Hello!
I'm trying to implement this
https://trisquel.info/en/wiki/full-disk-encryption-install, but i wanted to
do it to a system with multiple partitions and to have them all encrypted
(from what i was able to understand that documentation applies only to the
swap area and root partition, but it doesn't contemplate having /tmp, /var
and other separate partitions and to encrypt them also).
I have partitioned my hard drive in the following way:
/dev/sda1: /boot (200 MB, EXT2, Primary)
/dev/sda2: /swap (2 GB, swap, Primary)
/dev/sda3: (Extended)
/dev/sda5: /tmp (18 GB, XFS, Logical)
/dev/sda6: /var (16 GB, XFS, Logical)
/dev/sda7: /root (16 GB, XFS, Logical)
/dev/sda8: /usr/local (6 GB, XFS, Logical)
/dev/sda9: /usr (32 GB, XFS, Logical)
/dev/sda10: /opt (8 GB, XFS, Logical)
/dev/sda11: /home (200 GB, XFS, Logical)
Note: I have chosen this partitioning scheme and file system based on what i
read on-line, with performance and stability in mind. I even chose the
partitioning order trying to reduce the amount of disk searches (...maybe a
bit silly of me)! If you have anything to point out to the way i have
partitioned my hard drive, any tip or recommendation, please do so!
Actually, i've just formatted /dev/sda1 with ext2 and will leave it unused
for now, because i intend to put the boot partition, with GRUB and the
kernel, in an external USB thumb drive, for added security.
Basically, my question is: will i have to encrypt every single partition, one
at a time, with cryptsetup -y --cipher aes-xts-essiv:sha256 --key-size 512
luksFormat /dev/PARTITION and, from there, work with each one individually,
as explained in the link i've placed at the beginning of this post, or is it
possible/recommended to encrypt the whole extended partition area (/dev/sda3)
in place?
Any comment would be much appreciated. Thank you!
