reencrypt_linux_post_install
Differences
This shows you the differences between two versions of the page.
| Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
| reencrypt_linux_post_install [2025/05/02 14:17] – [Associate the boot partition] usera | reencrypt_linux_post_install [2025/07/26 09:51] (current) – usera | ||
|---|---|---|---|
| Line 373: | Line 373: | ||
| you will be prompted with a menu saying "apply the recommanded repairs" | you will be prompted with a menu saying "apply the recommanded repairs" | ||
| + | Now you can restart your computer, remove the USB key and let it boot on the normal OS, check that the system boots, and that the result of the command: | ||
| + | < | ||
| + | lsblk | ||
| + | </ | ||
| + | shows among other lines one line for the ESP partition (Mount point /boot/efi), one for the boot parititon (Mount point /boot), and one for the root filesystem (Mount point /). | ||
| + | === Do the actual reencryption === | ||
| + | Insert your live USB key, restart your computer and boot on your live system again. Once this is done, open a command line. We will need to shrink the partition with the root filesystem by 32M in order to encrypt it. To do this, a small computation is necessary. Here are the command you will use, if you want to encrypt the partition [ROOT_PARTITION], | ||
| - | Then, open a terminal and check the unique identifier associated with your desired | + | < |
| + | sudo dumpe2fs -h /dev/ | ||
| + | </ | ||
| + | which will give you something like this: | ||
| + | |||
| + | < | ||
| + | dumpe2fs 1.46.5 (30-Dec-2021) | ||
| + | Block count: | ||
| + | Block size: 4096 | ||
| + | Blocks per group: | ||
| + | </ | ||
| + | |||
| + | note the "Block count" and the "Block size", then use the following formula, where BLOCK_COUNT and BLOCK_SIZE should be replaced with their value: | ||
| + | < | ||
| + | python3 -c " | ||
| + | </ | ||
| + | |||
| + | In my case, I get: | ||
| + | |||
| + | < | ||
| + | python3 -c " | ||
| + | 77875200 | ||
| + | </ | ||
| + | Note this number. | ||
| + | Now enter: | ||
| + | |||
| + | < | ||
| + | sudo e2fsck -f / | ||
| + | </ | ||
| + | |||
| + | in my case, I get: | ||
| + | < | ||
| + | mint@mint: | ||
| + | e2fsck 1.46.5 (30-Dec-2021) | ||
| + | Pass 1: Checking inodes, blocks, and sizes | ||
| + | Pass 2: Checking directory structure | ||
| + | Pass 3: Checking directory connectivity | ||
| + | Pass 4: Checking reference counts | ||
| + | Pass 5: Checking group summary information | ||
| + | /dev/sda2: 311972/ | ||
| + | </ | ||
| + | |||
| + | then you can do the actual resize of the filesystem, using the number you previously calculated, in my case 77875200. | ||
| + | < | ||
| + | sudo resize2fs -p / | ||
| + | </ | ||
| + | |||
| + | I got: | ||
| + | < | ||
| + | resize2fs 1.46.5 (30-Dec-2021) | ||
| + | Resizing the filesystem on /dev/sda2 to 77875200 (4k) blocks. | ||
| + | The filesystem on /dev/sda2 is now 77875200 (4k) blocks long. | ||
| + | </ | ||
| + | |||
| + | you can now do the actual reencription: | ||
| + | < | ||
| + | sudo cryptsetup reencrypt --encrypt --reduce-device-size 32M / | ||
| + | </ | ||
| + | which will take a very long time, depending on the size of your disk. In my case, I got: | ||
| + | |||
| + | < | ||
| + | mint@mint: | ||
| + | |||
| + | WARNING! | ||
| + | ======== | ||
| + | This will overwrite data on LUKS2-temp-5c24539d-acc7-4216-bc61-0939b2d4f51f.new irrevocably. | ||
| + | |||
| + | Are you sure? (Type ' | ||
| + | Enter passphrase for LUKS2-temp-5c24539d-acc7-4216-bc61-0939b2d4f51f.new: | ||
| + | Verify passphrase: | ||
| + | Finished, time 358:10.876, 304216 MiB written, speed 14.2 MiB/ | ||
| + | </ | ||
| + | |||
| + | which took 358 minutes, which is 6 hours. | ||
| + | |||
| + | Then you can decrypt this partition, then mount the corresponding system: | ||
| + | |||
| + | < | ||
| + | sudo cryptsetup luksOpen / | ||
| + | </ | ||
| + | |||
| + | you will have to enter your passphrase. Then resize the filesystem there: | ||
| + | < | ||
| + | sudo resize2fs / | ||
| + | </ | ||
| + | |||
| + | which gave in my case: | ||
| + | < | ||
| + | resize2fs 1.46.5 (30-Dec-2021) | ||
| + | Resizing the filesystem on / | ||
| + | The filesystem on / | ||
| + | </ | ||
| + | |||
| + | Now, you need to note down the content of the file / | ||
| + | < | ||
| + | cat / | ||
| + | </ | ||
| + | |||
| + | and you can now do a special operation to " | ||
| + | Enter the following commands, where [BOOT_PARTITION] is the boot partition you created, in my case sda3, and [EFI_PARTITION] is the EFI partition, in my case sda1: | ||
| + | |||
| + | < | ||
| + | sudo mount / | ||
| + | sudo mount / | ||
| + | sudo mount / | ||
| + | sudo mount --bind /dev /mnt/dev | ||
| + | sudo mount --bind /dev/pts / | ||
| + | sudo mount --bind /sys /mnt/sys | ||
| + | sudo mount --bind /proc /mnt/proc | ||
| + | sudo chroot /mnt | ||
| + | </ | ||
| + | |||
| + | the prompt will change a bit: you are now an administrator inside your own system! | ||
| + | Let us first check that we are connected to internet. To do that, you need to try to ping a website: | ||
| + | |||
| + | < | ||
| + | ping google.com | ||
| + | </ | ||
| + | |||
| + | if you see something like this: | ||
| + | < | ||
| + | (base) usera@debian: | ||
| + | PING google.com (142.250.74.78) 56(84) bytes of data. | ||
| + | 64 bytes from arn09s23-in-f14.1e100.net (142.250.74.78): | ||
| + | 64 bytes from arn09s23-in-f14.1e100.net (142.250.74.78): | ||
| + | 64 bytes from arn09s23-in-f14.1e100.net (142.250.74.78): | ||
| + | </ | ||
| + | |||
| + | then you are good to go, you can do CTRL+C to stop it. Otherwise, try copying the content of the / | ||
| + | |||
| + | < | ||
| + | nano / | ||
| + | </ | ||
| + | then paste the content, and enter CTRL+X, then Y do save the changes. Try again to ping: | ||
| + | |||
| + | < | ||
| + | ping google.com | ||
| + | </ | ||
| + | |||
| + | It should work now. | ||
| + | |||
| + | Now, install some required packages: | ||
| + | < | ||
| + | sudo apt install cryptsetup cryptsetup-initramfs | ||
| + | </ | ||
| + | |||
| + | and let us do some modifications. | ||
| + | Enter the following command: | ||
| < | < | ||
| Line 384: | Line 538: | ||
| </ | </ | ||
| - | look for the line corresponding to the partition: | + | in my case I get: |
| < | < | ||
| - | /dev/sda3: UUID="e6dd6eda-387a-4ef6-a69c-8faecfe02f04" BLOCK_SIZE=" | + | /dev/sdb2: SEC_TYPE=" |
| + | /dev/sdb3: LABEL=" | ||
| + | /dev/sdb1: BLOCK_SIZE=" | ||
| + | /dev/loop0: TYPE=" | ||
| + | / | ||
| + | /dev/sda2: UUID=" | ||
| + | /dev/sda3: UUID="1185a0bc-123f-4fc0-9ff5-7bc127e559df" BLOCK_SIZE=" | ||
| + | /dev/sda1: UUID=" | ||
| </ | </ | ||
| - | you want to copy the UUID="" | + | you should note the UUID of the encrypted disk, in my case sda2, whose UUID is 5c24539d-acc7-4216-bc61-0939b2d4f51f |
| + | edit the file / | ||
| + | |||
| + | < | ||
| + | nano / | ||
| + | </ | ||
| + | |||
| + | and add the following line, replacing [UUID] with the value you noted: | ||
| + | |||
| + | < | ||
| + | cryptodisk | ||
| + | </ | ||
| + | |||
| + | you can exit the editor with CTRL+X, then type Y for saving it. | ||
| + | then note the UUID of the decrypted partition, here / | ||
| + | |||
| + | < | ||
| + | nano / | ||
| + | </ | ||
| + | |||
| + | you should check the line that has the mount point "/", and check that it is like the following, otherwise edit it and save it: | ||
| + | |||
| + | < | ||
| + | / | ||
| + | </ | ||
| + | |||
| + | you need finally to modify the file / | ||
| + | < | ||
| + | nano / | ||
| + | </ | ||
| + | |||
| + | you need to locate the entry " | ||
| + | where you change <LUKS partition UUID> for the UUID of your encrypted partition. | ||
| + | You can then enter: | ||
| + | |||
| + | < | ||
| + | sudo update-initramfs -u | ||
| + | </ | ||
| + | |||
| + | and then: | ||
| + | |||
| + | < | ||
| + | update-grub | ||
| + | </ | ||
| + | |||
| + | and finally the following commands: | ||
| + | |||
| + | < | ||
| + | exit | ||
| + | sudo shutdown -r now | ||
| + | </ | ||
| - | and edit the file specifying what to mount during the startup of your computer, located at /etc/fstab: | + | you will then remove your USB key and boot in your encrypted system hopefully. You should see a prompt asking |
reencrypt_linux_post_install.1746195456.txt.gz · Last modified: by usera