1. Purpose

This document is for you if you wish to use full system encryption with all of these features:

• LUKS
• LVM
• encrypted Boot
• manual partitioning

and optionally any of these features:

• encrypted hibernation

• hybrid suspend *&*

• dual-booting
• multi-disk installation

As LVM is used, you can also use snapshots. This advanced topic is not covered here, but it is mentioned in the partitioning section.

2. Caveats

It is important for you to know the possible limitations (described in the Background) and the potential problems.

• Always, when you install a system, there is a chance of data loss. No matter how careful you are, sometimes a person makes a silly mistake. For example, you accidentally delete the Windows partition. Or, something else can go wrong (I've had an installation cause data loss because a previously-unused part of the hard drive was faulty and caused it to crash). Therefore:

• The process optionally enables hibernation. While this should work well, some people have reported hardware that doesn't support it. So, you will need to test this on your machine after installation.

• A consequence of full-disk encryption is that you need to type in a password or passphrase each time you power on your computer, including after hibernation.

  • If you share your computer with anyone else, they need to know the passphrase, even if they only use Windows.

  • You need a strong passphrase to prevent a hacker with physical access to your machine from breaking the encryption. You can look up "strong passphrase" for yourself; here's a pretty good method for paranoid mode.

• Having a strong passphrase does not obviate the need for a good account password. Without a password, or with only a weak password:

  • You cannot lock the computer when it is unattended and powered on.
  • Anyone with physical access, or a hacker with Internet access, will find it easy to access your account and steal data or install malware such as a keylogger.

• This process has been tested for a modern computer with EFI (aka UEFI). If your computer doesn't have EFI, the process should still work if you simply omit any instructions relating to it. *&*

3. Document Structure

Because the default Ubuntu Installer supports only the first two of the above-mentioned features (i.e. LUKS and LVM), and even then only for full-disk encryption, this installation process is rather more complicated than you might prefer. Thus, this document is organised into several sections. They are intended to be read in the order given here.

1. Background
   A summary of the options; features; benefits and downsides; and purpose and limitations.

2. Basics of entering commands, partitioning, LUKS, and LVM
   If you are new to Linux, or you don't know much about some or all of these features, this section is for you. You can safely skip it if you are already familiar with the command line, partitioning, LUKS, and using LVM.

3. High-level overview
   What this process will achieve, and what you need to do to prepare. It includes freeing space on your hard drive if your current system has taken it all.

4. Detailed process
   Exactly how to prepare your system and install Ubuntu with encryption. Checkpoints are given along the way. It takes into account dual-booting and, optionally, paranoid mode.

5. Troubleshooting
   Sometimes something goes wrong and you struggle to figure out what. Errors and their messages can seem bewildering. Here are some pointers.