1

I have encrypted my home folder using ecryptfs, but now the need has arisen to encrypt the entire partition (/). Will encrypting my / folder with ecryptfs without removing the encryption on my home folder cause any problems?

Tobb
  • 121
  • 3
  • I can't assure you there won't be any problems, so wait for an answer from a more experienced user, but you shouldn't expect any. It's possible to encrypt the system partition with LUKS and also encrypt the home directory with ecryptfs at the same time on installation. However, you may experience a slight performance loss with this method. In my experience it's better to encrypt the whole partition in LUKS and then create a Private-folder in ecryptfs especially for your sensitive files. Also, make sure that a /boot-partition is situated outside the encrypted area, else you may get boot issues. – Prototype700 Oct 31 '17 at 10:53
  • Doesn't LUKS encryption destroy existing data? – George Udosen Oct 31 '17 at 10:55
  • I believe that doing a / encryption would initially render the other /home encryption useless and after that a re-encryption of /home should be ok – George Udosen Oct 31 '17 at 10:59
  • 2
    I do not believe you can use ecryptfs to encrypt all of / and with any system encryption you need a separate / boot partition. – Panther Oct 31 '17 at 15:16

2 Answers2

0

I do not believe you can use ecryptfs to encrypt / , you need to use LUKS.

When using LUKS, you will need a non-encrypted /boot partition.

In addition, the conversion to LUKS is destructive, meaning your data on both / and, unless /home is already on a separate partion, /home will also be overwritten, typically with random data.

You, may, use ecryptfs with LUKS and encrypt your home directory when you install or convert home post install if you do not encrypt $HOME as part of the install.

Also, backups of encrypted data are complex so make sure you have a working backup strategy in place. I usually make a .tar of $HOME using the unencrypted data and then encrypt the .tar ball.

My advice is to back up your data in an encrypted .tar or method of your choice (MAKE SURE YOU DO NOT BACK UP THE .ecryptfs config files ;)) and perform a fresh install. Encrypt $HOME if you feel you must (probably unnecessary on a single user system) and restore from backup.

Panther
  • 102,067
0

If you're thinking of using a separate eCryptfs encrypted directory, inside another eCryptfs encrypted directory, it won't work:

"Nesting encrypted directories inside of encrypted directories is not supported with eCryptfs. Sorry."

<p><em>Full disclosure: I'm one of the authors and current maintainers of <a href="http://ecryptfs.org" rel="nofollow noreferrer">eCryptfs</a></em></p>

-Dustin Kirkland

So, even if you could encrypt your entire root partition with eCryptfs (which appears unlikely from Panther's answer), or tried encrypting just /home and then your specific home, you would run into the nested encryption wall.

(Using LUKS on just the /home partition should work, if it has it's own partition.)

Xen2050
  • 8,705