21

If I have a partition like /dev/hd1 that is unencrypted and want it to be encrypted, but want to keep everything currently in that partition, how can I do that?

Improve this question
2

5 Answers 5

Reset to default
5

There does not seem to be an solution to do that in place. Truecrypt offers the system encryption only for windows, dm-crypt overwrites partitions. Your best bet would be to move everything from that partition into a backup with cp -a, create an encrypted partition with luks/dm-crypt and move everything back.

Improve this answer
1
  • 5
    rsync is more suitable than cp for this kind of operations, as it has options to exclude specific folders, handle specific file types, etc.
    – ccpizza
    Dec 2, 2017 at 22:23
29

Since this comes up near the top of google results, adding solution:

LUKS in place encryption via http://www.johannes-bauer.com/linux/luksipc/

Improve this answer
2
  • 8
    The luksipc author nowadays recommends to use the upstream crytsetup reencrypt command.
    – maxschlepzig
    May 6, 2020 at 19:15
  • @greg Please accept this more helpful answer.
    – Tilman Vogel
    May 22, 2022 at 16:08
7

This is trivial if you choose plain dm-crypt. It's risky - if it fails part-way through (power cut or whatever) then you're stuffed!

Ensure the raw device isn't mounted then create an encrypted device for it and use dd to copy from the raw device to the encrypted one:

$ cryptsetup open /dev/sda sda-crypt --type plain
$ dd if=/dev/sda of=/dev/mapper/sda-crypt bs=512

The plaintext data is read from /dev/sda and written to the device mapper, /dev/mapper/sda-crypt, which encrypts it and writes it back to /dev/sda, overwriting the plaintext data that was read.

It will likely take some time due to it reading and writing the entire disk.

Improve this answer
2
  • How do you then mount?
    – joedborg
    Mar 24, 2016 at 23:39
  • you mount mount /dev/mapper/sda-crypt /mnt or whatever mount-point you need. Of course, you must unlock /dev/sda first, as shown above.
    – starfry
    Mar 25, 2016 at 10:07
6

cryptsetup reencrypt

I just stumbled upon this rather old question and would like to note that cryptsetup has gained a cryptsetup reencrypt option. The documentation lists examples for reencrypting a device:

Encrypt LUKS2 device (in-place). Make sure last 32 MiB on /dev/plaintext is unused (e.g.: does not contain filesystem data):

cryptsetup reencrypt --encrypt --type luks2 --reduce-device-size 32m /dev/plaintext_device

The documentation has more examples such as initializing the device at first and taking the device online, encrypting it while it is in use. Furthermore the reencryption seems to be resilient in that it can be stopped and restarted, allowing for elaborate use-cases.

Note that the luks header still needs to be written and thus size restrictions apply, meaning that you should be very careful and ideally test your specific scenario (for instance on another device with plausible test data) before attempting this. The --reduce-device-size option has more information on this.

While reencrypting the tool will output information about size, speed, and ETA, making it very user friendly IMHO.

Workflow

The general workflow would be as follows:

  1. resize the existing filesystem/data to be 32MiB smaller than the surrounding blockdevice (e.g. on btrfs run btrfs fi resize -32m /mnt)
  2. make absolutely 100% sure that the device is not mounted or opened in any other way (if you have mdadm running on top of the device that'd be an issue as it would be trying to recover while the device is written to)
  3. reencrypt the device (e.g. cryptsetup reencrypt --encrypt --type luks2 --reduce-device-size 32m /dev/sda4)
  4. that's it, you can now cryptsetup open like usual, and use the UUID of the blockdevice (the blockdevice itself now has a UUID derived from the luks layer) as usual, for instance in your boot process/initrd
Improve this answer
1
  • I only just now saw the comment mentioning the command (@kael beat me to it), I'll leave the answer here anyway.
    – benaryorg
    Mar 16 at 14:28
1

Actually you can convert from a plain filesystem partition to dm-crypt.

But it's risky and cumbersome.

There is an out-dated tutorial here: https://help.ubuntu.com/community/EncryptedFilesystemHowto7

Dm-crypt maps one block to one block, so in theory it is doable. Luks is a user-friendly container that uses dm-crypt inside it. A luks partition contains a header and a dm-crypt partition inside it, where the encrypted filesystem really lives.

Warnings:

  1. If you choose to go Luks then your task is even harder, and you will need to know exactly how much ahead the dm-crypt data should be with respect to the begining of the official partition.

  2. In any case, if your system crashes or halts during the procedure you loose your data

More references:

http://www.richardneill.org/a22p-mdk11-0.php#encrypt2

http://www.saout.de/tikiwiki/tiki-index.php?page=EncryptExistingDevice

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .