2

I'm planning a fresh debian install on my notebook and want to have full disk encryption. But I mainly hibernate, which is why I want my swap to be encrypted as well.

During the graphical expert install debian (just as other os's) offers to set up encrypted LVM. Does this encrypt my Swap partition, or are additional steps necessairy to accomplish this? And if so, when I hibernate, will it automatically encrypt the disk (including swap) and then decrypt, after i entered my password again on boot?

Screenshot of the encrypted LVM option

  • You are aware you can't encrypt the whole disk, right? At least boot partition must be unencrypted, otherwise you won't be able to boot. – YoMismo May 20 '15 at 11:47
5

If you choose the "use entire disk and set up encrypted LVM" it will crypt your swap. But, you can do as I did, manually. Doing it this way you can do whatever you want with your partitions and have more control over the process:

1) First, during the installation, at the partition disks step, choose "manual" mode.

2) Then create a new primary partition with a size of 1 GB, approximately. Set /boot as a mount point and make it bootable. It will be your boot partition.

3) Choose the option "configure encrypted volumes" then -> "create encrypted volumes", choose all the free space remaining on your hdd and press "continue". Choose your encryption type, and if you want to erase all the data before installing debian, set "erase data" to "yes", else, to "no". Then done setting the partition and select "finish" (you will be asked to set password to lock the disk).

4) Now choose "Configure the logical manager" -> create volume group -> enter the volume group name and then choose your recently encrypted partition (it may be something like /dev/mapper/sda5_crypt).

5) Now you can create local volumes. Choose "create logical volume", and start creating the volumes you need (swap, home, root). When you finish, press "Finish".

6) And now set the file systems and the mount points to the volumes that you've created (The ones that appears in blocks with LVM tags).

And done. You have encrypted all your device included the swap, and, hibernate function will work.

If you want I can dedicate it time and make a detailed manual and post it here.

2

Yes, it encrypts the swap partition with no extra effort. Yes, when you hibernate, will it automatically encrypt the disk, including swap (but not the boot partition). Yes, when you start again from hibernation, it prompts for the decryption pass phrase (but not for the account password). You get an unencrypted boot partition, and the rest of the disk is LVM and encrypted.

Are you also installing the default DE, Gnome 3? Well, then, there's a need to Use Tweak Tool's Power Options to configure what happens when the lid is shut. Otherwise, if you want a hibernation option on a menu, then more configuration is needed. I had good luck following this guide, except that the alternative status menu didn't work for me. This is a repost of that guide:

Activate Hibernation

  • Install s2disk: aptitude install uswsusp
  • Configure uswsusp: dpkg-reconfigure uswsusp (default options should be ok)

Get Suspend/Hibernation options on Gnome3 Status Bar

  • Install the Gnome3 Extension: Alternative Status Menu
  • Install systemd-shim: aptitude install systemd-shim

(This gets rid of the following Gnome3 bug 729576: dbus[2301]: [system] Activated service 'org.freedesktop.systemd1' failed: Launch helper exited with unknown return code 1)

Restart gnome3: ALT + F2 Enter the command: r

By now, you should be able to:

  • Execute s2disk as root (sudo s2disk)
  • Click on Hibernate from the Gnome3 Status Bar (top right of the screen)

Troubleshooting

If you have still trouble at this point, please refer to the following links:

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.