I've just discovered the joys of encryptsetup
.
I'm now wondering about the possibility of auto-mounting a partition which is encryptsetup
("LUKS") formatted.
I found this article, which talks about making a second key (randomly generated keyfile) for your volume, and then using /etc/crypttab. But the author also says:
This key file needs to be kept secret as it allows to unlock the encrypted volume. I suggest storing this key on an already encrypted system partition / volume to protect it. Storing this key on an unencrypted / unprotected location will render the encryption useless.
... which makes sense.
Given that I have to enter a password when I start up Linux (Mint 18.3), I was thinking: "well, that's OK, I can just put this keyfile somewhere under / and it'll be secure enough".
But is that true? Is my main Linux file system partition actually encrypted in any sense of the word, or is it merely that access to it is password-protected? If the latter, does that mean that someone who has the right disk diagnosis tools can read any file under / ?
Is it then practical to think of encrypting one's main Linux partition? Won't this come with a big performance hit?
What's the answer to this conundrum? Do I just have to resign myself to entering the encryptsetup
password (or "passphrase") manually each time I reboot? And make sure I keep confidential data outside my unencrypted main Linux partition?