1. Purpose

This document is for you if you wish to use full-disk encryption with all of these features:

• LUKS
• LVM
• encrypted Boot
• manual partitioning
• encrypted hibernation (optional)

• hybrid suspend (optional) *&*

• dual-booting (optional)
• multi-disk installation (optional)

As LVM is used, you can also use snapshots. This advanced topic is not covered here, but it is mentioned in the partitioning section.

2. Caveats

It is important for you to know the possible limitations (described in the Background) and the potential problems.

• Always, when you install a system, there is a chance of data loss.

  • If the power fails during the installation, you can restart from the beginning or (depending on when the failure occurred) a checkpoint.
  • No matter how careful you are, sometimes a person makes a silly mistake. For example, you accidentally delete the Windows partition.

  Therefore, take a full backup of all your data before you start the process. If you know how to use CloneZilla, you would be well advised to back up your entire disk beforehand.

• The process optionally enables hibernation. While this should work well, some people have reported hardware that doesn't support it. So, you will need to test this on your machine after installation.

• A consequence of full-disk encryption is that you need to type in a password or passphrase each time you power on your computer.

  • If you share your computer with anyone else, they need to know the passphrase, even if they only use Windows.

  • You need a strong passphrase to prevent a hacker with physical access to your machine from breaking the encryption. You can look up "strong passphrase" for yourself; here's a pretty good method for paranoid mode.

• Having a strong passphrase does not obviate the need for a good account password.

  • If you leave your computer unattended while powered on, you must lock it, otherwise anyone with physical access can access your account. This includes installing malware such as a keylogger.
  • Without a password, a hacker (even without physical access) can access your account and install malware.

3. Organisation

Because the default Ubuntu Installer supports only the first two of the above-mentioned features (LUKS and LVM), this installation process is rather more complicated than one would like. Thus, this document is organised into several categories. They are intended to be read in this order.

1. Background
   A summary of the options; features; pros and cons; and purpose and limitations.

2. Basics of entering commands, partitioning, LUKS and LVM
   If you are new to Linux, or you don't know much about some or all of these, this section is for you. You can safely skip it if you already understand the concepts.

3. High-level overview
   What this process will achieve, and what you need to do to prepare.

4. Detailed process
   Exactly how to prepare your system and install Ubuntu with encryption. Checkpoints are given along the way. It takes into account dual-booting and, optionally, paranoid mode.

5. Troubleshooting
   Sometimes something goes wrong and you struggle to figure out what. Messages and errors can seem bewildering, so here are some pointers.