Workshops

User Tools

Site Tools

Trace: • reencrypt_linux_post_install
reencrypt_linux_post_install

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revision		Previous revision
reencrypt_linux_post_install [2025/05/02 14:34] – [Associate the boot partition] userareencrypt_linux_post_install [2026/06/19 09:25] (current) – usera
Line 13: Line 13:
 You should make (encrypted !) backups of your system all the time. However, you should **ABSOLUTELY** do it before any operation on your disks or partitions such as the one presented here: there is a significant risk to destroy ALL your data. You should make (encrypted !) backups of your system all the time. However, you should **ABSOLUTELY** do it before any operation on your disks or partitions such as the one presented here: there is a significant risk to destroy ALL your data.
  
-I suggest a backup using two different open source softwares. The first one is [[https://clonezilla.org/downloads/download.php?branch=stable|Clonezilla]], it is free, open source and allows to make a disk image and save it in a compressed encrypted file to be stored on an external drive. With this, you will be able to restore your whole disk in its current state where it works fine.+Please follow the procedures listed [[backup|here]] to do a backup of your disk image with Clonezilla and a second backup of all your non program files with restic.
  
-For this, you will need: 
  
-  - An external hard drive to store the backup. I suggest using an external SSD with a capacity of roughly 3 times your whole drive capacity. For example, if you have a 500GB drive, you will probably be fine with a 2TB drive, but it should be used only for this purpose. +===== STEP 2: Setup your partitioning =====
-  - An external USB stick to install CloneZilla. It should be at least 1GB and be used only for CloneZilla+
  
-==== STEP 1.1: prepare the CloneZilla USB stick ==== +There are several ways a Linux distribution can be installed without encryption. Check the output of:
- +
-First, [[https://clonezilla.org/downloads/download.php?branch=stable|download]] the file as an iso. +
- +
-Then, verify the download, using the following commands:+
  
 <code> <code>
-wget https://clonezilla.org//downloads/stable/data/CHECKSUMS.TXT +lsblk
-wget https://clonezilla.org//downloads/stable/data/CHECKSUMS.TXT.gpg +
-gpg --keyserver hkp://keys.openpgp.org --recv-key 667857D045599AFD +
-gpg --verify CHECKSUMS.TXT.gpg CHECKSUMS.TXT+
 </code> </code>
  
-The output should show the line: +Ideally, you should have on your laptop hard drive 2 or 3 partitions.
-<code> +
-gpg: Good signature from "DRBL Project (Diskless Remote Boot in Linux) <drbl@clonezilla.org>" [unknown] +
-</code>+
  
-You then have verified that the file CHECKSUM.TXT has been encrypted by the owner of the private key of the clonezilla project. +  - One of them should be the "ESP" partition which handles the "EFI" boot system (the mountpoint should be /boot/efi, the size below 1GB typically, and the filesystem should be fat32), 
-You can then compare the checksum of your file with the content of CHECKSUMS.TXT:+  - One of them will contain your root installation (the mount point should be /, the size should be most of the disk size and the filesystem should be ext4). 
 +  - Optionally, you can have a separate ext4 partition for /home, that would then be much bigger than the / (something like 30GB-50GB is typical for /, the rest of the disk for /home), 
 +  - Maybe a partition for swap, 
 +  - Maybe an ext4 partition for /boot, which is typically around the same size as the EFI partition 
  
-<code> +If you have a /home or a /swap partition, we are going to ignore them for now. The setup you will need to make this work is:
-sha256sum clonezilla-live-3.2.1-9-amd64.iso +
-</code>+
  
-Replace the filename with the actual file you downloaded if it is another version. Check that the output of this command is part of the output of:+  - The ESP (or EFI) partition 
 +  - One partition for the / 
 +  - One partition for the /boot
  
-<code> +You most likely have the two first one. If you already have the last one, you can go immediately to the following step. 
-cat CHECKSUMS.TXT +
-</code>+
  
-If so, you are sure to have the right file. You can then proceed to flash you USB key. I recommend using [[balena-etcher|Balena Etcher]], which is Open Source, user friendly and cross platform.+==== In case you do not have a separate /boot partition ====
  
-==== STEP 1.2: prepare the external SSD ====+=== Create the partition ===
  
-You are going to make two partitions on your external SSD:  
-  - __One unencrypted partition__, to store the encrypted compressed image that CloneZilla will output, 
-  -  __One encrypted partition__, that will contain two virtual sub partitions: 
  
-      - One for the backups of your /home directory (meaning Videos, Photos, Documents, ...) This will be done later with a software called BackinTime +If you do not have the last one, you need to create one ext4 partition of roughly 500MB. You will need to shrink another partition for this, and you cannot shrink a partition that you are using, You will therefore need to **[[boot_live_usb|boot from a live USB]]**
-      - One for snapshots of your root filesystem (so your programs). This should be done later (but it will not be covered in this tutorial), once you have a stable encrypted system, with a program called Timeshift.+
  
-For this you should use the gparted tool, that you can install with: +Once there, you can use the gparted tool again:
-<code> +
-sudo apt install gparted +
-</code> +
- +
-Launch it:+
  
 <code> <code>
Line 73: Line 53:
 </code> </code>
  
-This will prompt the following screen, where I will take the example of a small 1GB USB key formatting (a USB key behaves the same way as any storage device from a software perspective), but in your case you will have much more storage size. I recommend the first unencrypted partition to be roughly 1.5 the size of your disk, so maybe around 700GB for a 500GB disk. +Select your disk, then locate the partition you want to shrink (usually the one dedicated to /home if you have one, otherwise the one dedicated to /).
  
-First it will prompt you to the partitioning of your current disk most likely. This is my case, where I have a standard partitioning for full disk encryption: +If you see something in the "Mount point" column, right click and click on "unmount". Then right click and click on resize/move. Add 500MB at the end of this partition **(do not copy the number used in this example screenshot, as it was with partitions that were too small to create a 500MB extra one)**. Then click on resize/move
-  - One small (500MB for example) unencrypted partition in fat32 for the EFI boot system (/boot/efi) +
-  - One small (500MB for example) unencrypted partition in ext4 for the boot partition (/boot) +
-  - One large (in my case almost 500GB) encrypted partition in etx4 for my whole filesystem+
  
-{{ ::gparted_1.png?600 |}}+{{::gparted_12.png?600 |}}
  
-Select the disk you want to partition (beware that **the coming operations will delete all data that you have on this disk**).+You can now create a new ext4 partition of size 500MB roughly, and then click on Add, then "Apply all operations"
  
-{{ ::gparted_2.png?600 |}}+{{ ::gparted_13.png?600 |}}
  
-{{ ::gparted_3.png?600 |}} +{{ ::gparted_14.png?600 |}}
-To modify the partitions you first need to unmount them+
  
-{{ ::gparted_4.png?600 |}}+{{ ::gparted_15.png?600 |}}
  
-Then you can create a new partition table. There are several type of such partition table, we will choose gpt, which is the most commonly used one.+=== Associate the boot partition ===
  
-{{ ::gparted_5.png?600 |}} 
  
-{{ ::gparted_6.png?600 |}}+Then, you need to reinstall your boot partition. It is possible to do it manually, but I recommend a nice tool called boot-repair. To use it, open a command prompt and type:
  
-You can make a new partition now by right clicking on the empty space+<code> 
 +sudo add-apt-repository ppa:yannubuntu/boot-repair 
 +sudo apt-get update 
 +sudo apt-get install boot-repair 
 +boot-repair 
 +</code>
  
-{{ ::gparted_7.png?600 |}} +you will be prompted with a menu saying "apply the recommanded repairs". Do not click on it, but instead on "advanced options"->GRUB location->tick the "separate /boot partition" and select the correct partition to use for it (the one you just created)->click on "Apply" and follow the instructions if some are presented.
-Choose the size you want (in this example I take 500MB for each partitions, in your case it could be 700GB and 1300GB)+
  
-{{ ::gparted_8.png?600 |}} +Now you can restart your computer, remove the USB key and let it boot on the normal OS, check that the system boots, and that the result of the command: 
-Repeat the operation for the second partition +<code> 
-{{ ::gparted_9.png?600 |}}+lsblk 
 +</code>
  
-{{ ::gparted_10.png?600 |}} +shows among other lines one line for the ESP partition (Mount point /boot/efi), one for the boot parititon (Mount point /boot), and one for the root filesystem (Mount point /).
-click on Apply (the green check mark). **You are warned: all data are going to be lost on this disk**. Click on Apply.+
  
-{{ ::gparted_11.png?600 |}}+=== Do the actual reencryption ===
  
-you can then close gparted. Open a terminal and proceed to the encryption of the second partition. You can find its name with the command:+Insert your live USB key, restart your computer and boot on your live system again. Once this is done, open a command line. We will need to shrink the partition with the root filesystem by 32M in order to encrypt it. To do this, a small computation is necessary. Here are the command you will use, if you want to encrypt the partition [ROOT_PARTITION], in my case it was sda2.
  
 <code> <code>
-lsblk+sudo dumpe2fs -h /dev/[ROOT_PARTITION] | grep Block
 </code> </code>
  
-In my case I get the following output:+which will give you something like this: 
 <code> <code>
-NAME                             MAJ:MIN RM   SIZE RO TYPE  MOUNTPOINTS +dumpe2fs 1.46.5 (30-Dec-2021) 
-sda                                8:0    0 465.8G  0 disk   +Block count:              77883392 
-├─sda1                             8:1    0   512M  0 part  /boot/efi +Block size:               4096 
-├─sda2                             8:2    0   488M  0 part  /boot +Blocks per group:         32768
-└─sda3                             8:3    0 464.8G  0 part   +
-  └─disk1                        254:0    0 464.8G  0 crypt  +
-    ├─usera--computer--vg-root   254:1    0    50G  0 lvm   / +
-    ├─usera--computer--vg-swap_1 254:2    0   976M  0 lvm   [SWAP] +
-    └─usera--computer--vg-home   254:3    0   410G  0 lvm   /home +
-sdb                                8:16   1   960M  0 disk   +
-├─sdb1                             8:17   1   500M  0 part  /media/usera/2ef6dc0b-e0a8-4095-a9d9-437a367ae12a +
-└─sdb2                             8:18   1   458M  0 part  /media/usera/76c9dcf2-6043-4f0a-8845-6218fd0bacbd+
 </code> </code>
  
-you can see that this command gives more details than gparted, especially since my encrypted disk is decrypted, and you can see the next level, three "sub partitions" hidden behind my encrypted disk, that correspond to my root partition (usera--computer--vg-root) containing my programs, my home partition (usera--computer--vg-home) containing my "normal" files and a swap partition (usera--computer--vg-swap) which is a special linux feature that allows to convert disk space into RAM when this resource is scarce. +note the "Block count" and the "Block size", then use the following formula, where BLOCK_COUNT and BLOCK_SIZE should be replaced with their value:
-This parenthesis closed, I can identify the partition I want to encrypt: it is called sdb2 (in linux, disks are usually called sda, sdb, sdc..., and partitions in a disk called sda1, sda2, etc.).  +
- +
-To encrypt the second partition, let us install the cryptsetup tool, in case it is not already there on your computer. Open a terminal and enter: +
 <code> <code>
-sudo apt-get -y install cryptsetup+python3 -c "print(int((BLOCK_COUNT*BLOCK_SIZE-32*1024*1024)/BLOCK_SIZE))"
 </code> </code>
  
-Then you can proceed with the encryption (careful: if the partition you want to encrypt has another name, change it accordingly):+In my case, I get:
  
 <code> <code>
-sudo umount /dev/sdb2 +python3 -c "print(int((77883392*4096-32*1024*1024)/4096))" 
-sudo cryptsetup luksFormat /dev/sdb2+77875200
 </code> </code>
 +Note this number.
 +Now enter:
  
-You need to enter 'YES' and then your strong passphrase two times. 
 <code> <code>
-WARNING: Device /dev/sdb2 already contains a 'ext4' superblock signature. +sudo e2fsck -f /dev/[ROOT_PARTITION]
- +
-WARNING! +
-======== +
-This will overwrite data on /dev/sdb2 irrevocably. +
- +
-Are you sure? (Type 'yes' in capital letters): YES +
-Enter passphrase for /dev/sdb2:  +
-Verify passphrase:+
 </code> </code>
  
-After a couple time (a bit more depending on the size of the partition), your partition is now encrypted. +in my case, I get:
- +
-you can now decrypt it with the following command: +
 <code> <code>
-sudo cryptsetup luksOpen /dev/sdb2 cryptodisk+mint@mint:~$ sudo e2fsck -f /dev/sda2 
 +e2fsck 1.46.5 (30-Dec-2021) 
 +Pass 1: Checking inodes, blocks, and sizes 
 +Pass 2: Checking directory structure 
 +Pass 3: Checking directory connectivity 
 +Pass 4: Checking reference counts 
 +Pass 5: Checking group summary information 
 +/dev/sda2: 311972/19472384 files (0.4% non-contiguous), 4838704/77883392 blocks
 </code> </code>
-you will be prompted with your passphrase. Now that your disk is decrypted, you can check that the command:+ 
 +then you can do the actual resize of the filesystem, using the number you previously calculated, in my case 77875200.
 <code> <code>
-lsblk+sudo resize2fs -p /dev/[ROOT_PARTITION] 77875200
 </code> </code>
-gives a different result:+ 
 +I got:
 <code> <code>
-NAME                             MAJ:MIN RM   SIZE RO TYPE  MOUNTPOINTS +resize2fs 1.46.5 (30-Dec-2021) 
-sda                                8:0    0 465.8G  0 disk   +Resizing the filesystem on /dev/sda2 to 77875200 (4k) blocks. 
-├─sda1                             8:1    0   512M  0 part  /boot/efi +The filesystem on /dev/sda2 is now 77875200 (4k) blocks long.
-├─sda2                             8:2    0   488M  0 part  /boot +
-└─sda3                             8:3    0 464.8G  0 part   +
-  └─disk1                        254:0    0 464.8G  0 crypt  +
-    ├─usera--computer--vg-root   254:1    0    50G  0 lvm   / +
-    ├─usera--computer--vg-swap_1 254:2    0   976M  0 lvm   [SWAP] +
-    └─usera--computer--vg-home   254:3    0   410G  0 lvm   /home +
-sdb                                8:16   1   960M  0 disk   +
-├─sdb1                             8:17   1   500M  0 part  /media/usera/2ef6dc0b-e0a8-4095-a9d9-437a367ae12a +
-└─sdb2                             8:18   1   458M  0 part   +
-  └─cryptodisk                   254:4    0   442M  0 crypt  +
-sr0                               11:0    1  1024M  0 rom+
 </code> </code>
  
-We will now prepare the two "sub partitions" that we talked about before. This is done with a system called LVM (Logical Volume Manager). It can be installed with the following command, if it is not already on your distribution: +you can now do the actual reencription:
 <code> <code>
-sudo apt install lvm2+sudo cryptsetup reencrypt --encrypt --reduce-device-size 32M /dev/[ROOT_PARTITION]
 </code> </code>
 +which will take a very long time, depending on the size of your disk. In my case, I got:
  
-you will need to execute the following commands: 
- 
-You first create what we call a "Physical Volume" for LVM out of the decrypted disk: 
 <code> <code>
-sudo pvcreate /dev/mapper/cryptodisk+mint@mint:~$ sudo cryptsetup reencrypt --encrypt --reduce-device-size 32M /dev/sda2 
 + 
 +WARNING! 
 +======== 
 +This will overwrite data on LUKS2-temp-5c24539d-acc7-4216-bc61-0939b2d4f51f.new irrevocably. 
 + 
 +Are you sure? (Type 'yes' in capital letters): YES 
 +Enter passphrase for LUKS2-temp-5c24539d-acc7-4216-bc61-0939b2d4f51f.new:  
 +Verify passphrase:  
 +Finished, time 358:10.876, 304216 MiB written, speed  14.2 MiB/s\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00
 </code> </code>
  
-then you create a "Volume Group" in this physical volume:+which took 358 minutes, which is 6 hours. 
 + 
 +Then you can decrypt this partition, then mount the corresponding system:
  
 <code> <code>
-sudo vgcreate vgbackup /dev/mapper/cryptodisk+sudo cryptsetup luksOpen /dev/[ROOT_PARTITION] cryptodisk
 </code> </code>
  
-Then you create two "Logical Volumes" in the "Volume Group". In your case, you want to replace "250M" in the command below with something like 1.5 times the size of your programs, something like 80GB should be enough. You would then enter "80G". +you will have to enter your passphrase. Then resize the filesystem there:
 <code> <code>
-sudo lvcreate -L 250M -n root vgbackup +sudo resize2fs /dev/mapper/cryptodisk
-sudo lvcreate -l 100%FREE -n home vgbackup+
 </code> </code>
  
-then you can check again the output of +which gave in my case:
 <code> <code>
-lsblk+resize2fs 1.46.5 (30-Dec-2021) 
 +Resizing the filesystem on /dev/mapper/cryptodisk to 77879296 (4k) blocks. 
 +The filesystem on /dev/mapper/cryptodisk is now 77879296 (4k) blocks long.
 </code> </code>
-You can see that we have the right partitioning: 
  
 +Now, you need to note down the content of the file /etc/resolv.conf, which is use by linux to access internet:
 <code> <code>
-NAME                             MAJ:MIN RM   SIZE RO TYPE  MOUNTPOINTS +cat /etc/resolv.conf
-sda                                8:0    0 465.8G  0 disk   +
-├─sda1                             8:1    0   512M  0 part  /boot/efi +
-├─sda2                             8:2    0   488M  0 part  /boot +
-└─sda3                             8:3    0 464.8G  0 part   +
-  └─disk1                        254:0    0 464.8G  0 crypt  +
-    ├─usera--computer--vg-root   254:1    0    50G  0 lvm   / +
-    ├─usera--computer--vg-swap_1 254:2    0   976M  0 lvm   [SWAP] +
-    └─usera--computer--vg-home   254:3    0   410G  0 lvm   /home +
-sdb                                8:16   1   960M  0 disk   +
-├─sdb1                             8:17   1   500M  0 part  /media/usera/2ef6dc0b-e0a8-4095-a9d9-437a367ae12a +
-└─sdb2                             8:18   1   458M  0 part   +
-  └─cryptodisk                   254:4    0   442M  0 crypt  +
-    ├─vgbackup-root              254:5    0   252M  0 lvm    +
-    └─vgbackup-home              254:6    0   188M  0 lvm    +
-sr0                               11:0    1  1024M  0 rom+
 </code> </code>
  
-Then you need to create a "file system" in those "sub partitions", or Logical Volumes:+and you can now do a special operation to "enter" in your system. It is called a chroot operation, ,it is very convenient to recover a system that does not boot for example (boot with a live USB system, do a chroot, change some things to fix your system, and reboot). 
 +Enter the following commands, where [BOOT_PARTITION] is the boot partition you created, in my case sda3, and [EFI_PARTITION] is the EFI partition, in my case sda1: 
 <code> <code>
-sudo mkfs.ext4 /dev/mapper/vgbackup-root +sudo mount /dev/mapper/cryptodisk /mnt 
-sudo mkfs.ext4 /dev/mapper/vgbackup-home+sudo mount /dev/[BOOT_PARTITION] /mnt/boot 
 +sudo mount /dev/[EFI_PARTITION] /mnt/boot/efi 
 +sudo mount --bind /dev /mnt/dev 
 +sudo mount --bind /dev/pts /mnt/dev/pts 
 +sudo mount --bind /sys /mnt/sys 
 +sudo mount --bind /proc /mnt/proc 
 +sudo chroot /mnt
 </code> </code>
-this formatted those partitions with the filesystem called "ext4", which is a default Linux filesystem. 
  
-In what we did, there are several levels of partitions that you need to know: +the prompt will change a bit: you are now an administrator inside your own system!  
-{{ ::partitionning.png?600 |}}+Let us first check that we are connected to internet. To do that, you need to try to ping a website:
  
-You can then close the LVM: 
 <code> <code>
-sudo vgchange -an vgbackup+ping google.com
 </code> </code>
  
-and the luks container:+if you see something like this:
 <code> <code>
-sudo cryptsetup luksClose cryptodisk+(base) usera@debian:~$ ping google.com 
 +PING google.com (142.250.74.78) 56(84) bytes of data. 
 +64 bytes from arn09s23-in-f14.1e100.net (142.250.74.78): icmp_seq=1 ttl=113 time=20.3 ms 
 +64 bytes from arn09s23-in-f14.1e100.net (142.250.74.78): icmp_seq=2 ttl=113 time=21.3 ms 
 +64 bytes from arn09s23-in-f14.1e100.net (142.250.74.78): icmp_seq=3 ttl=113 time=20.4 ms
 </code> </code>
  
 +then you are good to go, you can do CTRL+C to stop it. Otherwise, try copying the content of the /etc/resolv.conf file from before:
  
-==== STEP 1.3: do the actual backup ==== 
- 
-you can then follow the [[https://clonezilla.org/show-live-doc-content.php?topic=clonezilla-live/doc/01_Save_disk_image|clonezilla guide]] to backup your whole image to an encrypted image stored in your unencrypted partition. Do not forget to tick the "encrypt your image" option, and secure it with a strong passphrase that you will remember. 
- 
-Once this is done, you can do another backup of your /home, which contains all your regular files. For this you can use the software backintime. You can install it with: 
 <code> <code>
-sudo apt install backintime-qt+nano /etc/resolv.conf
 </code> </code>
 +then paste the content, and enter CTRL+X, then Y do save the changes. Try again to ping:
  
-Before launching it, we need to decrypt the encrypted disk, and mount the logical volume we intend to use: 
 <code> <code>
-sudo cryptsetup luksOpen /dev/sdb2 cryptsetup +ping google.com
-sudo vgchange -ay +
-sudo mount /dev/mapper/vgbackup-home /mnt+
 </code> </code>
  
-now everything written on /mnt on your computer will be written on your disk.+It should work now.
  
-You can then launch backintime with:+Now, install some required packages:
 <code> <code>
-sudo backintime-qt+sudo apt install cryptsetup cryptsetup-initramfs
 </code> </code>
  
-you can then configure it to save things in /mnt:+and let us do some modifications. 
 +Enter the following command:
  
-{{ ::backintime_1.png?600 |}}+<code> 
 +blkid 
 +</code>
  
 +in my case I get:
  
-{{ ::backintime_2.png?600 |}}+<code> 
 +/dev/sdb2: SEC_TYPE="msdos" LABEL_FATBOOT="ESP" LABEL="ESP" UUID="8D6C-A9F8" BLOCK_SIZE="512" TYPE="vfat" PARTLABEL="Appended2" PARTUUID="6d4f3559-353e-4f68-9e82-073ebfc45977" 
 +/dev/sdb3: LABEL="writable" UUID="8f575917-6870-4bc8-bc52-88dca8725727" BLOCK_SIZE="4096" TYPE="ext4" PARTUUID="046f4c25-8d42-0144-8919-012dc6b514fc" 
 +/dev/sdb1: BLOCK_SIZE="2048" UUID="2022-07-26-18-56-47-00" LABEL="Linux Mint 21 Xfce 64-bit" TYPE="iso9660" PARTLABEL="ISO9660" PARTUUID="6d4f3559-353e-4f68-9e81-073ebfc45977" 
 +/dev/loop0: TYPE="squashfs" 
 +/dev/mapper/cryptodisk: UUID="eb4337fa-a978-4aa6-a8c9-407b30af8b48" BLOCK_SIZE="4096" TYPE="ext4" 
 +/dev/sda2: UUID="5c24539d-acc7-4216-bc61-0939b2d4f51f" TYPE="crypto_LUKS" PARTUUID="cd8058db-e068-404a-b4eb-e4365087e2df" 
 +/dev/sda3: UUID="1185a0bc-123f-4fc0-9ff5-7bc127e559df" BLOCK_SIZE="4096" TYPE="ext4" PARTUUID="1dc8c979-f987-4330-9507-0e5c195f6c75" 
 +/dev/sda1: UUID="1EF0-6BBB" BLOCK_SIZE="512" TYPE="vfat" PARTLABEL="EFI System Partition" PARTUUID="7a499615-a81d-4993-a9ab-9a6f7595812d" 
 +</code>
  
 +you should note the UUID of the encrypted disk, in my case sda2, whose UUID is 5c24539d-acc7-4216-bc61-0939b2d4f51f
 +edit the file /etc/crypttab with the following command:
  
-{{ ::backintime_3.png?600 |}} +<code> 
- +nano /etc/crypttab 
-And then click on "Take snapshot" and wait for it to finish: +</code>
- +
-{{ ::backintime_4.png?600 |}}+
  
-you can then unmount and remove your backup disk:+and add the following line, replacing [UUID] with the value you noted:
  
 <code> <code>
-sudo umount /mnt +cryptodisk UUID=[UUID] none luks,discard
-sudo vgchange -an vgbackup +
-sudo cryptsetup luksClose cryptodisk+
 </code> </code>
  
-===== STEP 2: Setup your partitioning ===== +you can exit the editor with CTRL+X, then type Y for saving it. 
- +then note the UUID of the decrypted partition, here /dev/mapper/cryptodisk, whose UUID is in my case eb4337fa-a978-4aa6-a8c9-407b30af8b48. Modify the file /etc/fstab with the command:
-There are several ways a Linux distribution can be installed without encryption. Check the output of:+
  
 <code> <code>
-lsblk+nano /etc/fstab
 </code> </code>
  
-Ideally, you should have on your laptop hard drive 2 or 3 partitions. +you should check the line that has the mount point "/", and check that it is like the following, otherwise edit it and save it:
- +
-  - One of them should be the "ESP" partition which handles the "EFI" boot system (the mountpoint should be /boot/efi, the size below 1GB typically, and the filesystem should be fat32), +
-  - One of them will contain your root installation (the mount point should be /, the size should be most of the disk size and the filesystem should be ext4). +
-  - Optionally, you can have a separate ext4 partition for /home, that would then be much bigger than the / (something like 30GB-50GB is typical for /, the rest of the disk for /home), +
-  - Maybe a partition for swap, +
-  - Maybe an ext4 partition for /boot, which is typically around the same size as the EFI partition  +
- +
-If you have a /home or a /swap partition, we are going to ignore them for now. The setup you will need to make this work is: +
- +
-  - The ESP (or EFI) partition +
-  - One partition for the / +
-  - One partition for the /boot +
- +
-You most likely have the two first one. If you already have the last one, you can go immediately to the following step.  +
- +
-==== In case you do not have a separate /boot partition ==== +
- +
-=== Create the partition === +
- +
- +
-If you do not have the last one, you need to create one ext4 partition of roughly 500MB. You will need to shrink another partition for this, and you cannot shrink a partition that you are using, You will therefore need to **[[boot_live_usb|boot from a live USB]]** +
- +
-Once there, you can use the gparted tool again:+
  
 <code> <code>
-sudo gparted+/dev/mapper/cryptodisk /               ext4    errors=remount-ro 0       1
 </code> </code>
  
-Select your disk, then locate the partition you want to shrink (usually the one dedicated to /home if you have one, otherwise the one dedicated to /). +you need finally to modify the file /etc/default/grub:
- +
-If you see something in the "Mount point" column, right click and click on "unmount". Then right click and click on resize/move. Add 500MB at the end of this partition **(do not copy the number used in this example screenshot, as it was with partitions that were too small to create a 500MB extra one)**. Then click on resize/move +
- +
-{{::gparted_12.png?600 |}} +
- +
-You can now create a new ext4 partition of size 500MB roughly, and then click on Add, then "Apply all operations" +
- +
-{{ ::gparted_13.png?600 |}} +
- +
-{{ ::gparted_14.png?600 |}} +
- +
-{{ ::gparted_15.png?600 |}} +
- +
-=== Associate the boot partition === +
- +
- +
-Then, you need to reinstall your boot partition. It is possible to do it manually, but I recommend a nice tool called boot-repair. To use it, open a command prompt and type: +
 <code> <code>
-sudo add-apt-repository ppa:yannubuntu/boot-repair +nano /etc/default/grub
-sudo apt-get update +
-sudo apt-get install boot-repair +
-boot-repair+
 </code> </code>
  
-you will be prompted with a menu saying "apply the recommanded repairs". Do not click on it, but instead on "advanced options"->GRUB location->tick the "separate /boot partition" and select the correct partition to use for it (the one you just created)->click on "Apply" and follow the instructions if some are presented.+you need to locate the entry "GRUB_CMDLINE_LINUX=" and change it to "GRUB_CMDLINE_LINUX="cryptdevice=UUID=<LUKS partition UUID>:cryptodisk root=/dev/mapper/cryptdisk" 
 +where you change <LUKS partition UUID> for the UUID of your encrypted partition. 
 +You can then enter:
  
-Now you can restart your computer, remove the USB key and let it boot on the normal OS, check that the system boots, and that the result of the command: 
 <code> <code>
-lsblk+sudo update-initramfs -u
 </code> </code>
  
-shows among other lines one line for the ESP partition (Mount point /boot/efi), one for the boot parititon (Mount point /boot), and one for the root filesystem (Mount point /). +and then:
- +
-=== Do the actual reencryption === +
- +
-Insert your live USB key, restart your computer and boot on your live system again. Once this is done, open a command line. We will need to shrink the partition with the root filesystem by 32M in order to encrypt it. To do this, a small computation is necessary. Here are the command you will use, assuming that the partition you want to encrypt is /dev/sda2+
  
 <code> <code>
-sudo dumpe2fs -h /dev/sda2 | grep Block+update-grub
 </code> </code>
  
-which will give you something like this:+and finally the following commands:
  
 <code> <code>
-dumpe2fs 1.47.0 (5-Feb-2023) +exit 
-Block count:              499712 +sudo shutdown -r now
-Block size:               1024 +
-Blocks per group:         8192+
 </code> </code>
  
-note the "Block count" and the "Block size", then use the following formula: +you will then remove your USB key and boot in your encrypted system hopefully. You should see a prompt asking to unlock your disk, and then your familiar OS will boot, with all the configuration you previously had. Congratulations !
-<code> +
-python3 -c "print((BLOCK_COUNT*BLOCK_SIZE-32*1024*1024)/1024)" +
-</code> +
-Note this number.+
reencrypt_linux_post_install.1746196497.txt.gz · Last modified: by usera