Perils of Encrypting your Home Folder on Ubuntu

Forketyfork

·

Follow

6 min read

·

Sep 16, 2020

66

Listen

Share

Encrypting an existing user home folder in Ubuntu should be a single-command task, but it got tricky for me with some complications. I’ll try to explain what issues I had and how I fixed them. I used the latest LTS 20.04.1 version of Ubuntu.

First off, you’ll probably want to encrypt the whole drive instead, since some sensitive data may reside not only in your home folder but also outside of it. For instance, you should definitely encrypt the swap file in addition to home folder encryption, as the swap file may contain all kinds of sensitive information offloaded from the memory.

This article will cover both encrypting the home directory, and encrypting the swap file.

Once again, home folder encryption is tricky, and it may ruin your home folder, so first, do a backup. Please use this guide at your own risk.

Encrypting the home folder

Start with installing eCryptFS:

sudo apt install ecryptfs-utils cryptsetup

Now you’ll need an additional local administrator user to encrypt your home folder, since when you’re logged in, some of the files in this folder may be open or inaccessible. To make sure you don’t loose anything during the encryption, this process has to be done from another user. The easiest way to create one is as follows:

sudo adduser tempadmin
sudo usermod -aG sudo tempadmin

Now log out and log in using this tempadmin user. Before running the utility, make sure you have enough free space on the drive — it should be at least 2.5 times the size of your home folder you want to encrypt.

Run the utility that’s supposed to encrypt your home folder, providing the name of the user whose home folder you want to encrypt (it’s just user in my example):

sudo ecryptfs-migrate-home -u user

If you try to run the utility and it fails due to insufficient free space, it may leave an .ecryptfs folder in your /home folder. This may prevent the utility to run the second time, but at this stage it should be safe to just remove this .ecryptfs folder, clean up the free space, and restart the utility.