Encrypting /home folder using LUKS - CM4

uConsole
1

Some of us are probably planning on traveling with the uConsole. If it gets lost though, anybody can pull your sd card out and go through all your files and read your business.

Encrypting your /home directory seems like a good idea - I used this easy howto guide to get there.
https://www.makeuseof.com/how-to-protect-your-raspberry-pi-data-from-loss-or-theft/

Just a public service announcement - if any longtime linux experts have some other suggestions about how to do this I’d like to hear some tips.

4 Likes
2

I did this, leaving 13GB in root partition unencrypted. Now I have almost 8GB used in the root leaving me with only 5gb of free space. (64GB Card)
Question: what’s a good amount for the root partition to be safe?

3

I went through the alternative path – let the initrd loads the required driver and just go FDE.

Due to lacks of support AES acceleration on RP CM4 Broadcom SoC, I’d strongly suggest using alternative algorithm like xchacha12,aes-adiantum or xchacha20,aes-adiantum, which provide better performance compared to AES and provide reasonable security for it.

2 Likes
4

I have used fscrypt for home folder protection following Encrypting 🔐 a Home 🏡 in Raspberry Pi guide (with some small changes). From my PoV this could be easier and does not require to have separate partition for home folder / luks.

Actually Ubuntu uses something similar to thing path.

2 Likes
7

Rooky question, why can’t you just encrypt the home directory as is with fscrypt, why make a new one and move files to it?

8

@Yochi, because it works like this. You do not encrypt files, you setup folder to have encrypted content.

You setup new empty user home folder to be encrypted, then just move files from your origin home folder to it and rename new to old. Steps should be done from root user. It is easier than it seems, the guide can help.

2 Likes
9

Fscrypt does not hide file sizes. This could be a problem depending on your theat model.

1 Like