Setting up encryption on an already installed Arch setup?

ThatPerson · 2013-07-30 12:38:45

Recently I have been thinking about setting up encryption on my already installed Arch setup. I would reinstall and encrypt it that way, however I do not have an external HDD big enough to back up everything, so I was wondering if it is possible to encrypt a hard disk on an already installed Arch setup. I have two partitions, /dev/sda1 and /dev/sda2, and would like to encrypt both while not having to reinstall.
Can anyone help? Thanks!
Edit:
Alternatively, could I reinstall it and use encryption in the install in such a way that it retains my file contents?

Last edited by ThatPerson (2013-07-30 12:41:13)

84081 · 2013-07-30 12:47:50

As far as I know it's not possible to do a live migration to LUKS encryption.

ThatPerson · 2013-07-30 12:53:10

Oh, ok, thats a pity. I might as well try and reinstall it, and put my important files on other storage spaces or make a 3rd partition for them. Thanks anyway!

tomk · 2013-07-30 14:02:39

You don't need to back up everything, just your data and configs.

Stebalien · 2013-07-30 15:45:03

You can still do an offline migration without reinstalling. That is, tar up your entire system and back it up onto an external drive, encrypt your partitions, untar your system, and then adjust your mkinitcpio as necessary.

WonderWoofy · 2013-07-30 16:31:48

I use rsync rather than tar to do what Stebalien is suggesting here. I use btrfs, and my root filesystem is actually a subvolume. So I mount the entire btrfs filesystem (from subvolid=0) at /var/lib/btrfs-root. By doing this, it makes it much easier to simply rsync (or tar) from that mountpoint to the backup mountpoint. This makes it so that I can actually backup the system I am running off of without explicitly excluding all the volatile directories (like /sys, /tmp, /proc, etc.) Though I think a more sane approach, since I use btrfs, would be to snapshot each subvol and rsync those instead.

I guess what I am trying to get at, is that if you were to create something like /mnt/system and /mnt/backup. If you mounted your rootfs to /mnt/system (and then possibly your home partition to /mnt/system/home), then mount the backup destination to /mnt/backup, you could simply do something like:

# rsync -aAXv /mnt/system/* /mnt/backup

Then of course you would have to put it all back after you set up Luks/dmcrypt.

This installation I use has been through a few different drives and trying and removing Luks/dmcrypt. I have also changed filesystems, switched to LVM2, tried mdadm RAID0, mdadm RAID1, and eventually went back to btrfs. So as mentioned above, there is really no need to reinstall just to change the underlying layout of the HDD/SSD. Of course this assumes that you have a spare drive with the space to copy your entire filesystem to... but then you should have backups anyway, right?

ThatPerson · 2013-07-30 18:26:36

WonderWoofy wrote:

Of course this assumes that you have a spare drive with the space to copy your entire filesystem to... but then you should have backups anyway, right?

Well, I have an external disk which is big enough for most of my files and config, but then again I do have quite a few ISO files I don't really need, so I could probably get rid of them.

Thanks both of you, I am planning on rsyncing it to the disk and making the new partitions tommorow.

Strike0 · 2013-07-31 18:51:15

ThatPerson wrote:

I have two partitions, /dev/sda1 and /dev/sda2, and would like to encrypt both while not having to reinstall.
Can anyone help?

Actually a tool has been added to cryptsetup (a while back, in 1.5.0) which can do what you want. It can be used to switch encryption of a partition around and also (important sometimes) to re-encrypt a partition with a new key. However, it is still marked experimental and you are well advised to read the warning (particularly the bit in CAPS) carefully:

man cryptsetup-reencrypt

Given your reliable backup is done, it is dead simple to encrypt your partition with that. An example for your partition layout you find right at the end of the manpage. Of course you also have to change your mkinitcpio and bootloader config too, these steps (wiki) you would do before running the tool.
edit: I overread you want to encrypt /dev/sda1 too, which is presumably your /boot and cannot be encrypted of course .. So for clarity above only applies to your root partition.

Last edited by Strike0 (2013-07-31 19:02:22)

Arch Linux

#1 2013-07-30 12:38:45

Setting up encryption on an already installed Arch setup?

#2 2013-07-30 12:47:50

Re: Setting up encryption on an already installed Arch setup?

#3 2013-07-30 12:53:10

Re: Setting up encryption on an already installed Arch setup?

#4 2013-07-30 14:02:39

Re: Setting up encryption on an already installed Arch setup?

#5 2013-07-30 15:45:03

Re: Setting up encryption on an already installed Arch setup?

#6 2013-07-30 16:31:48

Re: Setting up encryption on an already installed Arch setup?

#7 2013-07-30 18:26:36

Re: Setting up encryption on an already installed Arch setup?

#8 2013-07-31 18:51:15

Re: Setting up encryption on an already installed Arch setup?

Board footer