# BEGIN GENTOO EXAMPLES FOR ENCRYPTED HOME

# user1 has an encrypted home that uses his/her system passwd as the

# encryption key

# To create a USB dongle secured user see user2:

# Define a user key and group key to use a USB dongle as an encrypted

# file system for the key to the user2 file system - so user would need

# the USB dongle, the password for user key and the password for user

# user2. in order to access the encrypted home of user2. Note that

# without the first two the user can still log in and create files

# on his home directory mount point. However the security for the

# encrypted volume is much better since a dictionary attack would need

# the dongle. See http://www.counterpane.com/twofish-final.html

# for a discussion on why twofish is a good choice. This setup works

# with mm-sources-2.6.0_beta9-r5. So to login graphically as user2

# insert key, ctrl-alt-f1 login as key, alt-f7, login as user2,

# ctrl-alt-f1, logout key, remove dongle. This works for KDM. Modify

# /etc/pam.d/login and /etc/pam.d/kde per docs

#volume key local - /dev/sda2 /key loop,encryption=twofish - -

#volume user1 local - /home/.user1 /home/user1 loop,encryption=twofish - -

#volume user2 local - /home/.user2 - - bf-ecb /key/sp.key

# /etc/fstab contains

#/home/.user2  /home/user2  reiserfs    user,loop,encryption=twofish,noauto     0 0

#/dev/sda2     /key         ext2        user,loop,encryption=twofish,noauto     0 0

#

# Device-Mapper based encryption (dm-crypt)

# Since the introduction of dm-crypt in Linux 2.6.4, cryptoloop has been

# deprecated. To use the new dm-crypt interface, you will have to adapt

# the preceding examples to use "crypt" instead of "local" as filesystem

# type. Additionally the cipher algorithm is specified via the "cipher"

# option (to distinguish from cryptoloop's "encryption"). Thus, the

# user1 example would look like this:

#volume user1 crypt - /home/.user1 /home/user1 loop,cipher=twofish - -

# An entry in /etc/fstab is not needed. A detailed HOWTO can be found in

# the forums: http://forums.gentoo.org/viewtopic.php?t=274651

# Note that pam_mount is LUKS (http://luks.endorphin.org) aware. To

# use luks, you need to have cryptsetup-luks (get it at 

# http://luks.endorphin.org/dm-cryp) installed. A config line would be

#volume user1 crypt - /dev/yourpartition /yourmountpoint - - -

# and cryptsetup will be told to read cypher/keysize/etc. from the luks-header.

# END GENTOO EXAMPLES