3

I recently installed Antergos (which is basically Arch) and set it to use full disk encryption. Now, I want to migrate from encrypt to sd-encrypt because I want to be able to hibernate and I couldn't put swap partition in the same LUKS volume..

Background

During the setup:

  • I used LUKS for / partition and swap partition,
  • because my main SSD is small, I wanted to be able to hibernate and I have 32GB of RAM I created the encrypted swap partition on the second drive,
  • I mounted swap partition (as well as another encrypted EXT4 partition from the second drive) using /etc/crypttab.

I tested that installation works, grub let me boot into both linux and dual booted Windows, on Linux boot it decrypts and mounts both encrypted drives.

However, I was getting error about not finding disk with the UUID of a swap drive, and Arch manual confirmed that encrypt which I got from installer can handle only one encrypted partition during boot. If I want to handle more of them I should move to sd-encrypt. However, even after reading the documentation I am not certain what I have to do in order to migrate to sd-encrypt.

Details

  • HOOKS="base udev autodetect modconf block keyboard keymap encrypt resume filesystems fsck"
  • GRUB_CMDLINE_LINUX_DEFAULT="quiet resume=UUID=[encrypted swap UUID]"
  • GRUB_CMDLINE_LINUX=cryptdevice=/dev/disk/by-uuid/[/ UUID]:Arch_crypt
  • GRUB_ENABLE_CRYPTODISK=y

  • /etc/crypttab

      swap_crypt /dev/disk/by-uuid/[/ UUID] password_file luks
  data_crypt /dev/disk/by-uuid/[/ UUID] password_file luks

What else should I do after I change encrypt to sd-encrypt in HOOKS? Do I have to create a /etc/crypttab.initramfs and move swap_crypt there? Do I have to change luks to rd.luks? Both swap partition and / partition uses the same password, so according to the documentation both should be mounted on boot after I entered the password once, is that right? Documentation mentions luks.* and rd.luks.* params and similar - do I have to use them and if so, where should I put them?

Mateusz Kubuszok
  • 143
  • 1
  • 8

1 Answers1

3

I don't use Grub myself (but Arch and sd-encrypt) but from my kernel options I guess you would have to transform your configuration to look like (don't forget to backup your old configuration before switching).

HOOKS="base systemd autodetect modconf block keyboard sd-vconsole sd-encrypt resume filesystems fsck"

GRUB_CMDLINE_LINUX_DEFAULT="quiet resume=UUID=[decrypted swap UUID]" 
# I use resume=/dev/mapper/name-of-decrypted-device

GRUB_CMDLINE_LINUX=luks.uuid=[/ encrypted UUID] luks.uuid=[swap encrypted UUID]
GRUB_ENABLE_CRYPTODISK=y

/etc/crypttab

  swap_crypt /dev/disk/by-uuid/[/ UUID] password_file luks
  data_crypt /dev/disk/by-uuid/[/ UUID] password_file luks

Don't forget to run mkinitcpio -p linux or the equivalent to regenerate your initramfs, once the modification of the HOOKS have been done. And the grub.cfg file with grub-mkconfig -o /boot/grub/grub.cfg or something similar.

Pierre-Alain TORET
  • 891
  • 5
  • 9
  • 1
    Just small note: I empirically checked that when you need to refer to `/dev/mapper/somename` you should use `luks.name=[UUID]=somename` because with sd-encrypt `crypttab` is not run. – Mateusz Kubuszok Apr 25 '19 at 16:22