ElRaph(W)ik(i)

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
====== Home Setup ======

As said in prior pages, the goal here is to make the SSD the home directory, with encryption enabled, as it is not recommended to do it on the eMMC.

===== SSD Cleaning and Encryption =====

So be careful your device does not contain any data you'd like to recover. Mine is brand new so it's not a consideration I have, however I'll still run a couple commands to wipe it.

<code bash>
export DEVICE=/dev/nvme0n1
export PART=/dev/nvme0n1p1
# Wipe disk
sudo wipefs -a $DEVICE

# Make the partition, once in fdisk use g for new GPT table, n for new partition, w to write
# When making the partition, choose the defaults for a full-disk partition
sudo fdisk $DEVICE
g
n
w

# Install cryptsetup and use it to encrypt the device with a passkey
sudo apt update && sudo apt install cryptsetup -y
sudo cryptsetup luksFormat $PART

# Now open the device with passkey, it should be located at /dev/mapper/crypt_home now
sudo cryptsetup open $PART crypt_home
export VOLUME=/dev/mapper/crypt_home

# Add a filesystem to the volume, and add a label
sudo mkfs.ext4 $VOLUME
sudo e2label $VOLUME home
</code>

You now have an encrypted disk with a single partition, that has a filesystem, great job!
Now, you may have to migrate the old home files into the new one before we continue, here's how to do so:

<code bash>
# Make temporary mount for migration + configuration
sudo mkdir /mnt/newhome
sudo mount /dev/mapper/crypt_home /mnt/newhome

# Migrate data from old home to new home, trailing slashes are important
sudo rsync -aAXv /home/ /mnt/newhome/
</code>

Great! Let's not configure the auto-mount and auto-decryption of the device on boot.

<code bash>
# Retrieve UUID of the partition
sudo blkid $PART
# Should return /dev/nvme0n1: UUID="xxxxxxxx-xxxx-xxxx" TYPE="crypto_LUKS"

sudo nano /etc/crypttab
# Add crypt_home UUID=YOUR-UUID none luks,initramfs

# Now configure your fstab
sudo blkid $VOLUME
sudo nano /etc/fstab
# Add /dev/mapper/crypt_home /home  ext4  defaults,noatime  0  2
</code>

<WRAP center round info 100%>
If you pay attention here, you'll notice the "initramfs" option in the crypttab.\\
I noticed that when booting, the prompt for the decryption passphrase does not appear if the disk decryption does not happen during the initramfs boot phase. If not present, it'll try to decypher during the systemd phase, in which you cannot interact with the prompt, so it will timeout and fail pretty hard.
</WRAP>


Okay now it's almost all set, just need to move some folders around :

<code bash>
# Archive old home
sudo mv /home /home_old
sudo mkdir /home
</code>

You **should** now be able to reboot, and the boot process should ask for a passphrase.\\
However, if you're like me, you'll need a couple extra steps:

<code bash>
# Install initramfs crypt support
sudo apt install cryptsetup-initramfs

# Regen initramfs
sudo update-initramfs -c -k all

# Now reboot
sudo reboot
</code>