-2

I know it can be done (LUKS) using an extra hard-drive which involves significant manual work. In Windows it's just a single click for encrypting/decrypting your hard-drives. Ubuntu offers a way to encrypt during installation but can anyone explain why there are no viable encryption mechanisms/tools in Linux as compared to Windows/Mac after the OS is installed? Is there an inherent bottleneck in OS architecture or it's just that no one have developed one yet?

  • 1
    I rather enjoy the flexibility of issuing the few commands to create a file and have it mounted as encrypted filesystem, instead of having to reach out for a mouse and only being able to encrypt whole hard-drives. But I understand those few commands might be significant manual work for someone else. – Anthon Aug 16 '17 at 19:55
  • 2
    It's possible and has been done: johannes-bauer.com/linux/luksipc This could easily be added to the initrd as it works with unmounted block devices only. I guess it has not been done by the distributors because there is too little demand and too much possible trouble. – Hauke Laging Aug 16 '17 at 19:57
  • Thanks @Huake_Laging for the info and the link. The link was very informative and even has dev procedures. Thanks. – ThunderPunch Aug 16 '17 at 20:20
  • @Anthon thanks for the answer although it's not an answer – ThunderPunch Aug 16 '17 at 20:20
1

Firstly I need to say that I have no idea how Windows handles encrypting hard drives.

On the surface it's just because no one have written the code to do that yet.

The obvious next question is: why haven't any one done so?

I guess the answer to that lies partly in very little need and partly in the complexity of the task.

As for the "very little need" part: Most people install Linux themselves, and can easily set up encryption during installation, so only people that gets a machine with Linux installed for them (or realising the need later) would need such a feature.

1

Your question is a bit trollish. If pushing on a button on your GUI is what you mean by "viable encryption mechanisms", Linux may indeed fail in this area but it just means that Linux is not for you, not that the encryption mechanisms are not viable.

Linux offers several encryption tools that do not require to have a spare disk at hand. In his comment, Hauke Laging cited luksipc which can encrypt your partition in place but requires that it be unmounted first. But other systems can operate on a mounted device, for example ext4 encryption, EncFS and eCryptfs.

It's quite extreme but, with eCryptfs, you can even encrypt a whole directory in place. I'm not sure that would be advisable, so don't try it at work or on anything valuable, but for the curious souls, here are the steps:

# mount -t ecryptfs dir dir                # Yes, mount it onto itself
(answer the questions; DO enable plaintext passthrough)
# cd dir
# find -type f -not -name my_temporary_file \( \
    -exec cp -a {} my_temporary_file ";" \
    -exec mv my_temporary_file {} ";" \
    -o -printf "Error while encrypting %p\n" \
\)

Voilà! All your original files are now encrypted (you can unmount the directory and check its content). Note that since it proceeds by making a copy of each file, you must have enough room left on your partition for the biggest file in dir.

  • It's pathetic that people are too worried about my Linux skills rather answering my question. And hey Mr.**** you don't need to say whether Linux is for me or not... I do enjoy the flexibility provided by Linux, however when it needs to be done on say 500 systems at my work, it's better for me to build a package that can be pushed over a network rather than doing those steps manually for 500 systems. It's people like you.... well it's people like you.................................... – ThunderPunch Aug 19 '17 at 3:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.