Full disk encryption (devuan)
This is a quick summary of how to set up encryption during the installation of a Debian based system. It is actually not full disk, but full partition. It assumes you want a separate /, /home and swap, all encrypted. It uses LUKS and dm-crypt. For a detailed explanation, see https://xo.tc/full-disk-encryption-on-linux.html.
This is a summary of the excellent article at [https://xo.tc/setting-up-full-disk-encryption-on-debian-jessie.html]. I'm writing this more because he is very, very detailed with lots of pretty pictures, and I wanted a quick and dirty. Thus, if you want to “know” what you're doing, read his article. If you are pretty sure what you're doing and just want a recipe, use this.
- Figure out a good passphrase; something you'll remember (you'll type it everytime you boot), but is hard to crack (it secures all your data). I use https://xkpasswd.net/s/ to generate memorable but secure passphrases.
- For very, very secure, use the default generator.
- For less secure, but easier to remember, use the XKCD preset (when I do this, I set the SEPARATOR char to random).
- On partitioning scheme, create the following. NOTE
- Partition 1, Primary, 256M, ext4, /boot
- Partition 5, Logical, 10G, Physical volume for encryption
- Partition 6, Logical, disk size minus 4G, Physical volume for encryption
- Partition 7, Logical, 4G, do not use the partition
- Configure encrypted volumes
- Create Encrypted Volumes
- Select sda5 and 6 (/ and /home), then Continue, then Finish
- Enter the passphrase for both / and /home. Note that /home's password will be overridden later, so not critical
- Set sda5_crypt (the 10G one) as ext4, mount point /
- Set sda6_crypt (the big one) as ext5, mount point /home
- Done with partitioning, and select “no” when it complains about the lack of swap (we'll create it later)
- Finish installation as you like and reboot system
- Log in as root (or become root)
- Set up swap partition. This uses a random key generated at boot time, so each boot generates a new key. Following are the two commands to do that, adding a new line to /etc/crypttab and /etc/fstab
- echo 'sda7_crypt /dev/sda7 /dev/urandom swap' » /etc/crypttab
- echo '/dev/mapper/sda7_crypt none swap sw 0 0' » /etc/fstab
- Set it up so /home's partition actually uses a key (stored on /) with no passphrase. Again, the following are the commands from a prompt
mkdir /etc/keys dd if=/dev/random of=/etc/keys/sda6.key bs=1 count=32 # create 32 byte key chmod 400 /etc/keys/sda6.key # add key file to /dev/sda6. When asked, use the key you created during install cryptsetup luksAddKey /dev/sda6 /etc/keys/sda6.key # add key to /home # now, remove the key you used at install for sda6 (you'll be asked which to to remove) cryptsetup luksRemoveKey /dev/sda6
- edit /etc/crypttab, find sda6_crypt, change 'none' to /etc/keys/sda6.key
At this point, you should be able to reboot. You will be asked one time for the encryption key (the one for sda5, to be mounted on /). sda6 (mounted /home) should be decrypted automatically as soon as / is mounted and key can be found, and swap should also be mounted with a generated key.
Don't forget to Donate. The xkpasswd site is free, but they have to pay for hosting. Devuan is also free, but they have a lot of overhead. Donating to them ensures they are able to continue development of a systemd free Linux.