Encrypting /etc directory

Question

I would like to be able to encrypt the /etc directory so that it can't be accessed without a password. How would I go about doing that? I want my Ubuntu Server to be able to access everything in that directory so that it can use all the packages without any problems but if somebody tries to access that directory to look at the configurations they will need a password. Will encryption stop Ubuntu from being able to run the packages on boot?

Answer 1

One choice would be to use an overlay filesystem for the /etc directory. More exactly:

Assuming you want to encrypt the /etc folder only when the disk is accessed offline (because online you would definitely need it):

• one choice would be to have another partition for the /etc folder;
• then, encrypt/decrypt this entire partition using LUKS.

If you want more, you can encrypt the whole filesystem using LUKS or TPM.

If you want to prevent also changing the content inside the /etc folder:

• then use the overlay on the /etc folder as described here, but for the /etc mountpoint: Example OverlayFS Usage

Here's some Ubuntu tutorial for this (adapt it to your situation): https://help.ubuntu.com/community/Full_Disk_Encryption_Howto_2019

success!...