6

I've installed Raspberry Pi OS and VeraCrypt on my RPI. I have used VeraCrypt (and, previously, TrueCrypt) for many years, but always on Windows and with the GUI. Now I try to use it on Linux on the command line (it's headless).

I have spent significant time in the manual trying to find this out prior to asking the question. I can't find any mention of it: https://www.veracrypt.fr/en/Command%20Line%20Usage.html

How do I actually tell VeraCrypt on the command line to encrypt the system (and only) disk? To make it crystal clear, I mean the same thing as is done in the VeraCrypt GUI by clicking:

System > Encrypt System Partition/Drive

Encrypting the system disk is by far the most important feature of this software, and the most common use case. It's got to be possible from the command line.

The reason I don't use "something else" is that they always require pages of cryptic commands which just rub me the wrong way. All I want is to basically do something like:

veracrypt --encrypt-system-disk

And then it will make me enter a password twice and then show a progress indicator (just like the GUI) from 0 to 100%, and then reboot, and then I have to enter the password each time it boots or else it won't start. That's it. It's all I want and need. Just like the GUI VeraCrypt behaves on Windows.

5
  • 1
    Have you read this?
    – KGIII
    Commented Sep 15, 2020 at 20:05
  • @KGIII Well, now I have. But that page talks about making "volumes". And when I run veracrypt -t -c, it doesn't behave like it does in that guide. After selecting "normal" type, it asks me Enter volume path:. I have no idea what it means by this. And the entire guide doesn't seem to be for doing what I'm asking for?
    – Derrike
    Commented Sep 15, 2020 at 20:10
  • I am not sure why it'd not and the volume can be the entire disk. Also, does your RPi have a GUI installed? If so, there's a VeraCrypt GUI for Linux. Or there was the last time I looked at it. I haven't played with it in a couple of years, so my recollection may be wrong.
    – KGIII
    Commented Sep 15, 2020 at 20:18
  • @KGIII It's headless and has no desktop software. If I select "/", it just asks me how big to make the "volume", which tells me that it's not about encrypting the system disk at all, but is trying to create a "container file".
    – Derrike
    Commented Sep 15, 2020 at 20:30
  • I think my memory may be going, but it doesn't look like you can encrypt your full drive in this way - with this program. I could have sworn you could as I played with veracrypt a couple years back. I even had some notes on it. I'd look for alternative solutions. I believe zulucrypt can do full drives.
    – KGIII
    Commented Sep 15, 2020 at 20:46

1 Answer 1

3

First, you mention system encryption. It is important to note that Veracrypt supports system encryption for Windows only (see https://veracrypt.fr/en/Supported%20Systems%20for%20System%20Encryption.html).

But in Linux, you can still encrypt a non-system drive or partition.

Let's say I want to encrypt my USB stick on /dev/sdc1.

For encryption itself, there's an interactive command line mode. Just type veracrypt -t --create and answer the different questions. When you are prompted for the volume path you wish to encrypt, type the mount point of your volume e.g. /dev/sdc1 for me. Then answer all questions, which happen to be the same as the GUI wizard. If you are used to Veracrypt in Windows then none of these questions should be a problem for you.

Otherwise, you can pass options to the veracrypt command in order to pre-answer the interactive questions. For example, I could successfully encrypt my USB stick with this command:

veracrypt -t --create /dev/sdc1 --volume-type normal --encryption AES --hash sha256 --filesystem NTFS --random-source foo.txt
3
  • 1
    This doesn't work. veracrypt -t --create clobbers the disk. The question asked is how to encrypt in place.
    – Joshua
    Commented Jul 13, 2023 at 20:12
  • AFAIK Veracrypt cannot encrypt a partition in place, except for system encryption. When creating a volume on a partition, Veracrypt formats it to FAT12, FAT16 FAT32 or NTFS, which de facto involves content loss.
    – FloT
    Commented Jul 15, 2023 at 9:33
  • I haven't found how either or I'd answer. I found this question asking how and only your answer. It make sense that encrypt /dev/sdc1 cannot be done without data loss (where does the header go?) but it makes no sense that the encrypt system partition function cannot be called upon when given the whole disk /dev/sdc. (Where does the header go? Same place it does on the whole disk encryption--between the partition table and the first partition.)
    – Joshua
    Commented Jul 15, 2023 at 15:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .