dm-crypt/Mounting at login

It is possible to configure PAM and systemd to automatically mount a dm-crypt encrypted home partition when its owner logs in, and to unmount it when they log out.

This tutorial assumes you have already created your encrypted partition, as described in Dm-crypt/Encrypting a non-root file system.

Note:

You need to use the same password for your user account and for LUKS.
In all the examples, replace username with your username, 1000 with your user ID and PARTITION with the name of your encrypted partition's device.

Unlocking at login

pam_exec can be used to unlock the device at login. Edit /etc/pam.d/system-login and add the line below emphasized in bold after auth include system-auth:

/etc/pam.d/system-login

...

auth       include    system-auth
'''auth       optional   pam_exec.so expose_authtok /etc/pam_cryptsetup.sh

...

Then create the mentioned script.

/etc/pam_cryptsetup.sh

#!/bin/sh

CRYPT_USER="''username''"
PARTITION="/dev/sd''XY''"
NAME="home-$CRYPT_USER"

if [ "$PAM_USER" = "$CRYPT_USER" ] && [ ! -e "/dev/mapper/$NAME" ]; then
    /usr/bin/cryptsetup open "$PARTITION" "$NAME"
fi

Make the script executable.

Mounting and unmounting automatically

systemd-logind maintains user@1000.service for as long as at least one session is active for the user. It is started automatically after a first successful login and stopped after a logout from the last session. Hence, we can create and enable a unit for the mapped volume and connect it to user@1000.service in order to make it mount and unmount automatically:

Locking after unmounting

After unmounting, the device will still be unlocked, and it will be possible to mount it without re-entering password. You can create and enable a service that starts when the device gets unlocked () and dies after the device gets unmounted (Requires,Before=home-username.mount), locking the device in the process ():

/etc/systemd/system/cryptsetup-''username''.service

[Unit]
DefaultDependencies=no
BindsTo=dev-''PARTITION''.device
After=dev-''PARTITION''.device
BindsTo=dev-mapper-home\x2d''username''.device
Requires=home-''username''.mount
Before=home-''username''.mount
Conflicts=umount.target
Before=umount.target

[Service]
Type=oneshot
RemainAfterExit=yes
TimeoutSec=0
ExecStop=/usr/bin/cryptsetup close home-''username''

[Install]
RequiredBy=dev-mapper-home\x2d''username''.device

gollark: Prove it mathematically via mathematics.

gollark: Why ever not?

gollark: I see; this has been apiobeeized into reality.

gollark: True.

gollark: And I can influence its RNG via apiohax™.

This article is issued from Archlinux. The text is licensed under Creative Commons - Attribution - Sharealike. Additional terms may apply for the media files.