1

I'm looking for a method to encrypt my laptop including the swap partition. I also read trough older similar questions but mostly the answer included just a what not much of a how. (Currently I'm working on a 128GB SSD & Debian Jessie)

My aim is to have

  • a state of the art encryption
  • fully encrypted disk (including swap)
  • a single password on boot for decryption
  • automatic encryption on hibernate/suspend

nice to have would also be a second password to boot to a second valid OS for plausible deniability.

1

These points are all resolved by the default installer if you choose full-disk encryption:

  • a state of the art encryption
  • fully encrypted disk (including swap)
  • a single password on boot for decryption
  • automatic encryption on hibernate/suspend

There are two partitions: /boot/ (sda1) is not encrypted, sda2 will be encrypted, an LVM group will be formed out of the created device, and this LVM group will then be split into /, /home/ and the swap partition. This swap partition will then also be used for hibernation. Using just a single encrypted partition makes the necessity for only one password, at boot or resume time, trivial.

Unfortunately I could not find any documentation of this on the Debian wiki, but Archlinux has this article.

a second password to boot to a second valid OS for plausible deniability.

I do not know of a Linux solution for this. And no real solution anywhere that makes the denying look really plausible (in the sense that the "fake" system should look as if it was regularly used); but that part would rather belong to security.stackexchange, IMHO.

0

Only partial answer, but too long for comment:

  • state-of-the-art encryption: LUKS with a reasonably long key-size

  • full disk encryption: dm-crypt with LUKS

  • single password on login: If it is okay to have /boot unencrypted use crypttab, auto login to virtual console and start X at boot.

  • I've never tried swap encryption, hibernation nor plausible deniablity.

You're asking quite much with your single question. I suggest you go on and try some of the tutorials available online and then come back to ask more specific questions. E.g. start by encrypting your home partition, then swap, then boot password.

Always back up your data!
  • 1
    thank you for the answer.. I already thought that the quesiton may include too many requirements/statements, but if I had asked them seperately I wouldn't have the certainty the single solutions would work together.. nevertheless I'll get some info about LUKS, dm-crypt and crypttab! – Daedalus Mythos Sep 10 '14 at 7:19
  • perhaps other can add information on the topics I couldn't comment. I have a Arch Linux background, so I can recommend the Arch wiki on these topics. Since debian also uses systemd, the steps are very similar. – Sebastian Sep 10 '14 at 7:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.