Chapter 6. Using the Ubuntu Installer Erase data: yes Determines whether the content of this partition should be overwritten with random data before setting up the encryption. This is recommended because it might otherwise be possible for an attacker to discern which parts of the partition are in use and which are not. In addition, this will make it harder to recover any leftover data from previous installations$^{7}$. After you have selected the desired parameters for your encrypted partitions, return back to the main partitioning menu. There should now be a new menu item called Configure encrypted volumes . After you select it, you will be asked to confirm the deletion of data on partitions marked to be erased and possibly other actions such as writing a new partition table. For large partitions this might take some time. Next you will be asked to enter a passphrase for partitions configured to use one. Good passphrases should be longer than 8 characters, should be a mixture of letters, numbers and other characters and should not contain common dictionary words or information easily associable with you (such as birthdates, hobbies, pet names, names of family members or relatives, etc.). Before you input any passphrases, you should have made sure that your keyboard is configured cor- rectly and generates the expected characters. If you are unsure, you can switch to the second virtual console and type some text at the prompt. This ensures that you won’t be surprised later, e.g. by try- ing to input a passphrase using a qwerty keyboard layout when you used an azerty layout during the installation. This situation can have several causes. Maybe you switched to another keyboard layout during the installation, or the selected keyboard layout might not have been set up yet when entering the passphrase for the root file system. If you selected to use methods other than a passphrase to create encryption keys, they will be generated now. Because the kernel may not have gathered a sufficient amount of entropy at this early stage of the installation, the process may take a long time. You can help speed up the process by generating entropy: e.g. by pressing random keys, or by switching to the shell on the second virtual console and generating some network and disk traffic (downloading some files, feeding big files into /dev/null , etc.). This will be repeated for each partition to be encrypted. After returning to the main partitioning menu, you will see all encrypted volumes as additional parti- tions which can be configured in the same way as ordinary partitions. The following example shows a volume encrypted via dm-crypt. Now is the time to assign mount points to the volumes and optionally change the file system types if the defaults do not suit you. Pay attention to the identifiers in parentheses ( sda2_crypt in this case) and the mount points you assigned to each encrypted volume. You will need this information later when booting the new system. The differences between the ordinary boot process and the boot process with encryption involved will be covered later in Section 7.2. Once you are satisfied with the partitioning scheme, continue with the installation. 7. It is believed that the guys from three-letter agencies can restore the data even after several rewrites of the magnetooptical media, though. 61 Warning Encrypted volume ( sda2_crypt ) - 115.1 GB Linux device-mapper #1 115.1 GB F ext3