1

I switched my OS from Windows to Ubuntu. On my Windows system I had my whole laptop encrypted so no one could access anything without the correct password. Now I have Ubuntu and TrueCrypt won't let me encrypt my whole system. I considered encrypting my whole C drive, but that wouldn't work, would it?

What are the Linux alternatives for full system encryption like the Windows version of TrueCrypt has to offer?

Improve this question
2

4 Answers 4

Reset to default
3

If you truly want full disk encryption, you will need to install from the Ubuntu Server or Ubuntu Alternate installer. In the partitioning section, you can select full disk encryption, using LVM, dmcrypt, and LUKS.

However, the Ubuntu Desktop graphical installer supports total encryption of your entire home directory by clicking a single checkbox. When you select your username and password, you'll have an option to "require a password to login and access your home directory contents." This is a very easy, seamless approach to cryptographically protecting the private data you store in your home directory.

This is only necessary for Ubuntu Versions <=12.04. Beginning with 12.10, Ubuntu shipped a new option with their graphical installer which allows easy full disk encryption.

Improve this answer
0

LUKS is probably what you're looking for. From memory, Oneiric can set this up for you during the installation process.

Improve this answer
2
  • joernfranz.net/2011/01/20/… This is the only tutorial I understand regarding the matter. I installed Ubuntu yesterday, so I guess I don't use anything that important that I couldn't install it again. Just looking at the post-installation ecnryption instructions give me a headache.
    – Iiro Krankka
    Feb 5, 2012 at 12:27
  • @liro see Dustin's answer. Post-Install is not painless, best to do it on install from the Ubuntu alternate installer. I've run FDE for years on Ubuntu with great success.
    – krondor
    Jun 13, 2013 at 20:14
0

First - You should have separate unencrypted boot partition because linux, or more precisely grub or other bootloader cannot boot from encrypted partition.
Second - it's not practical or absolutely necessary to encrypt whole drive. You should set up separate partition for /home directory and encrypt only that partition.

To encrypt your /home directory you could use ecryptfs-migrate-home command from eCryptfs project.

Guide on how to do use it

If you really need for full system encryption on linux - have you tried searching? Also it is much harder to set up full sytem encryption after installation.

Improve this answer
2
  • Got any citations for why you think FDE isn't practcal? IMO ecryptfs isn't great because it does nothing for swap or tmo folders. Meaning you could be leaving unecryped docs available when you don't expect it.
    – Zoredache
    Feb 4, 2012 at 12:14
  • From my own eperience - every time I've tried FSE it slowed down file access speeds and system in general.
    – AndyDeGroo
    Feb 4, 2012 at 16:45
0

Just to keep a better list of options here - it's possible to implement FDE on Linux with Truecrypt (yes, both full paritition encryption, hidden volumes or file-based containers are possible; access from other OS is also possible); you just have to glue together a minimal initrd consisting of init script, statically linked truecrypt and a number of required libs/binaries

I don't want to put my init script / initrd filelist here, but to give a few ideas:

  • don't forget to do umount -l /dev/; umount -l /proc/; umount -l /sys/ before changing to real root
  • you can use either switch_root or implement a full init subsystem which will switch you to your distro's real enviroment

Also, don't forget to add some protection against Evil Maid-class attacks..

Improve this answer
1
  • I was going to mention Truecrypt in an answer, glad you did so. I'm not sure there's any benefit to using that versus just using LUKS, but maybe if you move between OSes...
    – krondor
    Jun 13, 2013 at 20:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .