Re: [gentoo-security] Encrypting a user home folder on a laptop

[Florian Philipp]

On Sun, 2008-02-17 at 11:53 +0100, Florian Sowade wrote:
> Randy Barlow wrote:
> > I am probably being paranoid, but I'd like to encrypt my /home/username
> > folder on my laptop.
>
> just another point: you should think about encrypting at least /tmp and swap
> too, because temporary data will be stored there and if your home dir is
> encrypted but those two are not one could simply read your data from there.
> Have a look at this forum thread for the setup. because it uses random keys
> you don't have to enter a passphrase at bootup:
> http://forums.gentoo.org/viewtopic-t-298001-highlight-encrypt+ramdisk.html

It's even worse when you hibernate because your whole RAM-content
(including disk caches from your encrypted home-partition) is written to
disk and encryption is not so easy because you have to ask for the
pass-phrase on resuming in early userspace. Look here for how to solve
it:
http://gentoo-wiki.com/SECURITY_System_Encryption_DM-Crypt_with_LUKS

I fear I'll have to spend my Easter holidays converting my system with
that guide.