Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm curious if it is possible to mount a partition encrypted by cryptsetup with LUKS securely and automatically on Ubuntu 10.0.4 LTS.

For example, if I use the key for the encrypted partition, than that key has to be presented on a device that is not encrypted and if someone steals my disk they'll be able to find the key and decrypt the partition.

Is there any safe way to mount an encrypted partition? If not, does anything exist to do what I want?

share|improve this question
    
Hello! I edited your post to make the grammar more clear. I tried to maintain the integrity of the original post as much as possible, but there were a few areas that I was unsure of your exact meaning. You should stand a better chance of getting good responses now. –  Wesley Jan 1 '11 at 19:23
    
Well, thank you. –  Ency Jan 1 '11 at 19:25

2 Answers 2

up vote 0 down vote accepted

Yes, it is possible -- you can store the key in an encrypted home directory, or on the LVM-encrypted system volume, for example. However, both of these require you to decrypt the partition where the key is stored at some point -- if you're looking for unattended secure mount of an encrypted device at boot, that's much more of a challenge. See this question for a discussion.

We use encrypted LVM system drives a lot, and while it's a bit of a pain to have to enter the password at boot time, it means we can reasonably secure the disk (and any other encrypted devices, partitions, or volumes we want to mount) in the event of physical loss or theft. Doesn't help secure a running system a bit, though.

share|improve this answer
    
I am bit of confused, because all what I read about encrypted LVM was about LUKS. In my case, it is about LUKS on LVM. So I will have to somehow mount encrypted LVM anyway, won't I? –  Ency Jan 1 '11 at 23:30
    
LUKS/dmcrypt can be used for a device, partition, disk image, or LVM volume -- anything that can be used by the device mapper. I didn't catch that your question was about encrypting the root partition, and an encrypted LVM volume is just one way to implement this (and has the advantage of being automated as an install option by several prominent distros). Either way, the question boils down to how to secure your keys. If you don't want to have to enter a password at boot, you'll need to take a look at one of the more exotic options, e.g. in the question to which I've linked above. –  nedm Jan 2 '11 at 0:01

Like with your house or car, the only way to keep your data secure is to not leave your keys laying around... This kind of precludes automatic boot, unless you were to do something like seriously secure a key server, say by building it into a wall or pouring it into the foundation? :-)

I, personally, have done two different things in this situation. One of my machines has a remote KVM card in it, so when it boots I can login via the KVM and enter the crypto password. Another I have an unencrypted root partition, then store the security-important data on another partition that I have to ssh in and decrypt/mount. I am mostly worried about someone breaking in and stealing the box and then getting access to all this private data.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.