2

I recently installed CentOS 7 on a computer with high-end hardware (8-core processor, NVMe 512GB SSD, 16GB RAM).

My customer wants /home to be crypted and I was not aware of that, so that I didn't selected this option during install.

The computer hasn't be in use yet, so that there is no need to backup any data.

I remember a dedicated /home partition was created (but will have to check).

What would be the easiest to achieve :

  • A) Crypt existing /home partition?
  • B) Delete /home and create it again encrypted?
  • C) Wipe the SSD, reinstall CentOS 7 and choose this time to crypt?

Because I still have the installation CD and considering the high-end hardware, option C appears to me quite straightforward. (I just would have to reinstall the graphic card driver afterward.)

Is there an even easier solution with A) or B), and how should I proceed?

4
  • All of these are possible, assuming it's done right. So the choice comes down to personal preference / confidence / opinion... Jul 1, 2019 at 9:24
  • My preference would be B) if possible from CentOS 7 installer. If it is able to detect existing installation and not overwrite partitions other than /home.
    – OuzoPower
    Jul 1, 2019 at 9:47
  • 1
    If you're new to Linux, I highly recommend reinstalling CentOS 7 instead of adding filesystem encryption after-the-fact. The reason being is that a number of steps are required set up encryption on /home properly. For example, in the case of LUKS, you'd have to create the LUKS container, put a filesystem on it, put the files that were in /home in the new filesytem, and configure it to mount during boot (which means you'd need to either enter a LUKS passphrase during boot or use a "keyfile"). The process is doable, but requires research and experience to pull it off. Jul 1, 2019 at 10:10
  • Thank you for your comment, Emmanuel. I'm not new to Linux, although I've not used encryption so far. From your description, the solution "A" appears me the easiest one (unless the CentOS installer allows solution "B".
    – OuzoPower
    Jul 3, 2019 at 12:08

1 Answer 1

1

I believe the easiest way would be to crypt your /home partition by using some tool like LUKS (Linux Unified Key Setup) : https://linux.die.net/man/8/cryptsetup. You can find a nice guide on how to do so here : https://geekpeek.net/disk-encryption-on-centos-linux/ .

Of course, you can always reinstall the entire system. This could be even more optimized since all the partition will be crypted from the beginning.

It's actually on what bothers you less :)

1
  • Thanks. I had heard from LUKS, but I wonder if simply deleting the /home partition, CentOS installation DVD doesn't have some "repair" features that would let me create a new encrypted /home without reinstalling the whole system. I assume a partial reinstall would be the easiest if the installer allows it.
    – OuzoPower
    Jul 1, 2019 at 9:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .