Differences

This shows you the differences between two versions of the page.

--- reencrypt_linux_post_install [2025/05/03 18:34] – [Do the actual reencryption] usera
+++ reencrypt_linux_post_install [2025/07/26 09:51] (current) – usera
@@ Line 476: / Line 476: @@
 Resizing the filesystem on /dev/mapper/cryptodisk to 77879296 (4k) blocks.
 The filesystem on /dev/mapper/cryptodisk is now 77879296 (4k) blocks long.
+</code>
+Now, you need to note down the content of the file /etc/resolv.conf, which is use by linux to access internet:
+<code>
+cat /etc/resolv.conf
 </code>
@@ Line 492: / Line 497: @@
 </code>
-the prompt will change a bit: you are now an administrator inside your own system! Enter the following command:
+the prompt will change a bit: you are now an administrator inside your own system!
+Let us first check that we are connected to internet. To do that, you need to try to ping a website:
+<code>
+ping google.com
+</code>
+if you see something like this:
+<code>
+(base) usera@debian:~$ ping google.com
+PING google.com (142.250.74.78) 56(84) bytes of data.
+bytes from arn09s23-in-f14.1e100.net (142.250.74.78): icmp_seq=1 ttl=113 time=20.3 ms
+bytes from arn09s23-in-f14.1e100.net (142.250.74.78): icmp_seq=2 ttl=113 time=21.3 ms
+bytes from arn09s23-in-f14.1e100.net (142.250.74.78): icmp_seq=3 ttl=113 time=20.4 ms
+</code>
+then you are good to go, you can do CTRL+C to stop it. Otherwise, try copying the content of the /etc/resolv.conf file from before:
+<code>
+nano /etc/resolv.conf
+</code>
+then paste the content, and enter CTRL+X, then Y do save the changes. Try again to ping:
+<code>
+ping google.com
+</code>
+It should work now.
+Now, install some required packages:
+<code>
+sudo apt install cryptsetup cryptsetup-initramfs
+</code>
+and let us do some modifications.
+Enter the following command:
 <code>
@@ Line 500: / Line 540: @@
 in my case I get:
-<code
+<code>
 /dev/sdb2: SEC_TYPE="msdos" LABEL_FATBOOT="ESP" LABEL="ESP" UUID="8D6C-A9F8" BLOCK_SIZE="512" TYPE="vfat" PARTLABEL="Appended2" PARTUUID="6d4f3559-353e-4f68-9e82-073ebfc45977"
 /dev/sdb3: LABEL="writable" UUID="8f575917-6870-4bc8-bc52-88dca8725727" BLOCK_SIZE="4096" TYPE="ext4" PARTUUID="046f4c25-8d42-0144-8919-012dc6b514fc"
@@ Line 524: / Line 564: @@
 </code>
+you can exit the editor with CTRL+X, then type Y for saving it.
 then note the UUID of the decrypted partition, here /dev/mapper/cryptodisk, whose UUID is in my case eb4337fa-a978-4aa6-a8c9-407b30af8b48. Modify the file /etc/fstab with the command:
@@ Line 529: / Line 570: @@
 nano /etc/fstab
 </code>
+you should check the line that has the mount point "/", and check that it is like the following, otherwise edit it and save it:
+<code>
+/dev/mapper/cryptodisk /               ext4    errors=remount-ro 0       1
+</code>
+you need finally to modify the file /etc/default/grub:
+<code>
+nano /etc/default/grub
+</code>
+you need to locate the entry "GRUB_CMDLINE_LINUX=" and change it to "GRUB_CMDLINE_LINUX="cryptdevice=UUID=<LUKS partition UUID>:cryptodisk root=/dev/mapper/cryptdisk"
+where you change <LUKS partition UUID> for the UUID of your encrypted partition.
+You can then enter:
+<code>
+sudo update-initramfs -u
+</code>
+and then:
+<code>
+update-grub
+</code>
+and finally the following commands:
+<code>
+exit
+sudo shutdown -r now
+</code>
+you will then remove your USB key and boot in your encrypted system hopefully. You should see a prompt asking to unlock your disk, and then your familiar OS will boot, with all the configuration you previously had. Congratulations !