I am installing Debian and would like to set up the /swap
partition as encrypted.
I am able to select either encrypted physical device or as swap/swap
. Are there any methods to create an encrypted /swap
partition?
The swap partition can hold a lot of unencrypted confidential information and the fact that it persists after shutting down the computer can be a problem.
Encrypting a swap partition however is slightly tricky if one wants to also support suspend-to-disk (also called hibernation).:
0- Install the cryptsetup package:
apt-get install cryptsetup
1- Setup the encrypted partition as root:
swapoff -a
cryptsetup -h sha256 -c aes-cbc-essiv:sha256 -s 256 luksFormat /dev/hda2
cryptsetup luksOpen /dev/hda2 cswap
mkswap /dev/mapper/cswap
2- Add this line to /etc/crypttab:
cswap /dev/hda2 none swap,luks,timeout=30
3- Set the swap partition to be this in /etc/fstab:
/dev/mapper/cswap none swap sw 0 0
4- Configure uswsusp to use /dev/mapper/cswap and write unencrypted data
dpkg-reconfigure -plow uswsusp
You will of course want to replace /dev/hda2 with the partition that currently holds your unencrypted swap.