I want to boot the Linux from the /boot partition, and also want to encrypt this /boot partition.

[ AFAIK, Grub is unable to find the kernel and initrd from an truecrypted partition or cryptsetup encrypted boot partition. ]

Is there any way to do so ?

  • Just one remark -- encrypting entire system except /boot is supported by default. This means, that if you fall into problem with your system, you probably fix it easier than in case with /boot encrypted as well. – greenoldman Apr 20 '11 at 5:07

Yes, using Grub2 you can do this: It has been patched to support not only AES, Twofish, Serpent and CAST5 encryption, but a number of hashing routines such as SHA1, SHA256, SHA512, and RIPEMD160. There is also support for the LUKS on-disk encryption format.

Check out this xercestech post for a full manual walkthrough, but in a nutshell everything is encrypted except for the actual bootloader, which you could have on a USB stick if you really wanted to stay safe.

The LUKS patches to support grub are here.

  • Thanks Rory.... I will follow the tutorial and will give you feedback. BTW, the link is broken, it seems. If you have the michael.gorven.za.net/bzr/grub/luks., please do share with us. – SHW Apr 20 '11 at 5:40
  • Trim the period off the end of that URL and it will work. – isuldor Nov 25 '13 at 5:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.