cryptsetup-luks on fedora

Take a Fedora Core 5 system and encrypt (using dm-crypt and LUKS) the partition that gets mounted on /home.

Note that /home needs to be on its own partition, not on the / partition. Also, in words similar to those from night-shade, I have tested this with LVM2 devices containing nothing important. It worked for me but you are advised to have current working backups if the data matters to you. Because we are dealing with the /home partition, these instructions will also explain how to ensure that the /home partition is mounted during a boot.

Step 0: Log on as root

Because you will need to unmount /home, you must log on as root rather than su to root from an unpriveledged user account.

-=Step 1: Backup /home Presumably you would like to return to the same Home environment that you started with before you encrypted your /home partition. Therefore, you need to backup the contents of /home. (Be aware that these instructions will not necessary restore your Home environment EXACTLY as it was before you encrypted /home. Please read all of these instructions before proceeding, so that you are sure that this solution will work for you.) In this HOWTO, we will assume there is only one unpriveledged user (jmaher) on the system, so only /home/jmaher needs to be backed up. One way to back up this folder is to use the following commands:

# mkdir /root/jmaher
# /bin/cp -a /home/jmaher/.* /root/jmaher

The -a option is for archiving files and directories. It uses recursion and preserves the permissions of the files and directories.

Comments

the last steps of the instructions are now unnecessary

Chris Tatman sent a message using the contact form at http://web.bostonlinux.net/contact.
 
Hey There,
 
First of all, thank you for the very clear and concise instructions on your site for setting up LUKS on Fedora.
 
They were very helpful, and got me most of the way there. However, the last steps of the instructions are now unnecessary, and should probably be removed.
 
If an /etc/crypttab file is created with something similar to the following entry: home /dev/VolGroup00/home none The rc.sysinit file (in Fedora 10) will call on crypto and prompt the user for a password at boot time. This makes the luksopen script unnecessary. from rc.sysinit: if [ -f /etc/crypttab ]; then init_crypto 0
 
Here is the url with the final steps I am referring to: http://web.bostonlinux.net/file-management/cryptsetup-luks/11-12-13
 
Once again, thank you for the great instructions!