Install debian on encrypted volume

See https://www.blakecarpenter.dev/installing-debian-on-existing-encrypted-lvm/ The main points:

- expert install
- "Load installer components from CD. From here, you want to select crypto-dm-modules and rescue-mode."
- ctrl+alt+f2 to jump into a shell
- depmod -a
- cryptsetup luksOpen /dev/sda3 debian-crypt
- vgchange -ay
- ls /dev/mapper
control debian-crypt debian-home debian-root debian-swap
- "Hit ctrl+alt+f1 to return to the Debian installer and continue to Partition disks. Select Manual."
- setup partitions/mount points
- stop before Install the GRUB bootloader to a hard disk. ctrl+alt+f2 to jump into a terminal.
- blkid
- nano /target/etc/crypttab
debian-crypt UUID=98...eaa none luks
- "Continue to the end of the installation. When the generating initramfs step appears, the image will be built using the crypttab file you just modified."  

Luks partitioning

 Partition Table: gpt
Disk Flags:  

Number  Start   End    Size   File system  Name  Flags
1      1049kB  211MB  210MB  fat32              boot, esp
2      211MB   735MB  524MB  ext4               legacy_boot
3      735MB   512GB  511GB

Partition 1 mount point = /boot/efi

Partition 2 mount point = /boot

Partition 3 = luks

GRUB string:

sudo vim /etc/default/grub

linux   /vmlinuz-5.12-x86_64 root=UUID=xxx-uuid-of-root-ext4-fs-xxx rw  quiet cryptdevice=UUID=luks-partition-uuid:mapped-to-name:allow-discards root=/dev/mapper/mapped-to-name udev.log_priority=3 rd.luks.options=discard

update-grub

gpg encryption/decryption

Encrypt:

 gpg --no-symkey-cache -c cd2.iso

Decrypt:
 gpg --no-symkey-cache -o cd2.iso -d cd2.iso.gpg

Manjaro/archlinux drive encryption notes

https://wiki.archlinux.org/index.php/Dm-crypt/System_configuration

Need to have normal ext4 boot partition, vfat EFI partition, and an encrypted partition. 

Kernel boot image must have dmcrypt support:

/etc/mkinitcpio.conf

...


HOOKS=(base udev autodetect keymap modconf block encrypt filesystems keyboard fsck)

...

/etc/default/grub:
GRUB_CMDLINE_LINUX="cryptdevice=UUID=88.-..888:cryptroot:allow-discards"




/etc/fstab: 

# /dev/mapper/cryptroot
UUID=111-11-...       /               ext4            rw,noatime      0 0

# /dev/nvme0n1p6
UUID=222-22-...       /boot           ext4            rw,relatime     0 0

# /dev/nvme0n1p2
UUID=333..          /boot/efi       vfat            rw,relatime,fmask=0022,dmask=0022,codepage=437,iocharset=iso8859-1,shortname=mixed,utf8,errors=remount-ro
      0 0

 

mount encfs on login on ubuntu

Install libpam-encfs.

Edit /etc/security/pam_encfs.conf : 

Recommended: comment out the line

encfs_default --idle=1 

This flag will unmount your encrypted folder after 1 minute of inactivity. If you are automounting this on login, you probably would like to keep this mounted for as long as you are logged in.

At the bottom, comment any existing demo entries and add:

#USERNAME SOURCE TARGET PATH ENCFS Options FUSE Options foo /home/foo/EncryptedFolder /home/foo/DecryptedFolder -v allow_other

Make sure to initialize EncryptedFolder with the same user password.

Also, if you see the following line, remove allow_root from the options. Otherwise, it will be in conflict with allow_other defined above.

fuse_default allow_root,nonempty

Next, edit /etc/fuse.conf: Uncomment:

user_allow_other

To test your config, open a new virtual terminal (e.g. Ctrl+Alt+F4) and login. You should see pam successfuly mount your EncFS folder.

Should be enough.

See more at https://wiki.archlinux.org/index.php/EncFS#Mount_at_login_using_pam_encfs