Encryption with two disks /root and /home

[withoutughrepeatedly (without repeatedly)]

I have installed Silverblue like this:

I have two brfts volumes:

Disk 1: fedora (root and var as subvolumes)

Disk 2: home (home as subvolume)

I would like to encrypt my drives. I will reinstall everything but my question. Is there any way to encrypt my two disks with the same password and only have to type it once to log in?

If not. Should I just encrypt /home and forget about /root?

I do not want to create a single brfts module with my two disks, I did that and the performance took a hit. root disk is an expensive one and home disk is cheap just for data.

[mjg (Michael J Gruber)]

Whether you want to encrypt both root and home depends on the “attack” you want to protect against:

• lost/stolen computer: encrypted home protects your data
• unnoticed access to your computer: encrypted root protects against installing keyloggers etc
  Note that to be really safe, you’d need encrypted /boot here, as well.

As for the passwords: last time I had a setup like this the system would cache the passphrase while it unlocked several encrypted volumes so that having the same passphrase required 1 prompt only, unless you make a typo

Alternatively, you could use a passphrase on the first volume and a key file (stored on the first volume) for the second volume if this still matches your security considerations (key file can be copied with root access, but root access allows “everything”, of course).

[siosm (Timothée Ravier)]

@mjg

Alternatively, you could use a passphrase on the first volume and a key file (stored on the first volume) for the second volume if this still matches your security considerations (key file can be copied with root access, but root access allows “everything”, of course).

This is what I would do. Make sure to also enroll a password as backup for the second LUKS devices.

[arturasb]

I have my root and home on separate disks, LUKS2, encrypted. When booting, I enter passphrase to unlock the root, where the key file for the home is located. Then cryptsetup does the job unlocking home without asking its passphrase.

Disk Encryption User Guide

[vekruse (Villy Kruse)]

You could go a step further and use systemd-homed. With that you unlock your home directory using your login password.

[withoutughrepeatedly (without repeatedly)]

@mjg

Alternatively, you could use a passphrase on the first volume and a key file (stored on the first volume) for the second volume if this still matches your security considerations (key file can be copied with root access, but root access allows “everything”, of course).

This sounds good but, honestly, encryption is new for me. Not sure how to do this.

Should I encrypt both disks with password in anaconda and then once everything is done and running, then create a key file for the second disk?

I would really appreciate some step by step here

Edit: What is the advantage of the key file instead of the same password for both disks?

Asking because it might not worth the effort of the key file for my case.

[augenauf (Flo)]

@vekruse

You could go a step further and use systemd-homed.

Is this documented somewhere? Is it supported out-of-the-box in Silverblue?

[anon91881872]

Isint this all easiest to achieve from anaconda installer select both drives and then encrypt all setup custom partitions or use automatic.

I use this with my 2 nvme drives encrypted and lvm easiest way usually just clicking automatic setup best way

[withoutughrepeatedly (without repeatedly)]

@siosm

This is what I would do. Make sure to also enroll a password as backup for the second LUKS devices.

What is the advantage of the key file instead of the same password for both disks?

Asking because it might not worth the effort of the key file for my case.

[vekruse (Villy Kruse)]

See https://systemd.io/CONVERTING_TO_HOMED/.

I have no idea if it works on Silverblue.

[augenauf (Flo)]

@vekruse

I have no idea if it works on Silverblue.

Then better not recommend it to someone until officially supported!

[benpietras]

Hi,

I installed fedora 40 on a laptop with two drives yesterday.
I first used disk one (20GB) for the install. Then from the new OS encrypted the second disk, decrypted, wrote a btrfs partition to it. Then I created a keyfile, added the keyfile to the second disk as a … well, keyfile. Then set it up in /etc/crypttab, /etc/fstab. The cmds are from my root .bash_history.

The second disk decrypts and mounts on boot (I set my /home there) - you only enter a decryption password once to decrypt both disks.

OK, so my second disk has the disk label /dev/sda.
If anyone is following this USE YOUR DISK LABEL. Otherwise the wrong disk could be wiped…

cryptsetup luksFormat /dev/sda # (here set a pass as a failsafe)
dd bs=512 count=4 if=/dev/random of=/etc/keyfile iflag=fullblock
chmod 400 /etc/keyfile 
cryptsetup luksAddKey /etc/keyfile /dev/sda
cryptsetup luksOpen /dev/sda lukko # use pass
mkfs.btrfs /dev/mapper/lukko # (use 0% - 100% as limits)
vi /etc/crypttab 
# added:
# lukko /dev/sda /etc/keyfile luks
vi /etc/fstab
# added:
# /dev/mapper/lukko /home btrfs defaults 1 2 # (comment out other /home line)
umount /mnt/lukko 
cryptsetup close lukko
reboot

This didn’t exactly come from a guide. Hopefully I haven’t missed anything important.

[mjg (Michael J Gruber)]

@withoutughrepeatedly

@mjg

Alternatively, you could use a passphrase on the first volume and a key file (stored on the first volume) for the second volume if this still matches your security considerations (key file can be copied with root access, but root access allows “everything”, of course).

This sounds good but, honestly, encryption is new for me. Not sure how to do this.

Should I encrypt both disks with password in anaconda and then once everything is done and running, then create a key file for the second disk?

I would really appreciate some step by step here

Edit: What is the advantage of the key file instead of the same password for both disks?

Asking because it might not worth the effort of the key file for my case.

The advantage of the keyfile is that you never need the passphrase. I would still set one up, though, i.e.:

• during install, set up two encrypted volumes
• you may choose the same passphrase or different ones
  If you choose the same passphrase, chances are that you need to enter it only once.

There is no simple way to set up a keyfile during install (unless you switch to a virtual console, set up the file system, switch back and preserve the file system). I recommend doing the install as above first.

For adding the keyfile and setting things up, you will have to use the command line (only some of the steps pointed out by @benpietras ). Depending on how you feel about doing something like this, you may prefer to stick with passphrase only as above, or we’ll detail the steps (in short: create keyfile, cryptsetup luksAdkkey, edit crypttab).

[withoutughrepeatedly (without repeatedly)]

@mjg

Depending on how you feel about doing something like this, you may prefer to stick with passphrase only as above, or we’ll detail the steps (in short: create keyfile, cryptsetup luksAdkkey, edit crypttab).

It doesnt look too hard.

To be clear, I install Fedora with two volumes, one in each disk (root and home) with passwords.

And then, with the system running, I add the key file?

Yes, please. If i could get those steps it would be great.

Now I understand what you meant with ‘unless you make a typo’. In that case I will have to type my password for each disk. A key file will solve that problem

[mjg (Michael J Gruber)]

Ok, so let’s go, as root or using sudo for each command:

findmnt /home

will tell you which luks device your home is on, say luks-123-456 (it’s longer). Then,

cryptsetup status luks-123-456

will tell you which device is underlying that luks device, say /dev/diskOrPart (will be sd something, nvme something, …). Next, we create a random keyfile just like Ben did (be extra sure to get the dd line right):

mkdir -p /etc/cryptsetup-keys.d
dd bs=512 count=4 if=/dev/random of=/etc/cryptsetup-keys.d/luks-123-456.key iflag=fullblock
chmod 400 /etc/cryptsetup-keys.d/luks-123-456.key

Finally, we add that keyfile as a key to unlock your luks device:

cryptsetup luksAddKey /etc/cryptsetup-keys.d/luks-123-456.key /dev/diskOrPart

You will need to enter your passphrase here to confirm that you’re legit

Now, if the man page is right, you do not even need to edit /etc/crypttab because keyfiles are searched for automatically in that dir if they are named by luks device. Otherwise, change the none in the crypttab entry for your home luks device into the full path of the keyfile.

[hamrheadcorvette (hammerhead corvette)]

@withoutughrepeatedly

I have two brfts volumes:

Disk 1: fedora (root and var as subvolumes)

Disk 2: home (home as subvolume)

I would like to encrypt my drives. I will reinstall everything but my question. Is there any way to encrypt my two disks with the same password and only have to type it once to log in?

You can already do this from the installer, Choose the Advanced. I can post screenshots in about an hour to walk you through.

[withoutughrepeatedly (without repeatedly)]

@mjg

Otherwise, change the none in the crypttab entry for your home luks device into the full path of the keyfile.

Unfortunately nothing worked.

To be honest, I had problems to install Fedora 39 Silverblue with no encryption in the past, I guess because of NVIDIA.

I have a laptop with intel + NVIDIA.

Sometimes it didn’t log in until NVIDIA drivers were installed.

Soooo, I tried your method, @benpietras method and nothing worked. On Fedora 40 I could log in the first time (with the same password for both disks) but once I rebooted after updating Fedora (had to do it to install NVIDIA), in the first reboot: failed to log in.

Also, if I didn’t type the password right the first time (before trying to install NVIDIA), it would ask for the password for the second disk and then wouldn’t log in.

I tried with Fedora 39 and 38 just in case (I didn’t have any problems with 38 and NDIVIA). Same thing happened.

Whenever the second disk had to be decrypted (password or file) it wouldn’t boot.

Maybe it is a graphics problem, maybe it is a disk problem, maybe it is my laptop problem…

So, I just made an automatic install with encryption with the two disk under one brfts volume. And that worked. I could install NVIDIA and everything works smoothly.

Both are NVEM but one of them is faster than the other. I guess I won’t notice it much. I hope.

[benpietras]

Hi,

One btrfs partition over both encrypted disks sounds good. Downsides would be if one disk failed or a speed hit, but overall not bad.

The encryption / login has nothing to do with the graphics drivers. You can hold Ctrl-Alt-2 (or 1) to toggle to a basic CLI login if the GUI greeter freezes up. Too late to try that now.

Sorry my method didn’t work for ya. Without an eye on all your setup it’s not easy to say what went wrong.

[withoutughrepeatedly (without repeatedly)]

@benpietras

Sorry my method didn’t work for ya.

not a problem.

I tried crtl-alt-2 but nothing. It freezes when it has to decrypt the second drive.

Thanks anyway.

[siosm (Timothée Ravier)]

@withoutughrepeatedly

What is the advantage of the key file instead of the same password for both disks?

Asking because it might not worth the effort of the key file for my case.

With a keyfile added for the second partition, you don’t have to type your password two times on boot.