47.2. Using Encrypted Home Directories

SUSE Linux Documentation Chapter 47. Encrypting Partitions and Files / 47.2. Using Encrypted Home Directories
	Chapter 47. Encrypting Partitions and Files		47.3. Using vi to Encrypt Single Files

To protect data in home directories against theft and hard disk removal, create encrypted home directories for users. These are encrypted with LUKS, which results in an image and an image key generated for the user. The image key is protected with the user's login password. By default, the image and the image key are located in the respective user's home directory. The key can also be located anywhere in the file system—for example, on a removable device that can be mounted manually. To make use of this, specify a persistent device name in the Fstab Options when setting up the device with the YaST expert partitioner.

Use the YaST user management module or the cryptconfig command line tool to enable encryption of home directories. You can create encrypted home directories for new or existing users. To encrypt or modify encrypted home directories of already existing users, enter the user's current login password.

Security Restrictions

	Security Restrictions
Encrypting a user's home directory does not provide strong security from other users. If strong security is required, the system should not be physically shared. To enhance security, also encrypt the `swap` partition, `/tmp`, and `/var/tmp`, because these can contain temporary images of critical data.

Encrypting a user's home directory does not provide strong security from other users. If strong security is required, the system should not be physically shared.

To enhance security, also encrypt the swap partition, /tmp, and /var/tmp, because these can contain temporary images of critical data.

You can encrypt swap, /tmp, and /var/tmp with the YaST partitioner as described in Section 47.1.1, “Creating an Encrypted Partition during Installation” and Section 47.1.3, “Creating an Encrypted File as a Container”. In addition to the options YaST offers, you can use the cryptconfig command line tool for some special tasks.

For example, as a safety for users that may lose their key files, you can create and add an additional key to the image.

Log in to a shell as root.
Run
```
cryptconfig create-key admin.key
```
to create a key for administrators.
To create an encrypted home directory for user tux and to add the administration key to it, enter
```
cryptconfig make-ehd –extra-key-file=admin.key tux 200
```
This creates a home directory with the initial size of 200 MB.
To change the size of the home directory at any time, use
```
cryptconfig enlarge-size image size_to_add_in_MB
```

For more information about the command line tool, run cryptconfig --help to view a list of options available.