12

When I was installing my OS, I didn't encrypt. Is there a way to encrypt it now without formatting and without losing any data? I read a few guides how to encrypt and every one says that I need to backup all my data because I will lose it. Is there a way to encrypt it all now without losing data?

2
  • 3
    This is for experts. If your system crashes during this procedure then all data can be lost. So if you insist on doing this without a backup then I assume the data is not important to you. May 20, 2018 at 12:06
  • 1
    @HaukeLaging There's a difference between important (I must not lose this) and important (nobody else must know this). It's a valid assumption that some people have data which would not be a catastrophic loss, but might be catastrophic if inadvertantly disclosed. Aug 12, 2019 at 13:23

2 Answers 2

12

Yes, there is a way. The LUKS cryptsetup utility contains the reencrypt command that you can also use to encrypt your existing unencrypted root partition, i.e. without destroying the existing filesystem.

That said, before performing such a conversion you should still backup your data. Of course, one should always perform backups on a regular schedule, because of possible hardware failure etc. Thus, this is kind of redundant advice.

Switching an existing root filesystem from unencrypted to encrypted requires quite a few steps:

  1. backup
  2. make sure that the cryptsetup package is installed
  3. make sure that your root filesystem has some free space (at least 100 MiB to be on the safe side)
  4. identify the partition your root partition is located on: e.g. with df /, lookup the UUID of the filesystem with blkid and store it somewhere
  5. boot into a rescue system where you can unmount your root filesystem (e.g. boot from an USB stick which contains - say - Grml)
  6. locate your root partition (e.g. with blkid and look for the UUID)
  7. if it's ext4 execute a filesystem check: e2fsck -f /dev/sdXY
  8. shrink the filesystem to make some room for the LUKS header, e.g. if it's an ext4 filesystem: resize2fs /dev/sdXY $smallersizeinGiB_G (you need to shrink it by at least 32 MiB)
  9. encrypt it: cryptsetup reencrypt --encrypt /dev/sdXY --reduce-device-size 32M
  10. open it: cryptsetup open /dev/sdXY root
  11. enlarge the filesystem to the maximum: resize2fs /dev/mapper/root
  12. mount it to - say - /mnt/root
  13. mount the boot filesystem on /mnt/root and bind-mount pseudo filesystems /dev, /sys, /proc under /mnt/root.
  14. chroot into your system by: chroot /mnt/root /bin/bash
  15. update kernel parameters in /etc/default/grub or some equivalent location, e.g. when your distro uses dracut (which is likely) you need to add rd.luks.uuid=$UUID_OF_LUKS_DEVICE (cf. blkid, note that this UUID is different from the root filesystem one), if you have selinux installed you should add enforcing=0 (and later remove it) because of all the edits
  16. if your distribution has selinux enabled, configure a relabeling: touch /mnt/root/.autorelabel
  17. regenerate grub config: grub2-mkconfig -o /boot/.../grub...cfg
  18. regenerate initramfs (to make sure that cryptsetup support is included): dracut -f /boot/initramfs....img kernelversion
  19. exit the chroot
  20. unmount everything
  21. cryptsetup close root
  22. reboot

As you see these are many steps, i.e. there is some potential to introduce errors. Thus, arguably it might be simpler to just reinstall and restore your backup (e.g. config files and $HOME).

Also, in my experience as of 2020, cryptsetup reencrypt is relatively slow, thus it may be faster to just cryptsetup luksFormat the device and restore a backup.

If you have an XFS filesystem, you can't just shrink it, because XFS doesn't support this, as of 2020. Thus, you would need to fstransform it before being able to shrink it. With a transformed filesystem you have another uuid to take care of. That means either change the UUID of the new filessytem to the UUID of the old one. Or update the UUID of the filesystem in /mnt/root/etc/fstab.

With a dracut based distribution you don't need to create a /etc/crypttab, other distribution might require it (also before the initramfs update, because it might need to be included there).

3
  • Hi, sorry to bother you. What do you mean on the steps 12 and 13? I'm following your tutorial/steps and got stuck at this part, since i'm not being able to mount or figure it out the right commands to do them.
    – jonfornari
    Nov 25, 2020 at 23:13
  • Should i just do a ""mount /dev/sdXY /mnt/root"" ? this one command says it can recognize a luks filesystem. Also, how do I mount everything of step 13 (mount the boot on /mnt/root) and the bind-mount pseudos under /mnt/root (Thanks in advance and sorry again to bother you)
    – jonfornari
    Nov 25, 2020 at 23:15
  • @jonfornari something like mount -o /dev/mapper/root /mnt/root - i.e. unlocked luks devices appear under /dev/mapper. For the bind mounts something like gist.github.com/gsauthof/7c0b65ffe4da38b83c8c61d79b71c6d7 Nov 26, 2020 at 18:49
8

From the LUKS faq https://gitlab.com/cryptsetup/cryptsetup/wikis/FrequentlyAskedQuestions#2-setup

2.5 Can I encrypt an already existing, non-empty partition to use LUKS?

There is no converter, and it is not really needed. The way to do
this is to make a backup of the device in question, securely wipe the device (as LUKS device initialization does not clear away old data),
do a luksFormat, optionally overwrite the encrypted device, create a
new filesystem and restore your backup on the now encrypted device.
Also refer to sections "Security Aspects" and "Backup and Data
Recovery".

For backup, plain GNU tar works well and backs up anything likely to be in a filesystem.*

However you may want to look into https://johndoe31415.github.io/luksipc/usage.html#plain-to-luks-conversion "Plain to LUKS conversion" which could satisfy your requirement. Disclaimer : I've never tried this, I don't know if it works, and the project doesn't appear to have been updated since 2015.

1
  • The luksipc author nowadays recommends the upstream cryptsetup reencrypt method. Note that as of 2020 the mentioned cryptsetup-reencrypt command is replaced by cryptsetup reencrypt. May 3, 2020 at 20:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.