1

I've just finished setting up LUKS encryption on new install of Mint 18.3. I mainly followed the steps in this guide (only doing the system #1 setup however as this is the sole OS on this system).

My setup has /, /boot and swap on my SSD, and /home on a HDD, so I've added in the extra steps to set up LUKS encryption both on:

  1. A partition on my SSD that I created logical volumes for swap and /. I called this 'encrypted_ssd'.
  2. A partition on my HDD that only holds /home. I called this 'encrypted_hdd'.

During install I also checked the box to encrypt /home, and I followed the post install steps to mount them all properly and set up both encrypted_ssd and encrpted_hdd in my crypttab.

As far as I can see, I've followed the same steps for the hdd and ssd encrypted partitions. However when I boot into my install, it only asks me for a password to decrypt 'encrypted_ssd'. Is there a reason why it's not asking me to decrypt my 'encrypted_hdd' partition? Does the fact that the passwords are the same, or that I chose to encrypt my /homeduring install make a difference here?

Is a way to check that my /home is encrypted or not?

Here's what my crypttab looks like (cryptswap1 was already in my crypttab before I added the other lines):

cryptswap1 UUID=b6b9ac2c-6bd8-4689-bc43-9ed53ec305c7 /dev/urandom swap,offset=1024,cipher=aes-xts-plain64
# <target name> <source device> <key file>  <options>
encrypted_ssd   /dev/nvme0n1p3  none        luks
encrypted_hdd   /dev/sda1       none        luks

My partition setup is:

On nvme0n1 (ssd)
p1: efi
p2: /boot
p3: encypted_ssd

On sda (hdd)
1: encrypyed_hdd
0

For future reference: I ended up being able to solve this myself. I tried playing around with having different passwords for encrypted_ssd and encrypted_hdd, as well as choosing to encrypt my home folder during install or not.

The home folder encryption made no difference either way, but once I set different passwords for encrypted_ssd and encrypted_hdd, Mint asked for both passwords upon boot as I wanted. I wouldn't have thought this would be the case, as from what I've seen the passwords just point to a key which should be different for each drive anyway.

The only other change I made was to change my default encryption from sha128 to sha512 for both drives, explicitly:

sudo cryptsetup --hash sha512 --key-size 512 luksFormat /dev/sda1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.