17

2017 WARNING! The accepted answer appears to work, but with recent kernels I discovered that the system would hang as soon as it started swapping. If you attempt using an encrypted swap file, make sure that it actually swaps properly. It took me a long time to figure out why my system kept locking up for no apparent reason. I've gone back to using an encrypted swap partition, which does work correctly.


How do I set up an encrypted swap file (not partition) in Linux? Is it even possible? All the guides I've found talk about encrypted swap partitions, but I don't have a swap partition, and I'd rather not have to repartition my disk.

I don't need suspend-to-disk support, so I'd like to use a random key on each boot.

I'm already using a TrueCrypt file-hosted volume for my data, but I don't want to put my swap in that volume. I'm not set on using TrueCrypt for the swap file if there's a better solution.

I'm using Arch Linux with the default kernel, if that matters.

11
  • What exactly would be the point of that? It would have to be decrypted while using it, and it would be empty when not in use.
    – tkbx
    Feb 12, 2013 at 16:51
  • 1
    When you search for encrypted swapfile the first result leads to rayslinux.blogspot.de/2011/01/…
    – ott--
    Feb 12, 2013 at 17:12
  • @ott, despite saying "swap file" in the title, if you read the directions in that post they're clearly describing a swap partition.
    – cjm
    Feb 12, 2013 at 17:16
  • @tkbx, the point is to prevent someone from recovering sensitive data from the swap file after I've turned my computer off. (Or someone has been unable to guess my password, so they're rebooting into a live CD or such.)
    – cjm
    Feb 12, 2013 at 17:18
  • 2
    @tkbx, I don't believe so. That would require writing gigabytes of data every time you turn your computer off. The data in a swap file is not used when you reboot, but that doesn't mean it's erased from the disk.
    – cjm
    Feb 12, 2013 at 17:29

3 Answers 3

16

Indeed, the page describes setting up a partition, but it's similar for a swapfile:

dd if=/dev/urandom of=swapfile.crypt bs=1M count=64
loop=$(losetup -f)
losetup ${loop} swapfile.crypt
cryptsetup open --type plain --key-file /dev/urandom ${loop} swapfile
mkswap /dev/mapper/swapfile
swapon /dev/mapper/swapfile

The result:

# swapon -s
Filename                                Type            Size    Used    Priority
/dev/mapper/swap0                       partition       4000176 0       -1
/dev/mapper/swap1                       partition       2000084 0       -2
/dev/mapper/swapfile                    partition       65528   0       -3

swap0 and swap1 are real partitions.

4
  • loop-AES.README says in section 7.1: "File backed loops can't be used for swap." Is that untrue (or only true for loop-AES)?
    – cjm
    Feb 12, 2013 at 21:18
  • That is without device mapper.
    – ott--
    Feb 12, 2013 at 21:32
  • I revised your cryptsetup command to use open instead of create (which the manpage says is obsolete), and to use a random key instead of prompting for a password. It seems to be working.
    – cjm
    Feb 12, 2013 at 22:15
  • This doesn't seem to persist on reboot: "swapon: cannot open /dev/mapper/swapfile: No such file or directory" Sep 1, 2018 at 1:25
6

This Configuration uses randomly generated keys at boot and will not support Hibernation to hard disk! You Should Disable Hibernation through your respectie DE Power Management Utility and set it to Shutdown on Critical to avoid Data Loss!

Make sure to run sudo -s or su before running the following.

  1. Disable Swap:

    # swapoff -a
    
  2. Locate the existing Swap Partition

    # lsblk
    

    You will get something like this:

    sda3    8:3    0     8G  0 part [SWAP]
    
  3. Overwrite Old Swap

    # dd if=/dev/zero bs=1024000 of=/dev/sda<#>
    

    for example:

    # dd if=/dev/zero bs=1024000 of=/dev/sda3
    
  4. fstab setup

    # vim /etc/fstab
    

    Replace old SWAP device with crypttab mapper name: /dev/mapper/cswap

    #<file system>      <mount point>   <type>  <options>   <dump>  <pass>
    /dev/mapper/cswap   none            swap    pri=1,defaults  0   0
    
  5. Crypto Setup

    # ls -lF /dev/disk/by-id
    

    For Example:

    ata-HGST_HTS545050A7E680_TEK55D4F0BU3GV-part3 -> ../../sda3
    
    # vim /etc/crypttab
    
    # <name>    <device>                            <password>  <options>
      cswap     /dev/disk/by-id/ata-HGST_HTS545050A7E680_TEK55D4F0BU3GV-part3   /dev/urandom    swap,cipher=aes-cbc-essiv:sha256,size=256
    
  6. Active Encrypted Swap

    # reboot
    
  7. Verify Enctypted Swap Operations

    For example:

    # dmsetup -C info 
    cswap      253   0 L--w    2    1      0 CRYPT-PLAIN-cswap  
    # lsblk
    ├─sda3                8:3    0     8G  0 part  
    │ └─cswap             253:0    0     8G  0 crypt [SWAP]
    # cat /proc/swaps 
    Filename                Type        Size    Used    Priority
    /dev/dm-0               partition   8385532 0       -1
    
2

If you use dd if=/dev/zero of=/swapfile bs=8G count=1, followed by mkswap /swapfile and swapon /swapfile, you should have a working swapfile on your root filesystem. (we use dd to ensure there are no holes in the swapfile)

This gets around having to mess with loop devices and/or crypttab and simply places the swapfile inside your already encrypted filesystem. (We're assuming that you're using encryption for the whole drive here. Prepend the /swapfile parameter with the path to your encrypted directory if it's somewhere else)

See man mkswap and man swapon for more information.

3
  • I tried creating a swapfile like this in my encrypted home directory like that, and it crashed just like the encrypted swap file did...
    – fifaltra
    May 13, 2018 at 18:58
  • 1
    Is your home directory unlocked on system boot or when you log in? If it only unlocks when you log in, then you can't have the swapfile in there. Swap must be unlocked and made available on system boot. Besides that, you don't want system stuff in your user home directory. That's reserved for user stuff.
    – Mio Rin
    May 16, 2018 at 13:56
  • This makes sense thanks for sharing. I kept asking myself "if you have your entire disk already encrypted why would you need to encrypt swapfile that is living on the disk/partition?"
    – Kuberchaun
    Jul 21, 2020 at 17:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .