4

I'm repeating a question that I posted on Server Fault. It was moved by another user to AskUbuntu because of a lack of responses. I think this is the more appropriate place to ask, but I don't think I have the right to move it here yet.

I would like to encrypt my entire disk with a fresh Ubuntu install as described here. However, my current laptop has many configurations that I do not want to re-do. I would like to backup the entire system, format the drive, re-install Ubuntu with the disk encryption option and restore all files and configuration settings. How hard is it to do this and what should I be careful about? Can I backup and restore as described here?

Improve this question
4
  • 1
    Does TrueCrypt.org provide a suitable in-place encryption solution for you? (Backing up first is still a smart idea regardless of what you decide to do.) Here's a web page that explains how to use TrueCrypt.org with Ubuntu Linux: linuxandfriends.com/2010/02/03/…
    – Randolf Richardson
    Sep 1, 2011 at 16:11
  • I don't want to use truecrypt. I want to encrypt the entire disk so if my laptop is stolen, the information is safe. Thanks for your response.
    – Vinh Nguyen
    Sep 1, 2011 at 16:17
  • 2
    TrueCrypt can encrypt the entire disk just fine, why are you ruling it out as an option? It is easy to back up and it can do a whole or a part of a disk and it runs on ubuntu. Why is that not exactly what you asked?
    – MaQleod
    Sep 1, 2011 at 16:35
  • @MaQleod He's likely ruling it out because it doesn't meet his requirements that it be able to encrypt his entire Linux system -- whole system encryption is only available under Windows, and in-place disk encryption is again only available under Windows.
    – Kromey
    Sep 1, 2011 at 18:25

2 Answers 2

Reset to default
2

Yes, you can do that.

The backup and restore procedure described on that page uses the tar utility, which operates on files; the encryption you would be using operates below that level, meaning anything you restore will the automagically encrypted for you as it is restored.

Where you might need to be careful (and I haven't done this myself, so I'm unsure if it's really a concern) is to avoid overwriting any configuration files relevant to the encryption. As I assume you're using the encrypted LVM installation option in the Ubuntu install routine, this means any configuration files relevant to LVM, as well as potentially any binaries relevant to LVM (if you currently have LVM binaries on your system but they lack the encryption support). (If LVM is not currently installed on your system, then there's almost certainly no problem whatsoever.)

I would add /boot and /dev as additional directories to exclude from your backup; the former will include any kernel modifications necessary for the encryption after you re-install (and which would be blown away should you restore that directory as well), and the latter, well, that's a fairly egregious oversight in the guide itself, and could get you into a lot of trouble since the encrypted LVM will necessarily modify the nodes within /dev, making them wholly incompatible with whatever you try to restore to them.

Improve this answer
7
  • I don't believe I have LVM set up on my current laptop. How can I check? df -m yields: Filesystem 1M-blocks Used Available Use% Mounted on /dev/sda1 458804 338217 97282 78% / none 3856 1 3856 1% /dev none 3867 3 3864 1% /dev/shm none 3867 1 3866 1% /var/run none 3867 0 3867 0% /var/lock
    – Vinh Nguyen
    Sep 1, 2011 at 19:10
  • @Vinh Run the commands pvdisplay and vgdisplay; if either returns no disks/volumes, or better yet a "command not found" message, then you are not using LVM (and, in the case of the latter, don't even have it installed).
    – Kromey
    Sep 1, 2011 at 19:21
  • both commands not found. So do you think it's safe to do as I propose? Backup (excluding certain directories), wipe, install OS with encrypted LVM, and restore? At the restore stage, should I restore from some kind of low level shell? Thanks!
    – Vinh Nguyen
    Sep 1, 2011 at 20:22
  • @Vinh Should be fine, yup. I would strongly recommend, if you have the storage space to spare, that you also make a wholly separate backup of just your files that you want to save -- documents, pictures, music, etc. -- which will be easier to restore from if the worst happens and you end up not being able to restore as you expect (shouldn't happen, but better safe than sorry IMHO). And no, you shouldn't need any special shell for the restore -- just log in as root (or su to root) and go.
    – Kromey
    Sep 1, 2011 at 22:10
  • Another question before I try this out next week. Should I do a hard disk backup with dd as outlined here just in case the previous method somehow fails? I have so much invested in my current setup that I would go crazy trying to reproduce it from scratch. Let me know your thoughts, thanks!
    – Vinh Nguyen
    Sep 3, 2011 at 17:12
0

I highly recommend using TrueCrypt because it is a free and open-source solution that provides on-the-fly encryption of the entire hard drive (or a specific partition, or a file that can be used as a fully mountable partition).

  TrueCrypt (free and open source)
  http://www.truecrypt.org/

For your convenience, I also located a web page that provides some instructions for installing and using TrueCrypt on Ubuntu Linux (the Operating System that you indicated is of interest to you):

  How to: TrueCrypt setup on Ubuntu Linux
  http://www.linuxandfriends.com/2010/02/03/how-to-truecrypt-setup-on-ubuntu-linux/

The fact that you want to run backups is excellent, and I strongly encourage you to do this regularly even after you've finished encrypting your hard drive (your question deserves an extra point in my opinion for mentioning backups).

In my experience, TrueCrypt (which beats the pants off the commercial-grade competitors I've seen) has proven to be 100% reliable for all my clients who are using it, and for my laptop -- it doesn't seem to matter that the power is lost or there is the occasional unexpected crash (mostly encountered with Windows), the system carries on where it left off, and disk repair options appear just like they do on unencrypted systems. In my professional estimation, it appears that the TrueCrypt developers "got it right," and I trust this product for reliability and security.

Improve this answer
2
  • 1
    TrueCrypt cannot encrypt the OS under anything except Windows XP and later. That means that per @Vinh's requirement that the whole system be encrypted, TrueCrypt is not a viable option -- and I say this as a rabid TrueCrypt fanboy myself!
    – Kromey
    Sep 1, 2011 at 18:23
  • Hmm. I remember reading somewhere that this could be done with Linux, but now I'm unable to find it. It looks like only Windows 7, Vista, XP, and 2000 are supported with this specific functionality. (My guess, and my hope, is that Linux and Unix will be supported in a future version of TrueCrypt.)
    – Randolf Richardson
    Sep 2, 2011 at 15:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .