Arch Linux

ralph026

Member

Registered: 2015-04-05

Posts: 8

Disk encryption with LUKS after installing arch

There is a chance to do a full disk encryption after I installed archlinux?
What tools should I use? Can I do that with Luks?

Thanks
rh

jasonwryan

Anarchist

From: .nz

Registered: 2009-05-09

Posts: 30,426

Website

Re: Disk encryption with LUKS after installing arch

Nope. Backup your data, your package list, configs etc, then scrub the drive and reinstall with Luks.

---

Arch + dwm   •   Mercurial repos  •   Surfraw

Registered Linux User #482438

mpan

Member

Registered: 2012-08-01

Posts: 1,644

Website

Re: Disk encryption with LUKS after installing arch

The same block device on which the root filesystem is installed? Not feasible⁽¹⁾. Copy everything to another drive, re-creating partition and copying back. Fortunately a freshly installed Arch will be very small, so not much space is needed. But if this is fresh… perhaps reinstall it?

The reason the whole operation is not trivial, is that LUKS requires shifting all the data to put the header before the encrypted block. In other words: it can’t be performed in-place. There are unofficial tools that claim they can perform the operation: e.g. luksipc. But they do not offer any reliability: a simple power failure or a write error will make you lose data.
____
⁽¹⁾ I do not consider writing custom software as a feasible method of solving this problem.

---

Paperclips in avatars?

frostschutz

Member

Registered: 2013-11-15

Posts: 1,653

Re: Disk encryption with LUKS after installing arch

from a live cd / rescue system with chroot, it's possible if you know what you are doing. backing everything up and restoring that backup is the traditional and easier-to-understand way, and you need the backup in any case since it's risky to do without.

so there's cryptsetup-reencrypt --new and cryptsetup reencrypt --encrypt. both part of the official cryptsetup package, no third party software. so it could be done as an in-place conversion. please read documentation carefully before attempting it and keep in mind that all in-place operations are inherently risky.

and also fixing the fstab, bootloader, initrd, etc. to handle the added cryptsetup layer is up to you.

traditional way is the safe way

adamlau

Member

Registered: 2009-01-30

Posts: 418

Re: Disk encryption with LUKS after installing arch

I have done it in the past with the official archlinux-iso. And it's only worth the time and effort if it offsets the time and effort of reconfiguring the entire system. Which it will likely not.

---

Arch Linux + sway
Debian Testing + GNOME/sway
NetBSD 64-bit + Xfce