[Solved] Newbie: Full disk encryption - as with TrueCrypt under Windows 7/10

[th23]

Hi together,

I recently started to switch from Windows 7/10 to Linux Mint 18.3, 64bit, Cinnamon - currently trying on a spare PC how to setup and which programs to use. The following question might have come up before, but it seems the answers differ depending on the disk setup, so bear with me for a similar question...

I want to encrypt the system (having read many pros/cons for Linux) as I did before. The HDD / partition setup looks like the following:

Code: Select all

/dev/sda
-- /dev/sda1 - ext4 - /root
-- /dev/sda2 - ext4 - /home
-- /dev/sda5 - swap

[optional, 2nd step, including additional SSD for editing photos/videos, just it there is something to consider already now about it...]

Code: Select all

/dev/sdb
-- /dev/sdb1 - ext4 - "media"

Under Windows 7/10 I used TrueCrypt with full disk encryption for "sda" which required only once to enter the password before the boot. Using this password as well for the encryption of "sdb", I could store the pass/hash in memory using it to automatically mount "sdb" after boot.

I would like to achieve a similar setup under Linux Mint - but failed attempting various tutorials/explanations I found. Is there any "simple" method/ path to follow?

Already tried/ followed:
https://community.linuxmint.com/tutorial/view/2265
https://github.com/CallumCameron/mint-e ... /README.md
https://community.linuxmint.com/tutorial/view/2026
https://web.archive.org/web/20171114233 ... encryption

Thanks a lot in advance!

Thorsten

[Moem]

Any reason why you did not choose to encrypt during installation? As far as I know, that's the easiest way.
(I have no idea how Win10 handles encryption, or, frankly, anything.)

[th23]

Any reason why you did not choose to encrypt during installation?

I didn't find an option to select full disk encryption - only to encrypt the "home" folder, but not the whole operating system. Did I miss something there?

[Pierre]

it's usually only for the /home partition or folder.

so, why is that not enough ??.

[Moem]

Maybe you missed the option for encryption on this screen?

[th23]

Maybe you missed the option for encryption on this screen?

Somehow, I did or confused it with the "home" encryption option... Thanks for pointing out, will try again with this one

Does this at the same time allow for customization of the partitions created - or is it better to go with the standard and change / adapt later once encrypted?

[Moem]

Someone else will need to answer that as I don't use encryption. Please note that full disk encryption is not recommended for new Linux users. Too many folks getting in trouble (most of them by forgetting their passphrase, but there are other ways too). If you feel that you still want to do it, be sure to have a backup of your data elsewhere.

[Pierre]

but, if you did backup elsewhere - then you'd to encrypt that too,, wouldn't you ?
otherwise, it's pointless in encrypting just the Full Disk, isn't it ?

ie: lot's of folks will use TrueCrypt within the windows system,
but then neglect to include the ext backup, in the TrueCrypt options . . .

[Moem]

but, if you did backup elsewhere - then you'd to encrypt that too,, wouldn't you ?
otherwise, it's pointless in encrypting just the Full Disk, isn't it ?

No?
If you take your computer with you, and it's encrypted, and you have a backup at home in a safe place (say, a locked vault)... how would that make the encryption of the disk pointless?

[Mute Ant]

"...does this at the same time allow for customization of the partitions created..." No, it's hard-coded into the Ubuntu-Mint installer, one drive holds one encrypted Mint installation. That's not totally undesirable. You get a large pool of helpers who already know what the OS looks like.

[th23]

but, if you did backup elsewhere - then you'd to encrypt that too,, wouldn't you ?

Of course, backups (even while stored in a safe place) are also encrypted...currently as well via TrueCrypt, but assume LUKS can also deal with external volumes

[th23]

No, it's hard-coded into the Ubuntu-Mint installer, one drive holds one encrypted Mint installation. That's not totally undesirable. You get a large pool of helpers who already know what the OS looks like.

Understood, thanks for the hint - will use this as a "basis" and do a bit trial & error from the standard install, to learn about the setup on my spare computer for now

[th23]

Thanks again for all your input and ideas! I spent the weekend to try out various things and approaches:

I still prefer to get the fully encrypted setup, only/max leaving the boot partition unencrypted. However, I wanted to modify the standard installation option provided by the Linux Mint installer, so I ended up with multiple tutorials...and after trying those, the following for me worked and was good to follow:
https://nowhere.dk/articles/installing- ... on-and-lvm

In case some other new joiner is looking to guidance

[newminty2018]

Hi Thorsten,

I was recently looking at the latest version of Veracrypt (Truecrypt) with a view to full disk encryption.

I almost did it, but something stopped me.

Veracrypt offered me the option to encrypt 'a system with either multiple operating sytems installed or dual boot system' .
I stopped the Veracrypt install because I want to install Linux Mint in a dual boot with Windows 7 and thought I better get that up and running and then go back to Veracrypt to encrypt the whole system with 'multiple operating systems'.

So if your looking at Truecrypt perhaps try the current version of Veracrypt that gives you the option above and hopefully that may solve your problem..

Regards
Newminty2018