3. Encrypting the partitions
3.1. Filling the partition with random data
Now that we have our partition layout, we need to encrypt /home and /. The first thing we are going to do is to fill those partitions with random data. There is 2 ways of doing it. A fairly fast one or a really slow but efficient one.
3.1.1. using badblocks
By using badblocks you will verify that your physical disk is fine and at the ame time, fill with some random data.
# badblocks -c 10240 -s -w -t random -v /dev/lvmvolume/encryptedhome # badblocks -c 10240 -s -w -t random -v /dev/lvmvolume/encryptedroot
3.1..2. using dd
We can use dd to read random data from /dev/urandom and write them to the “to be” encrypted partitions:
Note that this is really long and slow, but it will make it harder to find the key that lock your partition.
# dd if=/dev/urandom of=/dev/lvmvolume/encryptedroot # dd if=/dev/urandom of=/dev/lvmvolume/encryptedhome
For an ETA, Ubuntu community encryption tutorial mentions:
Fill the partitions with random data. This may take MANY hours for the large partitions, on average 1.6M/sec of data is written to disk, so a 10GB partition might take around 2 hours, and 100GB partition might take a bit under 20 hours.
In the meantime you can wish that the tutorial is going to work
3.2. Setting up the LUKS encryption
Ok, now that our partitions are full of random bytes, we can set up our encryption mechanism wtih the help of cryptsetup.
# cryptsetup -y --cipher aes-cbc-essiv:sha256 \ --key-size 256 luksFormat /dev/lvmvolume/encryptedroot WARNING! ======== This will overwrite data on /dev/lvmvolume/encryptedroot irrevocably. Are you sure? (Type uppercase yes): YES Enter LUKS passphrase: Verify passphrase: Command successful.
And the same for encryptedhome:
# cryptsetup -y --cipher aes-cbc-essiv:sha256 \ --key-size 256 luksFormat /dev/lvmvolume/encryptedhome
3.3. Mounting the encrypted partitions:
Now, encryptedhome and encryptedroot are LUKS enabled, from there, we can use cryptsetup again to mount those encrypted partitions:
[email protected]:~# cryptsetup luksOpen /dev/lvmvolume/encryptedroot rootvolume Enter LUKS passphrase: key slot 0 unlocked. Command successful. [email protected]:~# cryptsetup luksOpen /dev/lvmvolume/encryptedhome homevolume Enter LUKS passphrase: key slot 0 unlocked. Command successful.
3.4. Formatting the partitions
Finally, we now have all our partition pseudo devices available. we can now format them so Ubuntu installer sees the partition we want to install our system on, e.g the encrypted ones.