I have Gentoo Linux installed on a 25.93GB/62.43GB partition /dev/sda4. The other partitions on the disk are 150MB /boot on /dev/sda1 and 56,66GB unused space on other two partitions.

I am planning to encrypt the unused space with dm-crypt, format it to ext4 and after migrating my installation onto it, to nuke the old partition. My questions here are:

  • Is this possible at all? Or would it require many tweaks to get the installation running on the encrypted volume /dev/sda2?

  • Is this an efficient way? Taking into consideration my 25.9GB Gentoo, would it be less hassle for me if I just encrypted the whole disk and installed Gentoo(and all the packages) again?

  • Should I use encfs or ecryptfs instead of dm-crypt here? Would they provide equal security?

  • What algorithm should I use to encrypt the partition? My processor does not have AES-NI.

  • What should I use to sync the encrypted partition with the other one? Would something like dcfldd work for that?

Edit being written from migrated partition:

  • After deleting the unused partitions and making a new unformatted /dev/sda2, I ran :

    cryptsetup luksFormat /dev/sda2
    cryptsetup luksOpen /dev/sda2 encrypt
    pv /dev/zero > /dev/mapper/encrypt

    pv here is used to monitor the progress of writing zeroes, and after this I formatted the encrypted partition to ext4 with mkfs.ext4 /dev/mapper/encrypt.

  • To sync the partitions, I used YoMismo's recommendation rsync after booting the PC from a live USB. It didn't let me in with chroot though, I had to reboot my old partition and chroot from there instead. I ran in this process:

    mkdir /tmp/old_partition /tmp/new_encrypt
    mount /dev/sda4 /tmp/old_partition
    mount /dev/mapper/encrypt /tmp/new_encrypt
    cd /tmp/new_encrypt
    rsync -av /tmp/old_partition/* .

    and after rebooting the old partition /dev/sda4, opening and mounting /dev/sda2 and mounting virtual kernel filesystems:

  • I made an /etc/crypttab with root UUID=<uuid of /dev/sda2> none luks

  • I altered /etc/fstab to tell my root partition is UUID=<uuid of mapper>.
  • I altered /boot/grub/grub.conf : I deleted root=<root> on the end of kernel line, and set a crypted device with crypt_root=UUID=<uuid> root=/dev/mapper/root.
  • I ran genkernel --install --luks initramfs to make new initramfs with luks support.

Now I can boot and run it, the only thing left is setting the old partition on fire.


1.- Yes it is possible but you will have to do some tweaking.

2.- You can't encrypt the whole disk, at least boot partition must be unencrypted if you want your system to start (someone has to ask for the decryption password -initrd- and you need it unencrypted).

3.- encfs has some flaws, you can read about them here. I would use dm-crypt for the job.

4.- Can't help, maybe twofish?

5.- I would use a live CD/USB to do the job. I don't know if the space you have left is enought for the data on the other partitions, if it is (the partition is not full) I would:

  • First you need to decide what kind of partition scheme you want. I will assume you only want /, /boot and swap. So /boot doesn't need to be messed with, I will also assume the space left in the unused partition is enough for the data you want to place in the encrypted partition (/ in this case).
  • Start your system with the life CD.
  • Assuming your destination partition is /dev/sdc1 do cryptsetup luksFormat /dev/sdc1 you will be asked for the encryption password. After that open the encrypted partition cryptsetup luksOpen /dev/sdc1 Enc write all zeros to it dd if=/dev/zero of=/dev/mapper/Enc and create the filesystem mkfs.ext4 /dev/mapper/Enc
  • Now mount your partition, copy files and change root to the new partition.

mkdir /tmp/O /tmp/D

mount /dev/sda4 /tmp/O

mount /dev/mapper/Enc /tmp/D

cd /tmp/D;rsync -av /tmp/O/* .

mount --bind /dev dev

mount --bind /proc proc

mount --bind /proc/sys sys

mount --bind /sys sys

chroot /tmp/D

mount /dev/sda1 /boot

-Use blkid to identify your partitions UUIDs and use that information to modify grub configuration files and your fstab (root partition device should be /dev/mapper/root_crypt). Modify your /etc/crypttab so that the new encrypted partition is referenced there. Create a line like root_crypt UUID=your/encrypted/dev/uuid none luks. grub-update grub-install to where your grub must be and update-initramfs so that the new changes are updated in your initrd.

If I haven't missed anything you should now be ready to go unless you are worried about your swap partition, if you are and want to be able to resume from hybernation the you will have to follow the previous steps for encrypting swap partition and mkswap instead mkfs.ext4. You will also need to add the swap partition to the /etc/crypttab modify fstab so that /dev/mapper/name_swap_you_created_in_etc_crypttab is the device for the swap partition and update-initramfs.

  • 2
    Actually, one can use an encrypted /boot partition (on UEFI based systems, at least, though I do think it has to be separate from the whole / partition) with GRUB2 – hanetzer Oct 10 '15 at 2:53
  • Encrypted /boot partition also works without UEFI, but you need to enter your decryption password twice. BTDT, and migrated back to an unencrypted /boot partition. – Axel Beckert Apr 11 at 20:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.