Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How do I set up an encrypted swap file (not partition) in Linux? Is it even possible? All the guides I've found talk about encrypted swap partitions, but I don't have a swap partition, and I'd rather not have to repartition my disk.

I don't need suspend-to-disk support, so I'd like to use a random key on each boot.

I'm already using a TrueCrypt file-hosted volume for my data, but I don't want to put my swap in that volume. I'm not set on using TrueCrypt for the swap file if there's a better solution.

I'm using Arch Linux with the default kernel, if that matters.

share|improve this question
What exactly would be the point of that? It would have to be decrypted while using it, and it would be empty when not in use. – tkbx Feb 12 '13 at 16:51
When you search for encrypted swapfile the first result leads to rayslinux.blogspot.de/2011/01/… – ott-- Feb 12 '13 at 17:12
@ott, despite saying "swap file" in the title, if you read the directions in that post they're clearly describing a swap partition. – cjm Feb 12 '13 at 17:16
@tkbx, the point is to prevent someone from recovering sensitive data from the swap file after I've turned my computer off. (Or someone has been unable to guess my password, so they're rebooting into a live CD or such.) – cjm Feb 12 '13 at 17:18
@tkbx, I don't believe so. That would require writing gigabytes of data every time you turn your computer off. The data in a swap file is not used when you reboot, but that doesn't mean it's erased from the disk. – cjm Feb 12 '13 at 17:29
up vote 10 down vote accepted

Indeed, the page describes setting up a partition, but it's similar for a swapfile:

dd if=/dev/urandom of=swapfile.crypt bs=1M count=64
loop=$(losetup -f)
losetup ${loop} swapfile.crypt
cryptsetup open --type plain --key-file /dev/urandom ${loop} swapfile
mkswap /dev/mapper/swapfile
swapon /dev/mapper/swapfile

The result:

# swapon -s
Filename                                Type            Size    Used    Priority
/dev/mapper/swap0                       partition       4000176 0       -1
/dev/mapper/swap1                       partition       2000084 0       -2
/dev/mapper/swapfile                    partition       65528   0       -3

swap0 and swap1 are real partitions.

share|improve this answer
loop-AES.README says in section 7.1: "File backed loops can't be used for swap." Is that untrue (or only true for loop-AES)? – cjm Feb 12 '13 at 21:18
That is without device mapper. – ott-- Feb 12 '13 at 21:32
I revised your cryptsetup command to use open instead of create (which the manpage says is obsolete), and to use a random key instead of prompting for a password. It seems to be working. – cjm Feb 12 '13 at 22:15

This Configuration uses randomly generated keys at boot and will not support Hibernation to hard disk! You Should Disable Hibernation through your respectie DE Power Management Utility and set it to Shutdown on Critical to avoid Data Loss!

Make sure to run sudo -s or su before running the following.

  1. Disable Swap:

    # swapoff -a
  2. Locate the existing Swap Partition

    # lsblk

    You will get something like this:

    sda3    8:3    0     8G  0 part [SWAP]
  3. Overwrite Old Swap

    # dd if=/dev/zero bs=1024000 of=/dev/sda<#>

    for example:

    # dd if=/dev/zero bs=1024000 of=/dev/sda3
  4. fstab setup

    # vim /etc/fstab

    Replace old SWAP device with crypttab mapper name: /dev/mapper/cswap

    #<file system>      <mount point>   <type>  <options>   <dump>  <pass>
    /dev/mapper/cswap   none            swap    pri=1,defaults  0   0
  5. Crypto Setup

    # ls -lF /dev/disk/by-id

    For Example:

    ata-HGST_HTS545050A7E680_TEK55D4F0BU3GV-part3 -> ../../sda3
    # vim /etc/crypttab
    # <name>    <device>                            <password>  <options>
      cswap     /dev/disk/by-id/ata-HGST_HTS545050A7E680_TEK55D4F0BU3GV-part3   /dev/urandom    swap,cipher=aes-cbc-essiv:sha256,size=256
  6. Active Encrypted Swap

    # reboot
  7. Verify Enctypted Swap Operations

    For example:

    # dmsetup -C info 
    cswap      253   0 L--w    2    1      0 CRYPT-PLAIN-cswap  
    # lsblk
    ├─sda3                8:3    0     8G  0 part  
    │ └─cswap             253:0    0     8G  0 crypt [SWAP]
    # cat /proc/swaps 
    Filename                Type        Size    Used    Priority
    /dev/dm-0               partition   8385532 0       -1
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.