3

I have been using ecryptfs encryption for a long time. I prefer per user encryption. That means even a root user can not read a user files when the user is not logged in. When an user is not logged in, any users (including root) should not be able to read his files. But ecryptfs is not an encryption for the entire system.

So today, I am thinking to use LUKS to encrypt the entire partition and then use ecryptfs to encrypt per user's home. Is this recommended (standard) way to achieve what I want? should I use both LUKS and ecryptfs at the same time?

Thanks a lot.

Improve this question
0

1 Answer 1

Reset to default
4

This is exactly what I do with my desktop. I have my entire partition encrypted with LUKS. And then I have my home directory encrypted using ecryptfs. The reason I encrypt my home directory using ecryptfs is because the desktop is used by my partner as well.

If you are the sole user of your system, ecryptfs may not be necessary.

Make sure you use different passwords for LUKS and ecryptfs so that compromise of the LUKS password will still protect the files in your home directory.

Improve this answer
1
  • 2
    Thanks a lot for the quick reply and sharing your experience. Your experience makes me more confident to do it. I need ecryptfs is actually because I am living in an unsafe country. (Internet censorship etc..). I don't want gov forces me to scan my files by violence in case, which it's unlikely to happen in my life. (paranoid). So I can show them another user's account instead of the true one. I have upvoted your answer and will leave this question open for a while to see if anyone have an opposite opinion or not. Thanks a lot again.
    – sgon00
    Apr 19, 2020 at 13:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .