2

I want to use a swap drive that is encrypted by a random key on boot. I'm not sure if I am doing it safely, though.

I currently have /etc/crypttab based off of the example on arch wiki. Unlike their article, I got my swap's UUID from mkswap. It wouldn't allow me to put my swap in the unallocated space past a 1MB ext2 partition, as was shown in the arch wiki example. I'm a bit wary of the arch wiki example because of this.

My current crypttab is:

cryptswap UUID=... /dev/urandom swap,cipher=aes-cbc-essiv:sha256,size=256,offset=2048

Is this the proper way to set up an encrypted swap? I'm not sure how offset behaves if it tries to write to the last 1MB of the drive.

Probably worth noting that I'm doing all of this in a VM to test, before doing this on my hardware.

update:

this is the error message that shows up when I try to use an ext2 formatted drive, doing it exactly as shown in the arch tutorial:

    sudo /etc/init.d/cryptdisks reload
[ ok ] Stopping remaining crypto disks...cryptswap (stopped)...done.
[....] Starting remaining crypto disks...[info] cryptswap (starting)...
[....] cryptswap: the precheck for '/dev/disk/by-label/cryptswap' failed: - The [warne /dev/disk/by-label/cryptswap contains a filesystem type ext2. ... (warning).
[FAILswap (failed)...failed.
  • So it's the precheck, this probably doesn't exist in ArchLinux; updated my answer. – frostschutz Mar 20 '16 at 18:41
2

Unlike their article, I got my swap's UUID from mkswap.

That's probably not such a good idea. If you have an unencrypted swap header on a device, and use the same device for encrypted swap at 1 MiB offset, if for whatever reason you activate both swap partitions, the swaps would overwrite each others data as it's the same device.

This ambiguity does not exist with the 1MB ext2 partition - because the ext2 is limited to 1MB, even if you use it (mount it, write to it, ...) it would still be safe and not write stuff into the area used by the encrypted swap. The only dangerous operation here would be resize2fs.

It wouldn't allow me to put my swap in the unallocated space past a 1MB ext2 partition, as was shown in the arch wiki example.

In the end, Debian and ArchLinux are different so their solution might not necessarily work for you. If it's GPT you could probably get away with using PARTUUID instead of UUID. Only, if you ever want to use the partition for something else, you should delete the partition and create a new partition (with a new PARTUUID) so next time you reboot it won't be inadvertently formatted again as swap...

If you want more specific help in this direction maybe you should elaborate more on error messages and such... I'm guessing in Debian there is a filter script that rejects things that look like filesystems to avoid a data loss situation. You could probably disable it by adding precheck=/bin/true.

This cryptswap is really dangerous (in terms of formatting the wrong device by accident), if possible, avoid it completely. Using proper encryption with a LUKS header is much safer even if it means having to type another passphrase.

I'm not sure how offset behaves if it tries to write to the last 1MB of the drive.

There is no problem, offset just results in a smaller device mapping. So if you have a 1000MiB partition and use a plain crypttab mapping with offset 1MiB, the resulting crypt device is 999MiB in size.

  • I took the old swap entry out of fstab, so it shouldn't be able to activate both at once. Also, what's the difference between PARTUUID and UUID? – Bobby Sacamano Mar 20 '16 at 18:33
  • @BobbySacamano if you're sure that's okay, but unfortunately there is so much magic around nowadays particularly on a desktop system, things just happen without you knowing. PARTUUID/PARTLABEL is a feature of GPT partition table, it provides UUID and LABEL regardless of partition contents. – frostschutz Mar 20 '16 at 18:35
  • 1
    Looks like adding precheck=/bin/true worked. I'm going to look into LUKS though. It's probably worth the extra effort, to not accidentally reformat a drive. – Bobby Sacamano Mar 20 '16 at 19:09
  • I just noticed, mkswap also has an optional size parameter the same way mkfs.ext2 does. So you can make a "swap" partition only 1MiB in size and put the encrypted swap behind that and have no issue (other than unencrypted swap leaks) if it's activated by accident. – frostschutz Mar 20 '16 at 19:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.