=== home directory encryption on netbsd with cgd and vnd === Sep 19 2026

firstly you're going to logout of your current user and login as root

	$ exit
	login: root
	password:

once you're logged in as root, move your current home directory to a different one. instead of $USER you're going to type the username of your account.

	# mv /home/$USER /mnt
	
in the example above we moved our home directory to /mnt. this is of course temporary as we will remove that directory once we're done.

go to /home and create a virtual disk image with the dd command. the size of the disk image should be most of your disk space leaving your root with around 90gb to spare. root does not require much space, 60gb should be fine aswell but 90gb is a safe size. the command below assumes your disk space is 500gb, if the size is different then adjust the seek option appropriately.

	# cd /home
	# dd if=/dev/zero of=/home/$USER.img bs=1g count=0 seek=410

once the command finishes you should have a $USER.img file in /home

	# ls /home
	$USER.img

attach the image to vnd0

	# vnconfig vnd0 /home/$USER.img
	
create cgd encryption parameters and configure the encryption device

	# cgdconfig -g -o /etc/cgd/$USER aes-xts 256
	# cgdconfig cgd0 /dev/vnd0d /etc/cgd/$USER

format the device with FFSv2

	# newfs -O 2 /dev/rcgd0a
	
create a new directory for your user in /home

	# pwd
	/home
	# mkdir $USER
	# mount /dev/cgd0a /home/$USER

verify the device is mounted

	# df -h
	/dev/cgd0a     413G   9,0G   384G   3% /home/$USER

copy the files from old home to the new encrypted one, remember that we moved the old home directory to /mnt

	# mv /mnt/$USER/* /home/$USER

also don't forget to copy hidden files and directories

	# mv /mnt/$USER/.* /home/$USER

once your done, verify that everything has been moved

	# ls -a /mnt/$USER
	./
	../

once you verified everything has been moved, it's safe to remove this directory since there's no need for it anymore

	# pwd
	/mnt
	# rmdir $USER

=== automatic decryption and mounting ===

when you boot up your system you'd want to be prompted to enter the password to decrypt the home device and it to be mounted automatically. to do that create a shell script that does that in /etc/rc.d

	# cd /etc/rc.d
	# touch mountcrypt
	# chmod +x mountcrypt

mountcrypt is the name I've chosen for the script, you can choose any name you want

open the file with your preffered text editor, the script should look something like this

	#!/bin/sh
	vndconfig vnd0 /home/$USER.img
	cgdconfig cgd0 /dev/vnd0d /etc/cgd/$USER
	mount /dev/cgd0a /home/$USER

reboot the system, if you've done everything correctly it should prompt you for the password and mount the encrypted device in your $HOME.

note that if you enter the wrong password it's going to give you an error about bad super blocks. bad super blocks usually mean that the file system is corrupted but in this case the device just hasn't been decrypted and mount can't find the file system. if that happens just reboot and try again.