Disappointed to see that the 18.04 installer no longer offers the option to encrypt the home directory. According to this bug report referenced in the installer, the recommended method for encryption these days is full-disk with LUKS, or fscrypt for directories. Full-disk encryption seems a bit overkill for my needs, and all the bugs and caveats mentioned on the Wiki don't make it a very attractive option. All I really want is to protect my home directory from someone accessing my documents, photos, etc. if my laptop were to get stolen, making fscrypt the option for me.
The fscrypt GitHub page has some examples on how to set it up, but I can't find any documentation aimed at encrypting the home directory on Ubuntu. The old ecryptfs tool is still available, but after setting it up Ubuntu would sometimes freeze at the login screen.
So my question is: How do I setup fscrypt to encrypt my /home directory and decrypt when I log in? I also liked how ecryptfs allowed decrypting the folder manually (eg. from disk images).
(A similar question was posted here and was unfortunately closed for being an "off-topic" bug report. To clarify, this is not a bug report. The fact that the encrypt home directory option was removed from the installer was intentional. All I'm asking here is how to setup fscrypt.)
Best Answer
Update 2020-02
I'm running multiple encrypted homes with
fscrypt
. Install your system without encryption and use this guide to implementfscrypt
on your home.The API to
fscrypt
might change in the future, so make sure to back up your important files if you attempt to upgrade your system.(This feature is not widely used on Desktop. Use at your own risk.)
Update 2018-11
TL:DR; You can try
fscrypt
in Ubuntu 18.10+ or Linux Mint 19.1+Looks like this was finally fixed. Here's a pre-emptive guide: http://tlbdk.github.io/ubuntu/2018/10/22/fscrypt.html
I'm not quoting instructions here because it does require some hacks and you can end up losing your home data.
Next is my original answer:
Original Answer 2018-05
TL;DR: Use classic home encryption with Linux Mint 19 Tara.
fscrypt
for home encryption is still broken.This is something a lot of us want. It appears the Ubuntu team couldn't get
ecryptfs
to work bug-free on Ubuntu 18.04, and couldn't fix the bugs infscrypt
for a home-encryption option in time for the scheduled Ubuntu 18.04 release either.For
fscrypt
, is at least one critical bug that makes it unusable for home encryption at the moment:Furthermore, we'd need a transparent way of authenticating/unlocking before it's a realistic alternative to the "old" ecryptfs-type home encryption. This is tracked here:
With these issues open, you can consider home encryption broken at this point. With that, my colleagues and I consider Ubuntu
18.0418.04.1 unfinished at the moment, and hope that home-encryption will be brought back (using the new and much betterfscrypt
method) in Ubuntu18.04.118.04.2.Until such time, we're sticking with Ubuntu 16.04.We have switched all our machines to Linux Mint 19 Tara with the classic home encryption usingecryptfs
. Read the "known issues" section in the Release Notes for Linux Mint 19 Tara about theecryptfs
limitations, and see if this is acceptable to you:If you have tried
fscrypt
and found it to be broken for your usage, you can vote "this bug affects me too" at the following launchpad bug:Note that
fscrypt
/ext4-crypt
(future "encrypt home") is the fastest option, andecryptfs
(old "encrypt home") is the slowest option.LUKS
("encrypt entire drive") is in the middle.For this reason, entire disk encryption is 'conveniently' recommended. Because if you have very big projects with many small files, use revision management a lot, make big compiles, etcetera, you'll find that the overkill of encrypting your entire drive is actually worth it compared to the slowness of the old ecryptfs-type home encryption.
In the end, encrypting the entire drive has multiple drawbacks:
It's puzzling that Canonical decided that "we don't need this anymore" on their LTS version, which has come to be known as their more "serious" distribution.