Home / ubuntu / Questions / 1020390
Accepted
Falc
Asked: 2018-03-30 13:33:30 +0800 CST

How do I auto-mount LUKS partition?

  • 772

How do I automount a LUKS encrypted partition in a secure way? Ideally either when I log on (and therefore my password in at the log in screen), or once I get to desktop have Ubuntu ask for my password and then auto mount the partition?

The contents of my fdisk is below

The encrypted partition is /dev/sdb7, my root and home partition is /dev/sdb5 (which isn't encrypted).

Disk /dev/loop0: 14 MiB, 14647296 bytes, 28608 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes


Disk /dev/loop1: 81.7 MiB, 85692416 bytes, 167368 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes


Disk /dev/sda: 931.5 GiB, 1000204886016 bytes, 1953525168 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 4096 bytes
I/O size (minimum/optimal): 4096 bytes / 4096 bytes
Disklabel type: dos
Disk identifier: 0x0006d9d9

Device     Boot     Start        End    Sectors   Size Id Type
/dev/sda1            2048  524646399  524644352 250.2G  7 HPFS/NTFS/exFAT
/dev/sda2  *    524646400 1953523711 1428877312 681.4G 83 Linux


Disk /dev/sdb: 465.8 GiB, 500107862016 bytes, 976773168 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0x1ffae910

Device     Boot     Start       End   Sectors   Size Id Type
/dev/sdb1       214892542 976773119 761880578 363.3G  5 Extended
/dev/sdb2  *         2048   2150399   2148352     1G 83 Linux
/dev/sdb5       214892544 257558559  42666016  20.4G 83 Linux
/dev/sdb6       300716032 318294015  17577984   8.4G 82 Linux swap / Solaris
/dev/sdb7       318296064 976773119 658477056   314G 83 Linux

Partition table entries are not in disk order.
encryption partitioning mount luks

2 Answers

  1. Best Answer

    Using pam-mount

    You can use pam-mount to do this. It will hook into the login process and thus be able to use the entered password for mounting a luks partition. Here's how to set it up:

    Create a test luks image

    Skip this section if you have a LUKS-encrypted partition or image already

    Create a file called .priv in your home directory with size 1GB:

    truncate -s 1G ~/.priv

    Format the image using LUKS and set a password (use the same as your login password):

    cryptsetup luksFormat ~/.priv

    Enable the image:

    sudo cryptsetup luksOpen ~/.priv priv

    Create a file system on the new device:

    sudo mkfs.ext4 /dev/mapper/priv

    Disable the image again:

    sudo cryptsetup luksClose priv

    Install and set up pam-mount

    Install the package:

    sudo apt install libpam-mount

    Edit the configuration file /etc/security/pam_mount.conf.xml and add the following line to it:

    <volume path="~/.priv" mountpoint="~/priv" />

    Add this right after where it says <!-- Volume definitions -->. Notice the subtle but important difference in the path and mountpoint arguments. In your particular case you would use path="/dev/sdb7".

    Now login to your machine and you should notice that it takes a little longer than usual. After successful login you can check, using the mount command, that there is now a new file system mounted in your home. It should look similar to this:

    /dev/mapper/_dev_loop3 on /home/seb/priv type ext4 (rw,relatime,data=ordered,helper=crypt)

    Use for /home/USER

    I am using this setup for mounting my home directory (/home/seb) from a LUKS encrypted image on Ubuntu 18.04. pam_mount will also take care of unmounting the image after I log out. As such it is a nice way to get at least some encryption if during installation you did not choose full disk encryption.

    • 5

  2. To answer @Falc about why setting the mount point as <volume path="/dev/sdb7" mountpoint="/home" /> didn't work and instead prevented him from logging in. By setting the mount point as home you actually replaced your home directory with your encrypted partition. The reason why you could not log in is that the /home directory is needed by Linux to work. Whats more, the home directory contains many important hidden files such as .config, .bashrc, .profile and .bash_profile. These files and others in your home folder include gnome-session-properties which initiate programs to start when you log in. When you mount your encrypted drive on your home directory applications needed for the graphical session cannot start.

    • 1