Setting up encrypted swap in LMDE (debian)

Question

I want to use a swap drive that is encrypted by a random key on boot. I'm not sure if I am doing it safely, though.

I currently have /etc/crypttab based off of the example on arch wiki. Unlike their article, I got my swap's UUID from mkswap. It wouldn't allow me to put my swap in the unallocated space past a 1MB ext2 partition, as was shown in the arch wiki example. I'm a bit wary of the arch wiki example because of this.

My current crypttab is:

cryptswap UUID=... /dev/urandom swap,cipher=aes-cbc-essiv:sha256,size=256,offset=2048

Is this the proper way to set up an encrypted swap? I'm not sure how offset behaves if it tries to write to the last 1MB of the drive.

Probably worth noting that I'm doing all of this in a VM to test, before doing this on my hardware.

update:

this is the error message that shows up when I try to use an ext2 formatted drive, doing it exactly as shown in the arch tutorial:

    sudo /etc/init.d/cryptdisks reload
[ ok ] Stopping remaining crypto disks...cryptswap (stopped)...done.
[....] Starting remaining crypto disks...[info] cryptswap (starting)...
[....] cryptswap: the precheck for '/dev/disk/by-label/cryptswap' failed: - The [warne /dev/disk/by-label/cryptswap contains a filesystem type ext2. ... (warning).
[FAILswap (failed)...failed.

Answer 1

Unlike their article, I got my swap's UUID from mkswap.

That's probably not such a good idea. If you have an unencrypted swap header on a device, and use the same device for encrypted swap at 1 MiB offset, if for whatever reason you activate both swap partitions, the swaps would overwrite each others data as it's the same device.

This ambiguity does not exist with the 1MB ext2 partition - because the ext2 is limited to 1MB, even if you use it (mount it, write to it, ...) it would still be safe and not write stuff into the area used by the encrypted swap. The only dangerous operation here would be resize2fs.

It wouldn't allow me to put my swap in the unallocated space past a 1MB ext2 partition, as was shown in the arch wiki example.

In the end, Debian and ArchLinux are different so their solution might not necessarily work for you. If it's GPT you could probably get away with using PARTUUID instead of UUID. Only, if you ever want to use the partition for something else, you should delete the partition and create a new partition (with a new PARTUUID) so next time you reboot it won't be inadvertently formatted again as swap...

If you want more specific help in this direction maybe you should elaborate more on error messages and such... I'm guessing in Debian there is a filter script that rejects things that look like filesystems to avoid a data loss situation. You could probably disable it by adding precheck=/bin/true.

This cryptswap is really dangerous (in terms of formatting the wrong device by accident), if possible, avoid it completely. Using proper encryption with a LUKS header is much safer even if it means having to type another passphrase.

I'm not sure how offset behaves if it tries to write to the last 1MB of the drive.

There is no problem, offset just results in a smaller device mapping. So if you have a 1000MiB partition and use a plain crypttab mapping with offset 1MiB, the resulting crypt device is 999MiB in size.