1

I recently installed Antergos (which is basically Arch) and set it to use full disk encryption. Now, I want to migrate from encrypt to sd-encrypt because I want to be able to hibernate and I couldn't put swap partition in the same LUKS volume..

Background

During the setup:

  • I used LUKS for / partition and swap partition,
  • because my main SSD is small, I wanted to be able to hibernate and I have 32GB of RAM I created the encrypted swap partition on the second drive,
  • I mounted swap partition (as well as another encrypted EXT4 partition from the second drive) using /etc/crypttab.

I tested that installation works, grub let me boot into both linux and dual booted Windows, on Linux boot it decrypts and mounts both encrypted drives.

However, I was getting error about not finding disk with the UUID of a swap drive, and Arch manual confirmed that encrypt which I got from installer can handle only one encrypted partition during boot. If I want to handle more of them I should move to sd-encrypt. However, even after reading the documentation I am not certain what I have to do in order to migrate to sd-encrypt.

Details

  • HOOKS="base udev autodetect modconf block keyboard keymap encrypt resume filesystems fsck"
  • GRUB_CMDLINE_LINUX_DEFAULT="quiet resume=UUID=[encrypted swap UUID]"
  • GRUB_CMDLINE_LINUX=cryptdevice=/dev/disk/by-uuid/[/ UUID]:Arch_crypt
  • GRUB_ENABLE_CRYPTODISK=y
  • /etc/crypttab

      swap_crypt /dev/disk/by-uuid/[/ UUID] password_file luks
      data_crypt /dev/disk/by-uuid/[/ UUID] password_file luks
    

What else should I do after I change encrypt to sd-encrypt in HOOKS? Do I have to create a /etc/crypttab.initramfs and move swap_crypt there? Do I have to change luks to rd.luks? Both swap partition and / partition uses the same password, so according to the documentation both should be mounted on boot after I entered the password once, is that right? Documentation mentions luks.* and rd.luks.* params and similar - do I have to use them and if so, where should I put them?

1
+50

I don't use Grub myself (but Arch and sd-encrypt) but from my kernel options I guess you would have to transform your configuration to look like (don't forget to backup your old configuration before switching).

HOOKS="base systemd autodetect modconf block keyboard sd-vconsole sd-encrypt resume filesystems fsck"

GRUB_CMDLINE_LINUX_DEFAULT="quiet resume=UUID=[decrypted swap UUID]" 
# I use resume=/dev/mapper/name-of-decrypted-device

GRUB_CMDLINE_LINUX=luks.uuid=[/ encrypted UUID] luks.uuid=[swap encrypted UUID]
GRUB_ENABLE_CRYPTODISK=y

/etc/crypttab

  swap_crypt /dev/disk/by-uuid/[/ UUID] password_file luks
  data_crypt /dev/disk/by-uuid/[/ UUID] password_file luks

Don't forget to run mkinitcpio -p linux or the equivalent to regenerate your initramfs, once the modification of the HOOKS have been done. And the grub.cfg file with grub-mkconfig -o /boot/grub/grub.cfg or something similar.

  • Just small note: I empirically checked that when you need to refer to /dev/mapper/somename you should use luks.name=[UUID]=somename because with sd-encrypt crypttab is not run. – Mateusz Kubuszok Apr 25 at 16:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.