I just setup a new OS and decided I would put /home/cobertos on a separate partition and that I should full disk encrypt it. In my last Linux Mint install, I toggled the "Encrypt my home folder" option which apparently used eCryptfs to encrypt just the home folder. I was unaware of what the option really did until writing this post.

For this install, LUKS felt like a better fit as I wanted a separate user home partition anyway and eCryptfs has some downsides (see Filesystem-level Encryption heading) I could avoid.

Formatting

Before using my drive, I partitioned 1.7TB mapped at /dev/nvme0n1p4 with the intention that it would be mounted at /home/cobertos. Adding LUKS encryption was simple with cryptsetup

# -y is ask for password twice to verify
# Will interactively prompt for password and confirmation before formatting
cryptsetup -yv luksFormat /dev/nvme0n1p4

After formatting, I "opened" it, which creates a Device Mapper mapping to the unencrypted device at /dev/mapper/[name]

cryptsetup open /dev/nvme0n1p4 mydata

Then, on top of this mapped drive, I could format it however I wanted.

mkfs.ext4 /dev/mapper/mydata
mount /dev/mapper/root /mnt

And this was all I ended up needing to do for encrypting my home directory. Arch Wiki's dm-crypt/Encrypting an entire system details more if you want to encrypt the entire system root, which I don't need yet.

Backing up the LUKS header (best practice)

If the LUKS header gets damaged, which the cryptsetup man page calls "something people manage to do with surprising frequency", you lose all your data. So I also made a backup header file and stored it somewhere safe.

cryptsetup luksHeaderBackup /dev/nvme0n1p4 --header-backup-file luksHeaderBackup.bin

Restoring it is simple as luksHeaderRestore if you ever manage to mess up the header.

After all that, I copied all my data from my old eCryptfs-protected home directory after a bit of a struggle2. Now everything was safe in my new encrypted home directory. Yay! :3

Decrypting on Login

To be useful, the LUKS-encrypted partition needs to be decrypted at login and mounted to /home/cobertos. On Linux Mint, login authentication is handled by Pluggable Authentication Modules (PAM) which has a module called pam_mount that can handle decryption and mounting at login. The encryption password for /dev/nvme0n1p4 has to be the same as the login password for it to work.

I installed pam_mount, which is in libpam-mount for Linux Mint.

apt install libpam-mount

And configured my volume in /etc/security/pam_mount.conf.xml.

<!--There's some other boilerplate configuration in here that I omitted-->
<volume user="cobertos" fstype="auto" path="/dev/nvme0n1p4" mountpoint="/home/cobertos" options="fsck,noatime" />

And then I needed to make sure pam_mount.so was getting called when authenticating. In Linux Mint, it looks like this was already in the config3 /etc/pam.d/common-session with the line

# ...
session	optional	pam_mount.so
# ...

common-session gets included in most of the other /etc/pam.d/[service] files so this will apply for all of those PAM-aware services that check PAM before doing certain actions.

Deconstructing this specific line, it has a session type which is described in pam.conf to be (emphasis mine)

this module type is associated with doing things that need to be done for the user before/after they can be given service. Such things include the logging of information concerning the opening/closing of some data exchange with a user, mounting directories, etc.

The optional means the PAM stack will basically ignore the success/failure return of pam_mount.so . It's a little more intricate than this, but you're much better off reading the pam.conf man page if you want to understand it deeply. There's a lot of annoying subtleties.

Conclusion

And that's it! Hopefully I don't have to put this encryption to the test anytime soon. But knowing me and given years of time, it's likely I would probably forget my laptop and having my home encrypted would make me just a bit less anxious.

mount: mount(2) failed: No such file or directory
ERROR: Failed to mount private data at [/tmp/ecryptfs.xxx].