1. Scenario
In this Linux config we are going to create encrypted partition for user "linuxconfig" and use pam_mount to mount it under /home/linuxconfig directory. For this config we have used Debian Linux, however the very same principle for creating encrypted partitions can be applied also for any other Linux distributions such as SuSe, RedHat, Gentoo, Ubuntu.
2. Prerequisites
First and the most important one is to make sure that on partition on which you are going to encrypt, is empty. If you have some important data there move them NOW to some save place. When creating encrypted partition all data will be removed. Secondly we need to satisfied software prerequisite so you need to install packages for:
- cryptsetup ( Ubuntu, Debian package: cryptsetup )
- pam_mount ( Ubuntu, Debian package: libpam-mount )
3. Create Encrypted Partition
This command will create Encrypted partition /dev/sdb1 by formating it with LUKS Encryption:
# cryptsetup luksFormat /dev/sdb1
Open Encrypted partition:
This command will create an entry in /dev/mapper for sdb1 partition.
# cryptsetup luksOpen /dev/sdb1 sdb1
4. Create Filesystem
Now we can create filesystem as on any other partition. The only difference is that we create filesystem via mapper. If you try to create filesystem on /dev/sdb1 you will get this error message:
mke2fs 1.40-WIP (14-Nov-2006)
/dev/sdb1 is apparently in use by the system; will not make a filesystem here!
Instead we will use command:
# mkfs.ext3 /dev/mapper/sdb1
5. Edit pam_mount.conf
Because we want new encrypted partition to be mounted every time user "linuxconfig" log in we need to alter /etc/security/pam_mount.conf file and add this line:
volume linuxconfig crypt - /dev/sdb1 /home/linuxconfig - - -
On Debian or Ubuntu system, you will need to edit two files:
/etc/pam.d/common-auth :
auth optional pam_mount.so
/etc/pam.d/common-session
session optional pam_mount.so
Please NOTE: Some distributions have only one file with both auth and session.
7. Testing encrypted partition
Let's try login as a "linuxconfig" user, please note that you will be prompted to enter password two times, first time it will be your UNIX password and second time it will be your passphrase for your encrypted partition:
Now we need to confirm that we are using our new encrypted partition:
|
Did You Know? man is the Linux’s manual pager. Each page argument given to man is normally the name of a program, utility or function. The manual page associated with each of these arguments is then found and displayed. A section, if provided, will direct man to look only in that section of the manual. The default action is to search in all of the available sections, following a pre-defined order and to show only the first page found, even if page exists in several sections.
ISSN 1836-5930
Thanks for the useful guide. I managed to encrypt a data-only partition (sda1) on my eeePC. It's NOT my /home/usr directory, and I'm not sure how to have it automount based on the example above.
Presently, the unmounted drive shows up as "4.0 GB Filesystem." If I click on it from Nautilus, I'm first prompted for the encryption key, and they for my user PW. Then drive then is decrypted and mounted with the less-than-desirable label of: 3485b5cd-00ff-4f24-84db-176742963f38 (!).
How should I modify the lines in /etc/security/pam_mount.conf and/etc/fstab for automount, please? OR, how can I force this drive to mount manually with a short, descriptive label? That would be preferable to the monstrosity cited above!
Many thanks.