When you want to use hibernation and you care for security, you'd like to have the swap encrypted. But not with the random password, chosen for you at startup, but with a fixed one, supplied by you at the boot time, so the hibernated state would be available for resuming upon next boot.
There was a cool way to do this, that worked up until Mint 15: How to: get the whole system encrypted
This doesn't work anymore on Petra. Can anyone help me with working it out? The main culprit, the /usr/share/initramfs-tools/scripts/local-top
script didn't change, so I guess it has something to do with the kernel. It looks like the recent kernel just ignores all the scirpt, or at least the part that asks for a password for swap.
Oh, and I was able to get the password prompt, when I accidentally booted the Mint 16 with the kernel from Mint 15.
See also a related question:
How to ask for a password to mount crypted swap at boot time on Linux Mint 16 with initramfs-tools?
Some debug info
After opening the swap device with sudo cryptsetup luksOpen /dev/sda5 cryptswap
:
sudo lsblk -o name,uuid
NAME UUID
sda
├─sda1 F251-38C0
├─sda2 c66b8e51-dd1b-4d92-8605-a3ba7df6af83
├─sda3 77af32db-038d-4c10-b302-039634cf943a
├─sda4 7a3cde35-ab80-4618-ad76-7aa064d55f56
├─sda5 fc068dd2-759c-4779-b521-c73cc5499e86
│ └─cryptswap (dm-1) 964eafeb-c88b-49c8-8b5e-6f8395e040b4
├─sda6 926fa7cc-6f97-4672-85a7-a1ed8f5bd842
├─sda7 804b9c88-907b-43d9-b23f-964c32ecc2ac
└─sda8 ce2cd926-133f-4e20-86f8-45bc4844271c
└─adama-docs (dm-0) 61a32b98-3b65-4af6-81ff-da090cae039f
sr0
cat /etc/crypttab
#cryptswap1 /dev/sda5 /dev/urandom swap,cipher=aes-cbc-essiv:sha256
swap UUID=fc068dd2-759c-4779-b521-c73cc5499e86 none luks
cat /etc/fstab
UUID=926fa7cc-6f97-4672-85a7-a1ed8f5bd842 / btrfs defaults,subvol=@,compress,autodefrag 0 1
# /boot was on /dev/sda2 during installation
UUID=c66b8e51-dd1b-4d92-8605-a3ba7df6af83 /boot ext3 defaults 0 2
# /boot/efi was on /dev/sda1 during installation
UUID=F251-38C0 /boot/efi vfat defaults 0 1
# /home was on /dev/sda6 during installation
UUID=926fa7cc-6f97-4672-85a7-a1ed8f5bd842 /home btrfs defaults,subvol=@home 0 2
# /mnt/ext4 was on /dev/sda7 during installation
UUID=804b9c88-907b-43d9-b23f-964c32ecc2ac /mnt/ext4 ext4 defaults 0 0
# swap was on /dev/sda5 during installation
UUID=964eafeb-c88b-49c8-8b5e-6f8395e040b4 none swap sw 0 0
/etc/initramfs-tools/conf.d/resume
RESUME=/dev/disk/by-uuid/964eafeb-c88b-49c8-8b5e-6f8395e040b4
update:
When I setup everything like above, the system does display the familiar password prompt. It doesn't do that every time, and if it does, it is a fraction of second before the login screen (Linux Mint uses mdm for login). I guess there is racing condition; the mounting of swap is done parallel with the system booting; I expect the system to wait booting until the swap is mounted, and do it as early as possible. Otherwise how could it resume the hibernated state?
There is a similar question for Ubuntu: https://askubuntu.com/questions/396136/encrypted-home-partition-encrypted-swap-working-hibernate It seems, that it worked for someone if he encrypted the root as well.