I went with the option with keyfiles. I keep backups of LUKS headers and keyfile in case a harddisk gets damaged. Currently have that stored as a file attachment in my password manager.
this post was submitted on 19 Mar 2025
22 points (95.8% liked)
Linux
52050 readers
1254 users here now
From Wikipedia, the free encyclopedia
Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).
Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.
Rules
- Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.
- No misinformation
- No NSFW content
- No hate speech, bigotry, etc
Related Communities
Community icon by Alpár-Etele Méder, licensed under CC BY 3.0
founded 5 years ago
MODERATORS
But how to get the OS to recognize it?
My approach for doing this in Gentoo with an encrypted /home is to configure dracut to make a slightly customized initrd.
Thanks to dracut modules, not too much configuration is needed - it prompts on boot for the password to decrypt, and then fstab is just configured to mount the decrypted uuid.
Someone else mentioned using multiple key slots, but I think this is your only real secure option.
Edit: on second thought, you may be able to get this to work in grub simply by adding rd.luks.uuid=xxx as a kernel boot parameter, and then having the decrypted /dev/mapper uuid in fstab for /home
If you go with adding a passphrase to the drive keep in mind that if it’s a unique one you may end up forgetting it since you won’t normally be using it. Even if you set it to the same passphrase as root partition, if you ever change passphrase for root you might forget to change home passphrase.
I would probably just make a physical copy of the key file. It’s just 32 bytes (no, larger key file doesn’t make things any more secure) so you can hexdump -C it and copy the key on a piece of paper.
You can always have a copy of the keyfile somewhere else, on an USB drive for example.
Alternative is to also add a passphrase to the /home luks partition.
yeh if I encrypt /home using luks with passphrase, so cryptsetup. How do I tell the OS to decrypt it? I tried passphrase before and it cannot boot because /home cannot be mounted. That is why I searched and found out about the Arch wiki way: using keyfile stored in root.
LUKS does offer multiple key slots. You can have the OS unlock it with a keyfile and be able to manually unlock it with a keyphrase when you don't have access to that file.
I'm not sure if you can tell the OS to unlock it with a passphrase on boot like with the root partition.
You can.
I honestly can't remember the details, but I followed an Arch guide somewhere (probably the wiki). It definitely prompts me for passphrase on boot.
That's the simplest answer.
You could give the home partition two keys, one stored on the root as you described and the other stored somwhere else/remembered.
Why do you need /home to be on a separate drive?