Tell me more ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.
up vote 6 down vote favorite

How do I set up an encrypted swap file (not partition) in Linux? Is it even possible? All the guides I've found talk about encrypted swap partitions, but I don't have a swap partition, and I'd rather not have to repartition my disk.

I don't need suspend-to-disk support, so I'd like to use a random key on each boot.

I'm already using a TrueCrypt file-hosted volume for my data, but I don't want to put my swap in that volume. I'm not set on using TrueCrypt for the swap file if there's a better solution.

I'm using Arch Linux with the default kernel, if that matters.

share|improve this question
What exactly would be the point of that? It would have to be decrypted while using it, and it would be empty when not in use. – tkbx Feb 12 at 16:51
When you search for encrypted swapfile the first result leads to rayslinux.blogspot.de/2011/01/… – ott-- Feb 12 at 17:12
@ott, despite saying "swap file" in the title, if you read the directions in that post they're clearly describing a swap partition. – cjm Feb 12 at 17:16
@tkbx, the point is to prevent someone from recovering sensitive data from the swap file after I've turned my computer off. (Or someone has been unable to guess my password, so they're rebooting into a live CD or such.) – cjm Feb 12 at 17:18
2  
@tkbx, I don't believe so. That would require writing gigabytes of data every time you turn your computer off. The data in a swap file is not used when you reboot, but that doesn't mean it's erased from the disk. – cjm Feb 12 at 17:29
show 6 more comments

1 Answer

up vote 5 down vote accepted

Indeed, the page describes setting up a partition, but it's similar for a swapfile:

dd if=/dev/urandom of=swapfile.crypt bs=1M count=64
loop=$(losetup -f)
losetup ${loop} swapfile.crypt
cryptsetup open --type plain --key-file /dev/urandom ${loop} swapfile
mkswap /dev/mapper/swapfile
swapon /dev/mapper/swapfile

The result:

# swapon -s
Filename                                Type            Size    Used    Priority
/dev/mapper/swap0                       partition       4000176 0       -1
/dev/mapper/swap1                       partition       2000084 0       -2
/dev/mapper/swapfile                    partition       65528   0       -3

swap0 and swap1 are real partitions.

share|improve this answer
loop-AES.README says in section 7.1: "File backed loops can't be used for swap." Is that untrue (or only true for loop-AES)? – cjm Feb 12 at 21:18
That is without device mapper. – ott-- Feb 12 at 21:32
I revised your cryptsetup command to use open instead of create (which the manpage says is obsolete), and to use a random key instead of prompting for a password. It seems to be working. – cjm Feb 12 at 22:15

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.