Using secondary hard disk drive to extend a specific user home directory¶
Introduction¶
On a machine having two disks (one SSD and one larger traditional
spinning hard disk drive), I
wanted to use the SSD as the “main” disk (i.e. the disk where all files are
installed, including /home) and the spinning disk as an extension of the
home directory of a specific user (which is the only user of the machine).
I also wanted encryption on both disks.
After the run of the Debian installer, the system was entirely installed on the
SSD (device /dev/nvme0n1), and the other drive (device /dev/sda) had an
(empty) ext4 partition in a LUKS
container (/dev/sda1), unused (i.e. not mounted).
Finding the LUKS containers¶
Here are a few commands that make it possible to determine whether a partition is a LUKS container or not.
lsblk is usable by unprivileged users. Example output:
nvme0n1p5 here is a LUKS container, and is opened (unlocked). sda1 is
also a LUKS container but is not currently opened.
The following command (to be run as root):
cryptsetup isLuks -v /dev/sda1 # As root.
outputs “Command successful.” which means that sda1 is a LUKS container.
With the -f switch, lsblk gives more details and makes it easier to
find the LUKS container (but be aware that the output of lsblk is
sensible to terminal width, so you may not always get the same output):
Alternatively, you can use blkid (as root), which outputs something
like:
Unlocking and mounting automatically at boot time¶
This section describes a way to open (unlock) and mount sda1 at boot time.
Obviously, you have to know the passphrase that was provided to the Debian installer. If you want to change it, use (as root):
cryptsetup luksChangeKey /dev/sda1
This is fast and does not imply re-encrypting the whole drive, it just re-encrypts the “master key”.
The passphrase has to be stored somewhere, and the best option may be to store
it a hidden file on the (encrypted) “root” partition, in the home directory of
the root user (/root).
Some people have had difficulties with this (see for example this answer on superuser.com) due to a trailing new line in the file. I made sure to make a file without the trailing new line with a command like:
head -c -1 file_with_trailing_new_line >/root/.keyfile # As root.
Make sure also that the key file cannot be read by any one but the root user:
chmod 600 /root/.keyfile # As root.
The automatic opening of the LUKS container at boot time is achieved by adding
a line (as root) to /etc/crypttab (which probably already exists and
contains a line to open the swap partition container). The line to add is like:
The automatic mounting of the partition that the container contains is achieved
by adding a line (as root) to /etc/fstab. This line specifies the mount
point, make sure to create it (as root):
mkdir /media/extension # As root.
The line to add to /etc/fstab is like:
After a reboot, the spinning disk partition should be mounted on
/media/extension (a cat /etc/mtab should show a line starting with
“/dev/mapper/extension_crypt”).
Setting permissions and creating a symbolic link to the mount point¶
The final steps consist in:
Creating a directory in the mounted partition (the symbolic link we are going to create will point to this directory instead of directly to the mount point, this will make sure the
lost+founddirectory (which exists at the top level of any ext2, ext3 and ext4 partitions) is not visible through the symbolic link).Changing the ownership and permissions of the mount point, to make sure that only the intended user can access the mounted partition (the effect of this is persistent).
Creating a symbolic link in the home directory of the user.
You can do this with commands like:
mkdir /media/extension/data # As root.
chown -R <user>:<user> /media/extension # As root.
chmod -R 700 /media/extension # As root.
cd # As <user>.
ln -s /media/extension/data extension # As <user>.
User <user> has now a home directory extended with the full space available on
the spinning disk. User <user> has access to this space through
~/extension.
