Differences

This shows you the differences between two versions of the page.

--- reencrypt_linux_post_install [2025/05/03 18:43] – [Do the actual reencryption] usera
+++ reencrypt_linux_post_install [2026/06/19 09:25] (current) – usera
@@ Line 13: / Line 13: @@
 You should make (encrypted !) backups of your system all the time. However, you should **ABSOLUTELY** do it before any operation on your disks or partitions such as the one presented here: there is a significant risk to destroy ALL your data.
-I suggest a backup using two different open source softwares. The first one is [[https://clonezilla.org/downloads/download.php?branch=stable|Clonezilla]], it is free, open source and allows to make a disk image and save it in a compressed encrypted file to be stored on an external drive. With this, you will be able to restore your whole disk in its current state where it works fine.
+Please follow the procedures listed [[backup|here]] to do a backup of your disk image with Clonezilla and a second backup of all your non program files with restic.
-For this, you will need:
-  - An external hard drive to store the backup. I suggest using an external SSD with a capacity of roughly 3 times your whole drive capacity. For example, if you have a 500GB drive, you will probably be fine with a 2TB drive, but it should be used only for this purpose.
-  - An external USB stick to install CloneZilla. It should be at least 1GB and be used only for CloneZilla
-==== STEP 1.1: prepare the CloneZilla USB stick ====
-First, [[https://clonezilla.org/downloads/download.php?branch=stable|download]] the file as an iso.
-Then, verify the download, using the following commands:
-<code>
-wget https://clonezilla.org//downloads/stable/data/CHECKSUMS.TXT
-wget https://clonezilla.org//downloads/stable/data/CHECKSUMS.TXT.gpg
-gpg --keyserver hkp://keys.openpgp.org --recv-key 667857D045599AFD
-gpg --verify CHECKSUMS.TXT.gpg CHECKSUMS.TXT
-</code>
-The output should show the line:
-<code>
-gpg: Good signature from "DRBL Project (Diskless Remote Boot in Linux) <drbl@clonezilla.org>" [unknown]
-</code>
-You then have verified that the file CHECKSUM.TXT has been encrypted by the owner of the private key of the clonezilla project.
-You can then compare the checksum of your file with the content of CHECKSUMS.TXT:
-<code>
-sha256sum clonezilla-live-3.2.1-9-amd64.iso
-</code>
-Replace the filename with the actual file you downloaded if it is another version. Check that the output of this command is part of the output of:
-<code>
-cat CHECKSUMS.TXT
-</code>
-If so, you are sure to have the right file. You can then proceed to flash you USB key. I recommend using [[balena-etcher|Balena Etcher]], which is Open Source, user friendly and cross platform.
-==== STEP 1.2: prepare the external SSD ====
-You are going to make two partitions on your external SSD:
-  - __One unencrypted partition__, to store the encrypted compressed image that CloneZilla will output,
-  -  __One encrypted partition__, that will contain two virtual sub partitions:
-      - One for the backups of your /home directory (meaning Videos, Photos, Documents, ...) This will be done later with a software called BackinTime
-      - One for snapshots of your root filesystem (so your programs). This should be done later (but it will not be covered in this tutorial), once you have a stable encrypted system, with a program called Timeshift.
-For this you should use the gparted tool, that you can install with:
-<code>
-sudo apt install gparted
-</code>
-Launch it:
-<code>
-sudo gparted
-</code>
-This will prompt the following screen, where I will take the example of a small 1GB USB key formatting (a USB key behaves the same way as any storage device from a software perspective), but in your case you will have much more storage size. I recommend the first unencrypted partition to be roughly 1.5 the size of your disk, so maybe around 700GB for a 500GB disk.
-First it will prompt you to the partitioning of your current disk most likely. This is my case, where I have a standard partitioning for full disk encryption:
-  - One small (500MB for example) unencrypted partition in fat32 for the EFI boot system (/boot/efi)
-  - One small (500MB for example) unencrypted partition in ext4 for the boot partition (/boot)
-  - One large (in my case almost 500GB) encrypted partition in etx4 for my whole filesystem
-{{ ::gparted_1.png?600 |}}
-Select the disk you want to partition (beware that **the coming operations will delete all data that you have on this disk**).
-{{ ::gparted_2.png?600 |}}
-{{ ::gparted_3.png?600 |}}
-To modify the partitions you first need to unmount them
-{{ ::gparted_4.png?600 |}}
-Then you can create a new partition table. There are several type of such partition table, we will choose gpt, which is the most commonly used one.
-{{ ::gparted_5.png?600 |}}
-{{ ::gparted_6.png?600 |}}
-You can make a new partition now by right clicking on the empty space
-{{ ::gparted_7.png?600 |}}
-Choose the size you want (in this example I take 500MB for each partitions, in your case it could be 700GB and 1300GB)
-{{ ::gparted_8.png?600 |}}
-Repeat the operation for the second partition
-{{ ::gparted_9.png?600 |}}
-{{ ::gparted_10.png?600 |}}
-click on Apply (the green check mark). **You are warned: all data are going to be lost on this disk**. Click on Apply.
-{{ ::gparted_11.png?600 |}}
-you can then close gparted. Open a terminal and proceed to the encryption of the second partition. You can find its name with the command:
-<code>
-lsblk
-</code>
-In my case I get the following output:
-<code>
-NAME                             MAJ:MIN RM   SIZE RO TYPE  MOUNTPOINTS
-sda                                8:0    0 465.8G  0 disk
-├─sda1                             8:1    0   512M  0 part  /boot/efi
-├─sda2                             8:2    0   488M  0 part  /boot
-└─sda3                             8:3    0 464.8G  0 part
-  └─disk1                        254:0    0 464.8G  0 crypt
-    ├─usera--computer--vg-root   254:1    0    50G  0 lvm   /
-    ├─usera--computer--vg-swap_1 254:2    0   976M  0 lvm   [SWAP]
-    └─usera--computer--vg-home   254:3    0   410G  0 lvm   /home
-sdb                                8:16   1   960M  0 disk
-├─sdb1                             8:17   1   500M  0 part  /media/usera/2ef6dc0b-e0a8-4095-a9d9-437a367ae12a
-└─sdb2                             8:18   1   458M  0 part  /media/usera/76c9dcf2-6043-4f0a-8845-6218fd0bacbd
-</code>
-you can see that this command gives more details than gparted, especially since my encrypted disk is decrypted, and you can see the next level, three "sub partitions" hidden behind my encrypted disk, that correspond to my root partition (usera--computer--vg-root) containing my programs, my home partition (usera--computer--vg-home) containing my "normal" files and a swap partition (usera--computer--vg-swap) which is a special linux feature that allows to convert disk space into RAM when this resource is scarce.
-This parenthesis closed, I can identify the partition I want to encrypt: it is called sdb2 (in linux, disks are usually called sda, sdb, sdc..., and partitions in a disk called sda1, sda2, etc.).
-To encrypt the second partition, let us install the cryptsetup tool, in case it is not already there on your computer. Open a terminal and enter:
-<code>
-sudo apt-get -y install cryptsetup
-</code>
-Then you can proceed with the encryption (careful: if the partition you want to encrypt has another name, change it accordingly):
-<code>
-sudo umount /dev/sdb2
-sudo cryptsetup luksFormat /dev/sdb2
-</code>
-You need to enter 'YES' and then your strong passphrase two times.
-<code>
-WARNING: Device /dev/sdb2 already contains a 'ext4' superblock signature.
-WARNING!
-========
-This will overwrite data on /dev/sdb2 irrevocably.
-Are you sure? (Type 'yes' in capital letters): YES
-Enter passphrase for /dev/sdb2:
-Verify passphrase:
-</code>
-After a couple time (a bit more depending on the size of the partition), your partition is now encrypted.
-you can now decrypt it with the following command:
-<code>
-sudo cryptsetup luksOpen /dev/sdb2 cryptodisk
-</code>
-you will be prompted with your passphrase. Now that your disk is decrypted, you can check that the command:
-<code>
-lsblk
-</code>
-gives a different result:
-<code>
-NAME                             MAJ:MIN RM   SIZE RO TYPE  MOUNTPOINTS
-sda                                8:0    0 465.8G  0 disk
-├─sda1                             8:1    0   512M  0 part  /boot/efi
-├─sda2                             8:2    0   488M  0 part  /boot
-└─sda3                             8:3    0 464.8G  0 part
-  └─disk1                        254:0    0 464.8G  0 crypt
-    ├─usera--computer--vg-root   254:1    0    50G  0 lvm   /
-    ├─usera--computer--vg-swap_1 254:2    0   976M  0 lvm   [SWAP]
-    └─usera--computer--vg-home   254:3    0   410G  0 lvm   /home
-sdb                                8:16   1   960M  0 disk
-├─sdb1                             8:17   1   500M  0 part  /media/usera/2ef6dc0b-e0a8-4095-a9d9-437a367ae12a
-└─sdb2                             8:18   1   458M  0 part
-  └─cryptodisk                   254:4    0   442M  0 crypt
-sr0                               11:0    1  1024M  0 rom
-</code>
-We will now prepare the two "sub partitions" that we talked about before. This is done with a system called LVM (Logical Volume Manager). It can be installed with the following command, if it is not already on your distribution:
-<code>
-sudo apt install lvm2
-</code>
-you will need to execute the following commands:
-You first create what we call a "Physical Volume" for LVM out of the decrypted disk:
-<code>
-sudo pvcreate /dev/mapper/cryptodisk
-</code>
-then you create a "Volume Group" in this physical volume:
-<code>
-sudo vgcreate vgbackup /dev/mapper/cryptodisk
-</code>
-Then you create two "Logical Volumes" in the "Volume Group". In your case, you want to replace "250M" in the command below with something like 1.5 times the size of your programs, something like 80GB should be enough. You would then enter "80G".
-<code>
-sudo lvcreate -L 250M -n root vgbackup
-sudo lvcreate -l 100%FREE -n home vgbackup
-</code>
-then you can check again the output of
-<code>
-lsblk
-</code>
-You can see that we have the right partitioning:
-<code>
-NAME                             MAJ:MIN RM   SIZE RO TYPE  MOUNTPOINTS
-sda                                8:0    0 465.8G  0 disk
-├─sda1                             8:1    0   512M  0 part  /boot/efi
-├─sda2                             8:2    0   488M  0 part  /boot
-└─sda3                             8:3    0 464.8G  0 part
-  └─disk1                        254:0    0 464.8G  0 crypt
-    ├─usera--computer--vg-root   254:1    0    50G  0 lvm   /
-    ├─usera--computer--vg-swap_1 254:2    0   976M  0 lvm   [SWAP]
-    └─usera--computer--vg-home   254:3    0   410G  0 lvm   /home
-sdb                                8:16   1   960M  0 disk
-├─sdb1                             8:17   1   500M  0 part  /media/usera/2ef6dc0b-e0a8-4095-a9d9-437a367ae12a
-└─sdb2                             8:18   1   458M  0 part
-  └─cryptodisk                   254:4    0   442M  0 crypt
-    ├─vgbackup-root              254:5    0   252M  0 lvm
-    └─vgbackup-home              254:6    0   188M  0 lvm
-sr0                               11:0    1  1024M  0 rom
-</code>
-Then you need to create a "file system" in those "sub partitions", or Logical Volumes:
-<code>
-sudo mkfs.ext4 /dev/mapper/vgbackup-root
-sudo mkfs.ext4 /dev/mapper/vgbackup-home
-</code>
-this formatted those partitions with the filesystem called "ext4", which is a default Linux filesystem.
-In what we did, there are several levels of partitions that you need to know:
-{{ ::partitionning.png?600 |}}
-You can then close the LVM:
-<code>
-sudo vgchange -an vgbackup
-</code>
-and the luks container:
-<code>
-sudo cryptsetup luksClose cryptodisk
-</code>
-==== STEP 1.3: do the actual backup ====
-you can then follow the [[https://clonezilla.org/show-live-doc-content.php?topic=clonezilla-live/doc/01_Save_disk_image|clonezilla guide]] to backup your whole image to an encrypted image stored in your unencrypted partition. Do not forget to tick the "encrypt your image" option, and secure it with a strong passphrase that you will remember.
-Once this is done, you can do another backup of your /home, which contains all your regular files. For this you can use the software backintime. You can install it with:
-<code>
-sudo apt install backintime-qt
-</code>
-Before launching it, we need to decrypt the encrypted disk, and mount the logical volume we intend to use:
-<code>
-sudo cryptsetup luksOpen /dev/sdb2 cryptsetup
-sudo vgchange -ay
-sudo mount /dev/mapper/vgbackup-home /mnt
-</code>
-now everything written on /mnt on your computer will be written on your disk.
-You can then launch backintime with:
-<code>
-sudo backintime-qt
-</code>
-you can then configure it to save things in /mnt:
-{{ ::backintime_1.png?600 |}}
-{{ ::backintime_2.png?600 |}}
-{{ ::backintime_3.png?600 |}}
-And then click on "Take snapshot" and wait for it to finish:
-{{ ::backintime_4.png?600 |}}
-you can then unmount and remove your backup disk:
-<code>
-sudo umount /mnt
-sudo vgchange -an vgbackup
-sudo cryptsetup luksClose cryptodisk
-</code>
 ===== STEP 2: Setup your partitioning =====
@@ Line 476: / Line 184: @@
 Resizing the filesystem on /dev/mapper/cryptodisk to 77879296 (4k) blocks.
 The filesystem on /dev/mapper/cryptodisk is now 77879296 (4k) blocks long.
+</code>
+Now, you need to note down the content of the file /etc/resolv.conf, which is use by linux to access internet:
+<code>
+cat /etc/resolv.conf
 </code>
@@ Line 492: / Line 205: @@
 </code>
-the prompt will change a bit: you are now an administrator inside your own system! Enter the following command:
+the prompt will change a bit: you are now an administrator inside your own system!
+Let us first check that we are connected to internet. To do that, you need to try to ping a website:
+<code>
+ping google.com
+</code>
+if you see something like this:
+<code>
+(base) usera@debian:~$ ping google.com
+PING google.com (142.250.74.78) 56(84) bytes of data.
+bytes from arn09s23-in-f14.1e100.net (142.250.74.78): icmp_seq=1 ttl=113 time=20.3 ms
+bytes from arn09s23-in-f14.1e100.net (142.250.74.78): icmp_seq=2 ttl=113 time=21.3 ms
+bytes from arn09s23-in-f14.1e100.net (142.250.74.78): icmp_seq=3 ttl=113 time=20.4 ms
+</code>
+then you are good to go, you can do CTRL+C to stop it. Otherwise, try copying the content of the /etc/resolv.conf file from before:
+<code>
+nano /etc/resolv.conf
+</code>
+then paste the content, and enter CTRL+X, then Y do save the changes. Try again to ping:
+<code>
+ping google.com
+</code>
+It should work now.
+Now, install some required packages:
+<code>
+sudo apt install cryptsetup cryptsetup-initramfs
+</code>
+and let us do some modifications.
+Enter the following command:
 <code>
@@ Line 537: / Line 285: @@
 </code>
+you need finally to modify the file /etc/default/grub:
+<code>
+nano /etc/default/grub
+</code>
+you need to locate the entry "GRUB_CMDLINE_LINUX=" and change it to "GRUB_CMDLINE_LINUX="cryptdevice=UUID=<LUKS partition UUID>:cryptodisk root=/dev/mapper/cryptdisk"
+where you change <LUKS partition UUID> for the UUID of your encrypted partition.
 You can then enter: