2

I've been a Linux user for about 15 years. Since the feature existed, I used LUKS to encrypt the partitions on which I was installing Ubuntu.

I have the following issue: when someone else uses my computer, I have to be there to boot it, because only I should know the decryption secret phrase.

To solve this problem, I thought of installing several OS on my hard drive, one on a LUKS encrypted partition (for me) and another on a non-encrypted partition (for others). This with a dual boot that would allow booting either on the encrypted partition or on the non-encrypted partition.

Unfortunately, I was noble able to implement this idea. After manual partitioning under gparted, the installation always fails.

I'm looking for a tutorial that would explain how to install two GNU/Linux systems in dual boot, one of them encrypted and the other one not.

2
  • or you could use a 2nd keyslot for a 2nd passphrase if you trust enough your users to not abuse this.
    – A.B
    Oct 6, 2022 at 11:27
  • The idea is to have the other users as guests, so they don't have to type any password to use (essentially surfing the internet) the computer.
    – crocefisso
    Oct 6, 2022 at 11:34

1 Answer 1

1
  1. Prepare a partition for /boot/efi and a partition for /boot in gparted
   |------+-------------+-----------+------+-------+-----------|
   | Name | Mount point | Flag      | Size | FS    | Comment   |
   |------+-------------+-----------+------+-------+-----------|
   | sda1 | /boot/efi   | esp, boot | 300M | FAT32 |           |
   | sda2 | /boot       |           | 2G   | EXT4  |           |
   | sda3 |             |           |      | EXT4  | Encrypted |
   | sda4 |             |           |      | EXT4  | Clear     |
   |------+-------------+-----------+------+-------+-----------|
  1. Install clear GNU/Linux on sda4 At manual partitioning step
    • Select sda1
      • Format FAT32
      • Flag esp boot
      • Mount /boot/efi
    • Select sda4
      • Format EXT4
      • Mount /
  2. Install crypted GNU/Linux on sda3 At manual partitioning step, check encrypt
    • Select sda1
      • Mount /boot/efi
    • Select sda2
      • Format EXT4
      • Mount /boot
    • Select sda3
      • Delete partition
      • Create partition
      • Check crypt and enter passphrase
      • Mount /
  3. Edit grub
    • From crypted GNU/Linux do sudo gedit /etc/default/grub
    • Enable os-prober by uncommenting #GRUB_DISABLE_OS_PROBERfalse`
    • Do
       sudo grub-mkconfig -o /boot/grub/grub.cfg
       reboot

Notes

To have the passphrase asked after kernel selection,

  • encrypted GNU/Linux kernels have to be stored on a specific /boot/efi partition (sda2)
  • clear GNU/Linux kernels have to be stored in the same partition as clear GNU/Linux (sda4)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .