2

I need some information regarding any possibility to do full disk encryption for a already installed Linux system(e.g centOS or Ubuntu).

Is there any default mechanism for FDE present in Linux like "FileVault 2 in MAC OS X".

I have done some research on this and come across "dm-crypt" which is the standard device-mapper encryption functionality provided by the Linux kernel.

My need is to have a shell/bash script to be invoked in the Linux machine for doing Full Disk Encryption.

Any help/insight or suggestion will be of great help.

Improve this question
1

2 Answers 2

Reset to default
0

install cryptsetup-rencrypt (not installed by default) highly advise using from a chroot environment tho

Improve this answer
4
  • 1
    This might have the makings of being the definitive answer, but more details would be nice. What is this package? How do I use it? Do I use this from the system I want to encrypt or from a seperate live boot?
    – Journeyman Geek ♦
    Apr 26, 2015 at 22:21
  • the package is called " cryptsetup-reencrypt" and on a running system (assuming it is not the root drive or inclusive of it ) or from a second system or live media (aka an installer on usb /dvd) install the package on a usb instance if need be and run it on the drive / partition / lvm as desired ---in my case 1) its fire up a usb instance 2) install cryptsetup-reencrypt 3) run sudo cryptsetup-reencrypt {OPTIONS} /dev/sdXY
    – linuxdev2013
    Apr 28, 2015 at 10:31
  • This needs to be in your answer ;)
    – Journeyman Geek ♦
    Apr 28, 2015 at 12:36
  • @JourneymanGeek technically it doesn'y it is NOT for alll users even
    – linuxdev2013
    Apr 28, 2015 at 13:04
-1

In short, FDE would be an issue you would want to address during the install. If your partitioning schema uses LVS you could set up an encrypted volume using LUKS and copy system files to it, and reassign mount points in your /etc/fstab file, but this is ill advised, and very likely error-prone.

Now that your install is already 'mature' (in the sense that it's already installed and broken in), you might be better off concentrating on encrypting your home folder instead. For such operations you might look into cryptsetup or encryptfs. With full-disk encryption, a running machine is already in the auth'ed environment, whereas home folder encryption at least has the benefit of keeping the volume in question encrypted as long as the user isn't logged in.

But in summary, your best option to look into if still wanting full disk encryption (or at least partition encryption at this point in your install's maturity) would be LUKS.

Improve this answer
7
  • Sure, no problem. Glad I could be of some help.
    – SYANiDE
    Apr 10, 2015 at 7:19
  • Hi I have a question once again, for "cryptsetup" & "encryptfs" we need to install the setup to work from command line interface. Is there any such application installed by default in linux which can let me access "dm-crypt".
    – Govind Karmakar
    Apr 10, 2015 at 9:00
  • Basically I need to create a shell script for this job to perform, preferably without installing any other setup in the endpoint. Thanks!!
    – Govind Karmakar
    Apr 10, 2015 at 9:04
  • Scripting the creation and automated mounting of a dm-crypt managed partition. Take a look at the following writeup: bash.cyberciti.biz/security/…
    – SYANiDE
    Apr 10, 2015 at 15:43
  • thanks for the help, I am able to encrypt the drive using dm-crypt & cryptsetup but it is formatting the partition before encrypting it, is there any other way to encrypt the disk without formatting it as the machines are already installed so re-installing or formatting is not possible.
    – Govind Karmakar
    Apr 13, 2015 at 8:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .