Linux Disk Encryption - Revision history

Phil: /* Fedora 31, RHEL 7, CentOS 7 */

2020-02-13T16:59:50Z

Fedora 31, RHEL 7, CentOS 7

Phil: /* Fedora 29, RHEL 7, CentOS 7 */

2020-02-12T22:27:35Z

Fedora 29, RHEL 7, CentOS 7

Phil: /* Disk Encrypton During System Installation */ Verify the instructions still work for current OS releases.

2019-04-10T19:36:15Z

Disk Encrypton During System Installation: Verify the instructions still work for current OS releases.

Phil.cs.jhu.edu at 20:49, 13 January 2016

2016-01-13T20:49:28Z

Phil.cs.jhu.edu at 20:48, 13 January 2016

2016-01-13T20:48:06Z

Phil.cs.jhu.edu: Created page with "This page describes some methods for encrypting the disks on a Linux system. For an overview of CS Department disk encryption recommendations, please see Disk Encryption...."

2016-01-13T20:30:45Z

Created page with "This page describes some methods for encrypting the disks on a Linux system. For an overview of CS Department disk encryption recommendations, please see Disk Encryption...."

New page

This page describes some methods for encrypting the disks on a Linux system. For an overview of CS Department disk encryption recommendations, please see [[Disk Encryption]]. Windows and OSX instructions are coming soon.

The short version of the rest of this page is: Choose a good passphrase and enable disk encryption when you install Linux. If you're already running Linux, back up your data, reinstall Linux (enabling disk encryption when you do so), and then restore your data from the backups.

== Choose a Good Passphrase ==

Effective disk encryption requires a good passphrase. Please see the [[Disk Encryption#Disk Encryption Passphrases|Disk Encryption Passphrases]] section of our overview page for appropriate recommendations.

== Disk Encrypton During System Installation ==

Linux has built-in disk encryption known as LUKS (Linux Unified Key Setup). Unfortunately, there aren't really any good ways to add encryption to an existing system without reinstalling everything. We recommend making a copy of your <tt>/home</tt> directory (and possibly <tt>/etc</tt>, if you've altered your system configuration significantly) onto an external disk or another computer, reinstalling Linux, enabling encryption during the installation, copying your data back onto the system, and wiping the external disk (unless it was also encrypted).

The methods for enabling encryption vary with each Linux distribution. We do not have the resources to support all of them, but we have some guidance on several of the more popular distributions at the time of this document's writing.

=== Ubuntu 14.04 LTS ===

In the "Installation type" screen, make sure you have checked "Encrypt the new Ubuntu installation for security".

On the next screen, enter your disk passphrase and check "Overwrite empty disk space".

When you create an account, you do not need to check "Encrypt my home folder".

=== Debian 8 (jessie) ===

In the "Partition disks" screen, select "Guided - use entire disk and set up encrypted LVM". If you prefer to use manual partitioning, create your boot and main partitions, use the main partition as an encryption partition, use the new encrpyted device as an LVM physical volume, and proceed from there as usual.

=== Fedora 23, RHEL 7, CentOS 7 ===

(As of January 2016, the latest Fedora, RHEL, and CentOS releases all work the same with respect to disk encryption.)

Go into the "Installation Destination" section of the installer. Under "Other Storage Options", check the box next to "Encrypt my data".

=== OpenSUSE Tumbleweed ===

On the "Suggested Partitioning" screen, click the "Edit Proposal Settings" button. Check both "Create LVM-based Proposal" and "Encrypt Volume Group".

== Disk Encryption After Installation ==

Linux doesn't have great support for encrypting an existing filesystem. There are a few possibilities for that, but we don't have the resources to provide support for them.

The follow information is provided for reference, but our recommendation is to perform a complete reinstallation and enable full-disk encryption during the installation process.

=== Ubuntu ===

If you're running Ubuntu, you might be able to encrypt your home directory on the fly by installing <tt>ecryptfs</tt> and then running <tt>ecryptfs-migrate-home -u ''account-name''</tt>. Note that the migration command must be run as root without the affected account being logged in (so you'll have to log out, switch to a text console, log in as root, and then run it).

''This is not as good as full disk encryption. Although your home directory will be protected, information can still leak to unencrypted places such as system logfiles and swapspace. You should perform a reinstall and enable full disk encryption during the installation process.''

=== luksipc ===

There is a program named [https://github.com/johndoe31415/luksipc luksipc] (LUKS in-place conversion) that was created to convert existing partitions to encrypted partitions. It is a very low-level program that comes with the strong possibility of erasing all of your data. We do not support its use; it's mentioned here for completeness.

''luksipc can delete all of your data if you're not extremely careful (and possibly even if you are). We recommend reinstalling Linux and enabling full disk encryption during the installation process.''

[[Category:Security]]

@@ Line 25: / Line 25: @@
 In the "Partition disks" screen, select "Guided - use entire disk and set up encrypted LVM".  If you prefer to use manual partitioning, create your boot and main partitions, use the main partition as an encryption partition, use the new encrypted device as an LVM physical volume, and proceed from there as usual.
-=== Fedora 31, RHEL 7, CentOS 7 ===
+=== Fedora 31, RHEL 8, CentOS 8 ===
 (As of February 2020, the latest Fedora, RHEL, and CentOS releases all work the same with respect to disk encryption.)
-Go into the "Installation Destination" section of the installer.  Under "Other Storage Options", check the box next to "Encrypt my data".
+Go into the "Installation Destination" section of the installer.  Under "Encryption", check the box next to "Encrypt my data".
 === OpenSUSE Tumbleweed ===

@@ Line 25: / Line 25: @@
 In the "Partition disks" screen, select "Guided - use entire disk and set up encrypted LVM".  If you prefer to use manual partitioning, create your boot and main partitions, use the main partition as an encryption partition, use the new encrypted device as an LVM physical volume, and proceed from there as usual.
-=== Fedora 29, RHEL 7, CentOS 7 ===
+=== Fedora 31, RHEL 7, CentOS 7 ===
-(As of April 2019, the latest Fedora, RHEL, and CentOS releases all work the same with respect to disk encryption.)
+(As of February 2020, the latest Fedora, RHEL, and CentOS releases all work the same with respect to disk encryption.)
 Go into the "Installation Destination" section of the installer.  Under "Other Storage Options", check the box next to "Encrypt my data".

← Older revision		Revision as of 20:48, 13 January 2016
Line 53:		Line 53:
	''luksipc can delete all of your data if you're not extremely careful (and possibly even if you are). We recommend reinstalling Linux and enabling full disk encryption during the installation process.''		''luksipc can delete all of your data if you're not extremely careful (and possibly even if you are). We recommend reinstalling Linux and enabling full disk encryption during the installation process.''

−	[[Category:~~Security~~]]	+	[[Category:Disk Encryption]]

@@ Line 13: / Line 13: @@
 The methods for enabling encryption vary with each Linux distribution.  We do not have the resources to support all of them, but we have some guidance on several of the more popular distributions at the time of this document's writing.
-=== Ubuntu 14.04 LTS ===
+=== Ubuntu 18.04 LTS ===
 In the "Installation type" screen, make sure you have checked "Encrypt the new Ubuntu installation for security".
@@ Line 21: / Line 21: @@
 When you create an account, you do not need to check "Encrypt my home folder".
-=== Debian 8 (jessie) ===
+=== Debian 9 (stretch) ===
-In the "Partition disks" screen, select "Guided - use entire disk and set up encrypted LVM".  If you prefer to use manual partitioning, create your boot and main partitions, use the main partition as an encryption partition, use the new encrpyted device as an LVM physical volume, and proceed from there as usual.
+In the "Partition disks" screen, select "Guided - use entire disk and set up encrypted LVM".  If you prefer to use manual partitioning, create your boot and main partitions, use the main partition as an encryption partition, use the new encrypted device as an LVM physical volume, and proceed from there as usual.
-=== Fedora 23, RHEL 7, CentOS 7 ===
+=== Fedora 29, RHEL 7, CentOS 7 ===
-(As of January 2016, the latest Fedora, RHEL, and CentOS releases all work the same with respect to disk encryption.)
+(As of April 2019, the latest Fedora, RHEL, and CentOS releases all work the same with respect to disk encryption.)
 Go into the "Installation Destination" section of the installer.  Under "Other Storage Options", check the box next to "Encrypt my data".

@@ Line 1: / Line 1: @@
-This page describes some methods for encrypting the disks on a Linux system.  For an overview of CS Department disk encryption recommendations, please see [[Disk Encryption]].  Windows and OSX instructions are coming soon.
+This page describes some methods for encrypting the disks on a Linux system.  For an overview of CS Department disk encryption recommendations, please see [[:Category:Disk Encryption|Disk Encryption]].  Windows and OSX instructions are coming soon.
 The short version of the rest of this page is:  Choose a good passphrase and enable disk encryption when you install Linux.  If you're already running Linux, back up your data, reinstall Linux (enabling disk encryption when you do so), and then restore your data from the backups.
@@ Line 5: / Line 5: @@
 == Choose a Good Passphrase ==
-Effective disk encryption requires a good passphrase.  Please see the [[Disk Encryption#Disk Encryption Passphrases|Disk Encryption Passphrases]] section of our overview page for appropriate recommendations.
+Effective disk encryption requires a good passphrase.  Please see the [[:Category:Disk Encryption#Disk Encryption Passphrases|Disk Encryption Passphrases]] section of our overview page for appropriate recommendations.
 == Disk Encrypton During System Installation ==