1

I am unable to run luks reencryption. I have data on /dev/sdc1 and would like to encrypt it without the need to format. I am trying to utilize the luks2 online encryption feature.

mathew@plug:/mnt $ sudo cryptsetup reencrypt --new --reduce-device-size 16M /dev/sdc1
Usage: cryptsetup [-?vyrq] [-?|--help] [--usage] [--version] [-v|--verbose] [--debug] [--debug-json] [-c|--cipher=STRING] [-h|--hash=STRING]
        [-y|--verify-passphrase] [-d|--key-file=STRING] [--master-key-file=STRING] [--dump-master-key] [-s|--key-size=BITS]
        [-l|--keyfile-size=bytes] [--keyfile-offset=bytes] [--new-keyfile-size=bytes] [--new-keyfile-offset=bytes] [-S|--key-slot=INT]
        [-b|--size=SECTORS] [-o|--offset=SECTORS] [-p|--skip=SECTORS] [-r|--readonly] [-q|--batch-mode] [-t|--timeout=secs]
        [--progress-frequency=secs] [-T|--tries=INT] [--align-payload=SECTORS] [--header-backup-file=STRING] [--use-random] [--use-urandom]
        [--shared] [--uuid=STRING] [--allow-discards] [--header=STRING] [--test-passphrase] [--tcrypt-hidden] [--tcrypt-system]
        [--tcrypt-backup] [--veracrypt] [--veracrypt-pim=INT] [--veracrypt-query-pim] [-M|--type=STRING] [--force-password]
        [--perf-same_cpu_crypt] [--perf-submit_from_crypt_cpus] [--deferred] [-i|--iter-time=msecs] [--pbkdf=STRING] [--pbkdf-memory=kilobytes]
        [--pbkdf-parallel=threads] [--pbkdf-force-iterations=LONG] [--priority=STRING] [--disable-locks] [--disable-keyring]
        [-I|--integrity=STRING] [--integrity-no-journal] [--integrity-no-wipe] [--token-only] [--token-id=INT] [--key-description=STRING]
        [--sector-size=INT] [--persistent] [--label=STRING] [--subsystem=STRING] [--unbound] [--json-file=STRING] [--luks2-metadata-size=bytes]
        [--luks2-keyslots-size=bytes] [--refresh] [--keyslot-key-size=BITS] [--keyslot-cipher=STRING] [OPTION...] <action> <action-specific>
--new: unknown option

As specified in this document - https://wiki.archlinux.org/index.php/Dm-crypt/Device_encryption#Cryptsetup_usage I also tried, but still get error:

mathew@plug:/mnt $ sudo cryptsetup reencrypt --encrypt --reduce-device-size 16M /dev/sdc1
Usage: cryptsetup [-?vyrq] [-?|--help] [--usage] [--version] [-v|--verbose] [--debug] [--debug-json] [-c|--cipher=STRING] [-h|--hash=STRING]
        [-y|--verify-passphrase] [-d|--key-file=STRING] [--master-key-file=STRING] [--dump-master-key] [-s|--key-size=BITS]
        [-l|--keyfile-size=bytes] [--keyfile-offset=bytes] [--new-keyfile-size=bytes] [--new-keyfile-offset=bytes] [-S|--key-slot=INT]
        [-b|--size=SECTORS] [-o|--offset=SECTORS] [-p|--skip=SECTORS] [-r|--readonly] [-q|--batch-mode] [-t|--timeout=secs]
        [--progress-frequency=secs] [-T|--tries=INT] [--align-payload=SECTORS] [--header-backup-file=STRING] [--use-random] [--use-urandom]
        [--shared] [--uuid=STRING] [--allow-discards] [--header=STRING] [--test-passphrase] [--tcrypt-hidden] [--tcrypt-system]
        [--tcrypt-backup] [--veracrypt] [--veracrypt-pim=INT] [--veracrypt-query-pim] [-M|--type=STRING] [--force-password]
        [--perf-same_cpu_crypt] [--perf-submit_from_crypt_cpus] [--deferred] [-i|--iter-time=msecs] [--pbkdf=STRING] [--pbkdf-memory=kilobytes]
        [--pbkdf-parallel=threads] [--pbkdf-force-iterations=LONG] [--priority=STRING] [--disable-locks] [--disable-keyring]
        [-I|--integrity=STRING] [--integrity-no-journal] [--integrity-no-wipe] [--token-only] [--token-id=INT] [--key-description=STRING]
        [--sector-size=INT] [--persistent] [--label=STRING] [--subsystem=STRING] [--unbound] [--json-file=STRING] [--luks2-metadata-size=bytes]
        [--luks2-keyslots-size=bytes] [--refresh] [--keyslot-key-size=BITS] [--keyslot-cipher=STRING] [OPTION...] <action> <action-specific>
--encrypt: unknown option

I referred to the manpage here - https://man.cx/cryptsetup(8) and as per them my above command should have worked!

My cryptsetup version is 2.1.0 and I don't see any upgrade when trying apt-get install or apt-get upgrade.

I am confused and stuck :(

2
  • Neither source mentions an option --new... Have you reduced the file system accordingly? You should put all options between cryptsetup and reencrypt. May 19, 2020 at 15:58
  • I tried placing options b/w cryptsetup and reencrypt. Didn't work. I am fairly sure this is a version problem. My distro is Raspbain 10 and it looks like their version is outdated. I am trying to figure out a way to update the cryptsetup version. May 20, 2020 at 2:22

1 Answer 1

1

I finally compiled from source and it worked.

3
  • 1
    And which version did you compile from source?
    – AdminBee
    May 20, 2020 at 12:00
  • Downloaded the latest from gitlab (2.3.2) May 24, 2020 at 11:01
  • 3
    Then may I suggest that you edit your answer to include that information, and possibly anything you had to do to install it that wasn't readily obvious from the documentation provided. That way, others facing a similar proble can profit from your experience; also otherwise your post might get "delete" votes by moderators for being a comment rather than an actual answer.
    – AdminBee
    May 25, 2020 at 7:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .