Is it practically possible to make an encrypted partition be auto-mounted without entering a passphrase?

Question

I've just discovered the joys of encryptsetup.

I'm now wondering about the possibility of auto-mounting a partition which is encryptsetup ("LUKS") formatted.

I found this article, which talks about making a second key (randomly generated keyfile) for your volume, and then using /etc/crypttab. But the author also says:

This key file needs to be kept secret as it allows to unlock the encrypted volume. I suggest storing this key on an already encrypted system partition / volume to protect it. Storing this key on an unencrypted / unprotected location will render the encryption useless.

... which makes sense.

Given that I have to enter a password when I start up Linux (Mint 18.3), I was thinking: "well, that's OK, I can just put this keyfile somewhere under / and it'll be secure enough".

But is that true? Is my main Linux file system partition actually encrypted in any sense of the word, or is it merely that access to it is password-protected? If the latter, does that mean that someone who has the right disk diagnosis tools can read any file under / ?

Is it then practical to think of encrypting one's main Linux partition? Won't this come with a big performance hit?

What's the answer to this conundrum? Do I just have to resign myself to entering the encryptsetup password (or "passphrase") manually each time I reboot? And make sure I keep confidential data outside my unencrypted main Linux partition?

Answer 1

You cannot keep the secret key on the / and encrypt it at the same time. It simply won't work that way.

Yes, Someone with physical access to the disk can retrieve the secret.

Yes, encryption has performance drawbacks. It is a wise choice to do it on partitions containing important data, not the whole operation system.

Entering password manually is a better decision if you can keep system up and running for long periods of time, or be there in person, or remotely at the console at each startup. The remote procedure demands starting network services beforehand, hence main partitions must be kept unencrypted.

Otherwise, a less secure practice is to keep the secret somewhere close and accessible to the main operating system, in main partition or via a flash stick.