Is encrypting the home directory on an encrypted LVM installation overkill?

Solution 1:

It's overkill for most systems. By "encrypted LVM" you likely mean "LUKS" (Linux Unified Key Setup).

Encrypting the home directory protects you from:

• other users on the same system accessing your files
• data theft when the machine gets stolen / lost

But not from:

• Modification of system settings or files (including binaries) outside the users home directory. In this way, the administrator (or anyone with physical access and a LiveCD) can install a program that copies / modifies the files / settings in your home directory.

Encrypting your system using LUKS (full disk-encryption in the case of the alternative installer):

• data theft when the machine gets stolen / lost
• data integrity: anyone who does not know your LUKS passphrase cannot modify your system settings or files, although you're still not protected against an Evil Maid Attack.

So, if you are the only user of the system, encrypting your home directory does not add significant protection and will only worsen the performance. Neither should you do that if you're sharing your machine with people you can trust and your computer does not contains top-secret information. A final case: if you are sharing the machine and there are multiple operating systems installed on the machine and you're the only one who knows the passphrase, there is still no need to encrypt your home directory.

Solution 2:

Whether or not it's overkill depends on your circumstances. An encrypted home directory will protect your personal data from other users on the system as well as from outside intruders. Additionally, each additional level of encryption makes it more difficult for an attacker to break in. On my backup drive, which has images of client machines, some of which contain credit card and social security numbers, I use entire disk encryption, followed by an encrypted home directory with a different password and a [PPP]: https://www.grc.com/ppp.htm code. For the things with people's personal information, I will additionally stick it inside a TrueCrypt container with cascading encryption. It is probably overkill, but it covers all the bases. Someone who steals my drive is locked out of everything, somebody who somehow hacks the running system is locked out of my files, and somebody who gains console access while I have it backing something up only gets the currently decrypted backup set (Which is most likely their own data.)

Deciding what level you need is largely a matter of discovering what the possible attacks someone would be likely to make against your system and locking them out. Entire disk encryption is probably more than enough for 99% of single-user systems.