reencrypt_linux_post_install
Differences
This shows you the differences between two versions of the page.
| Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
| reencrypt_linux_post_install [2025/05/02 14:34] – [Associate the boot partition] usera | reencrypt_linux_post_install [2025/07/26 09:51] (current) – usera | ||
|---|---|---|---|
| Line 382: | Line 382: | ||
| === Do the actual reencryption === | === Do the actual reencryption === | ||
| - | Insert your live USB key, restart your computer and boot on your live system again. Once this is done, open a command line. We will need to shrink the partition with the root filesystem by 32M in order to encrypt it. To do this, a small computation is necessary. Here are the command you will use, assuming that the partition | + | Insert your live USB key, restart your computer and boot on your live system again. Once this is done, open a command line. We will need to shrink the partition with the root filesystem by 32M in order to encrypt it. To do this, a small computation is necessary. Here are the command you will use, if you want to encrypt |
| < | < | ||
| - | sudo dumpe2fs -h /dev/sda2 | grep Block | + | sudo dumpe2fs -h /dev/[ROOT_PARTITION] |
| </ | </ | ||
| Line 391: | Line 391: | ||
| < | < | ||
| - | dumpe2fs 1.47.0 (5-Feb-2023) | + | dumpe2fs 1.46.5 (30-Dec-2021) |
| - | Block count: | + | Block count: |
| - | Block size: 1024 | + | Block size: 4096 |
| - | Blocks per group: | + | Blocks per group: |
| </ | </ | ||
| - | note the "Block count" and the "Block size", then use the following formula: | + | note the "Block count" and the "Block size", then use the following formula, where BLOCK_COUNT and BLOCK_SIZE should be replaced with their value: |
| < | < | ||
| - | python3 -c " | + | python3 -c "print(int((BLOCK_COUNT*BLOCK_SIZE-32*1024*1024)/ |
| + | </ | ||
| + | |||
| + | In my case, I get: | ||
| + | |||
| + | < | ||
| + | python3 -c " | ||
| + | 77875200 | ||
| </ | </ | ||
| Note this number. | Note this number. | ||
| + | Now enter: | ||
| + | |||
| + | < | ||
| + | sudo e2fsck -f / | ||
| + | </ | ||
| + | |||
| + | in my case, I get: | ||
| + | < | ||
| + | mint@mint: | ||
| + | e2fsck 1.46.5 (30-Dec-2021) | ||
| + | Pass 1: Checking inodes, blocks, and sizes | ||
| + | Pass 2: Checking directory structure | ||
| + | Pass 3: Checking directory connectivity | ||
| + | Pass 4: Checking reference counts | ||
| + | Pass 5: Checking group summary information | ||
| + | /dev/sda2: 311972/ | ||
| + | </ | ||
| + | |||
| + | then you can do the actual resize of the filesystem, using the number you previously calculated, in my case 77875200. | ||
| + | < | ||
| + | sudo resize2fs -p / | ||
| + | </ | ||
| + | |||
| + | I got: | ||
| + | < | ||
| + | resize2fs 1.46.5 (30-Dec-2021) | ||
| + | Resizing the filesystem on /dev/sda2 to 77875200 (4k) blocks. | ||
| + | The filesystem on /dev/sda2 is now 77875200 (4k) blocks long. | ||
| + | </ | ||
| + | |||
| + | you can now do the actual reencription: | ||
| + | < | ||
| + | sudo cryptsetup reencrypt --encrypt --reduce-device-size 32M / | ||
| + | </ | ||
| + | which will take a very long time, depending on the size of your disk. In my case, I got: | ||
| + | |||
| + | < | ||
| + | mint@mint: | ||
| + | |||
| + | WARNING! | ||
| + | ======== | ||
| + | This will overwrite data on LUKS2-temp-5c24539d-acc7-4216-bc61-0939b2d4f51f.new irrevocably. | ||
| + | |||
| + | Are you sure? (Type ' | ||
| + | Enter passphrase for LUKS2-temp-5c24539d-acc7-4216-bc61-0939b2d4f51f.new: | ||
| + | Verify passphrase: | ||
| + | Finished, time 358:10.876, 304216 MiB written, speed 14.2 MiB/ | ||
| + | </ | ||
| + | |||
| + | which took 358 minutes, which is 6 hours. | ||
| + | |||
| + | Then you can decrypt this partition, then mount the corresponding system: | ||
| + | |||
| + | < | ||
| + | sudo cryptsetup luksOpen / | ||
| + | </ | ||
| + | |||
| + | you will have to enter your passphrase. Then resize the filesystem there: | ||
| + | < | ||
| + | sudo resize2fs / | ||
| + | </ | ||
| + | |||
| + | which gave in my case: | ||
| + | < | ||
| + | resize2fs 1.46.5 (30-Dec-2021) | ||
| + | Resizing the filesystem on / | ||
| + | The filesystem on / | ||
| + | </ | ||
| + | |||
| + | Now, you need to note down the content of the file / | ||
| + | < | ||
| + | cat / | ||
| + | </ | ||
| + | |||
| + | and you can now do a special operation to " | ||
| + | Enter the following commands, where [BOOT_PARTITION] is the boot partition you created, in my case sda3, and [EFI_PARTITION] is the EFI partition, in my case sda1: | ||
| + | |||
| + | < | ||
| + | sudo mount / | ||
| + | sudo mount / | ||
| + | sudo mount / | ||
| + | sudo mount --bind /dev /mnt/dev | ||
| + | sudo mount --bind /dev/pts / | ||
| + | sudo mount --bind /sys /mnt/sys | ||
| + | sudo mount --bind /proc /mnt/proc | ||
| + | sudo chroot /mnt | ||
| + | </ | ||
| + | |||
| + | the prompt will change a bit: you are now an administrator inside your own system! | ||
| + | Let us first check that we are connected to internet. To do that, you need to try to ping a website: | ||
| + | |||
| + | < | ||
| + | ping google.com | ||
| + | </ | ||
| + | |||
| + | if you see something like this: | ||
| + | < | ||
| + | (base) usera@debian: | ||
| + | PING google.com (142.250.74.78) 56(84) bytes of data. | ||
| + | 64 bytes from arn09s23-in-f14.1e100.net (142.250.74.78): | ||
| + | 64 bytes from arn09s23-in-f14.1e100.net (142.250.74.78): | ||
| + | 64 bytes from arn09s23-in-f14.1e100.net (142.250.74.78): | ||
| + | </ | ||
| + | |||
| + | then you are good to go, you can do CTRL+C to stop it. Otherwise, try copying the content of the / | ||
| + | |||
| + | < | ||
| + | nano / | ||
| + | </ | ||
| + | then paste the content, and enter CTRL+X, then Y do save the changes. Try again to ping: | ||
| + | |||
| + | < | ||
| + | ping google.com | ||
| + | </ | ||
| + | |||
| + | It should work now. | ||
| + | |||
| + | Now, install some required packages: | ||
| + | < | ||
| + | sudo apt install cryptsetup cryptsetup-initramfs | ||
| + | </ | ||
| + | |||
| + | and let us do some modifications. | ||
| + | Enter the following command: | ||
| + | |||
| + | < | ||
| + | blkid | ||
| + | </ | ||
| + | |||
| + | in my case I get: | ||
| + | |||
| + | < | ||
| + | /dev/sdb2: SEC_TYPE=" | ||
| + | /dev/sdb3: LABEL=" | ||
| + | /dev/sdb1: BLOCK_SIZE=" | ||
| + | /dev/loop0: TYPE=" | ||
| + | / | ||
| + | /dev/sda2: UUID=" | ||
| + | /dev/sda3: UUID=" | ||
| + | /dev/sda1: UUID=" | ||
| + | </ | ||
| + | |||
| + | you should note the UUID of the encrypted disk, in my case sda2, whose UUID is 5c24539d-acc7-4216-bc61-0939b2d4f51f | ||
| + | edit the file / | ||
| + | |||
| + | < | ||
| + | nano / | ||
| + | </ | ||
| + | |||
| + | and add the following line, replacing [UUID] with the value you noted: | ||
| + | |||
| + | < | ||
| + | cryptodisk UUID=[UUID] none luks, | ||
| + | </ | ||
| + | |||
| + | you can exit the editor with CTRL+X, then type Y for saving it. | ||
| + | then note the UUID of the decrypted partition, here / | ||
| + | |||
| + | < | ||
| + | nano /etc/fstab | ||
| + | </ | ||
| + | |||
| + | you should check the line that has the mount point "/", | ||
| + | |||
| + | < | ||
| + | / | ||
| + | </ | ||
| + | |||
| + | you need finally to modify the file / | ||
| + | < | ||
| + | nano / | ||
| + | </ | ||
| + | |||
| + | you need to locate the entry " | ||
| + | where you change <LUKS partition UUID> for the UUID of your encrypted partition. | ||
| + | You can then enter: | ||
| + | |||
| + | < | ||
| + | sudo update-initramfs -u | ||
| + | </ | ||
| + | |||
| + | and then: | ||
| + | |||
| + | < | ||
| + | update-grub | ||
| + | </ | ||
| + | |||
| + | and finally the following commands: | ||
| + | |||
| + | < | ||
| + | exit | ||
| + | sudo shutdown -r now | ||
| + | </ | ||
| + | |||
| + | you will then remove your USB key and boot in your encrypted system hopefully. You should see a prompt asking to unlock your disk, and then your familiar OS will boot, with all the configuration you previously had. Congratulations ! | ||
reencrypt_linux_post_install.1746196497.txt.gz · Last modified: by usera