When I was installing my OS, I didn't encrypt. Is there a way to encrypt it now without formatting and without losing any data? I read a few guides how to encrypt and every one says that I need to backup all my data because I will lose it. Is there a way to encrypt it all now without losing data?
Yes, there is a way. The LUKS
cryptsetup utility contains the reencrypt command that you can also use to encrypt your existing unencrypted root partition, i.e. without destroying the existing filesystem.
That said, before performing such a conversion you should still backup your data. Of course, one should always perform backups on a regular schedule, because of possible hardware failure etc. Thus, this is kind of redundant advice.
Switching an existing root filesystem from unencrypted to encrypted requires quite a few steps:
- make sure that the cryptsetup package is installed
- make sure that your root filesystem has some free space (at least 100 MiB to be on the safe side)
- identify the partition your root partition is located on: e.g. with
df /, lookup the UUID of the filesystem with
blkidand store it somewhere
- boot into a rescue system where you can unmount your root filesystem (e.g. boot from an USB stick which contains - say - Grml)
- locate your root partition (e.g. with
blkidand look for the UUID)
- if it's ext4 execute a filesystem check:
e2fsck -f /dev/sdXY
- shrink the filesystem to make some room for the LUKS header, e.g. if it's an ext4 filesystem:
resize2fs /dev/sdXY $smallersizeinGiB_G(you need to shrink it by at least 32 MiB)
- encrypt it:
cryptsetup reencrypt --encrypt /dev/sdXY --reduce-device-size 32M
- open it:
cryptsetup open /dev/sdXY root
- enlarge the filesystem to the maximum:
- mount it to - say -
- mount the boot filesystem on
/mnt/rootand bind-mount pseudo filesystems
- chroot into your system by:
chroot /mnt/root /bin/bash
- update kernel parameters in
/etc/default/grubor some equivalent location, e.g. when your distro uses dracut (which is likely) you need to add
blkid, note that this UUID is different from the root filesystem one), if you have selinux installed you should add
enforcing=0(and later remove it) because of all the edits
- if your distribution has selinux enabled, configure a relabeling:
- regenerate grub config:
grub2-mkconfig -o /boot/.../grub...cfg
- regenerate initramfs (to make sure that cryptsetup support is included):
dracut -f /boot/initramfs....img kernelversion
- exit the chroot
- unmount everything
cryptsetup close root
As you see these are many steps, i.e. there is some potential to introduce errors. Thus, arguably it might be simpler to just reinstall and restore your backup (e.g. config files and
Also, in my experience as of 2020,
cryptsetup reencrypt is relatively slow, thus it may be faster to just
cryptsetup luksFormat the device and restore a backup.
If you have an XFS filesystem, you can't just shrink it, because XFS doesn't support this, as of 2020. Thus, you would need to
fstransform it before being able to shrink it. With a transformed filesystem you have another uuid to take care of. That means either change the UUID of the new filessytem to the UUID of the old one. Or update the UUID of the filesystem in
With a dracut based distribution you don't need to create a
/etc/crypttab, other distribution might require it (also before the initramfs update, because it might need to be included there).
2.5 Can I encrypt an already existing, non-empty partition to use LUKS?
There is no converter, and it is not really needed. The way to do
this is to make a backup of the device in question, securely wipe the device (as LUKS device initialization does not clear away old data),
do a luksFormat, optionally overwrite the encrypted device, create a
new filesystem and restore your backup on the now encrypted device.
Also refer to sections "Security Aspects" and "Backup and Data
For backup, plain GNU tar works well and backs up anything likely to be in a filesystem.*
However you may want to look into https://johndoe31415.github.io/luksipc/usage.html#plain-to-luks-conversion "Plain to LUKS conversion" which could satisfy your requirement. Disclaimer : I've never tried this, I don't know if it works, and the project doesn't appear to have been updated since 2015.