Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.
Sign up to join this community
I would like to convert my raid6 mdadm into encrypted LUKS. Right now raid6 consists of "/dev/sdX1" which are raid partitions. /dev/md0 doesn't have a partition - it is pure ext4 FS.
Is it safe to reencrypt (cryptsetup-reencrypt /dev/md0)? Will LUKS add some specific header which could cause data loss/FS corrupt? Or is it safe only when you have partition on top of mdadm (i.e. /dev/md0p1)?
A volume is called a "LUKS volume" because it has a LUKS header. Thus if you convert a non-LUKS volume into a LUKS volume then you do get an additional header and do lose data space.
The LUKS header can be on a differenct device (--header) but I do not know whether cryptsetup-reencrypt supports that. But most probably you want to have the LUKS header within the RAID anyway.
Thus you have to
reduce the file system size by at least 4MiB
run cryptsetup-reencrypt with --new and --reduce-device-size
I suggest that you decrease the file system size by a bit more than the value for --reduce-device-size (which I guess must be 4MiB or more).
You may want to overwrite the gap between the encrypted LUKS data and the end of the device with random data afterwards. But be really careful with that. You should first make a backup (to a different volume, of course) of the blocks you are going to overwrite.
