev=$(sudo lsblk | grep -B1 "sda5_crypt" | grep -oP "sd[a-z]\d\b" | awk '{print "/dev/"$1}') sudo cryptsetup luksOpen $dev internal_crypt sudo mount /dev/mapper/xubuntu--vg-root /mnt
sudo rm -fr /mnt/home/*
Reboot into local installation:
At this point, you're ready to reboot. With your old home directory emptied out, shutdown the live OS and reboot into your system. Your system should now ask for two passwords, one to decrypt the internal drive and one to decrypt the external drive. Assuming you enter both of these correctly, your system should boot up, and your home directory should reside on your external drive.
Verifying that the external drive is being used as /home
:
If everything is pretty much where you left it in your home directory, you're golden. You can type mount | grep "/home"
into a terminal window. It should show that your LUKS partition on your external drive is mounted at /home
.
Collected from the Internet
Please contact [email protected] to delete if infringement.
Comments