LinuxQuestions.org
Share your knowledge at the LQ Wiki.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 01-09-2013, 09:52 AM   #1
edwardcode
Member
 
Registered: Apr 2010
Posts: 161

Rep: Reputation: 17
Disk encryption


I have a system that is already installed and I was wondering if I could encrypt the HDD with out reloading the os. I know luks is what rhel 6 uses but I do not know how to do that with out reloading the os.

Any help would be great.

Thanks
 
Old 01-10-2013, 02:46 AM   #2
pan64
LQ Addict
 
Registered: Mar 2012
Location: Hungary
Distribution: debian/ubuntu/suse ...
Posts: 21,842

Rep: Reputation: 7308Reputation: 7308Reputation: 7308Reputation: 7308Reputation: 7308Reputation: 7308Reputation: 7308Reputation: 7308Reputation: 7308Reputation: 7308Reputation: 7308
As far as I know a partition of a living os cannot be altered (encrypted).
 
Old 01-10-2013, 08:59 AM   #3
sundialsvcs
LQ Guru
 
Registered: Feb 2004
Location: SE Tennessee, USA
Distribution: Gentoo, LFS
Posts: 10,659
Blog Entries: 4

Rep: Reputation: 3941Reputation: 3941Reputation: 3941Reputation: 3941Reputation: 3941Reputation: 3941Reputation: 3941Reputation: 3941Reputation: 3941Reputation: 3941Reputation: 3941
Indeed. And if you do feel the need to encrypt a volume, save yourself a lot of work and get a SAN or similar device which will do the encryption for you in the disk-controller hardware.
 
Old 01-10-2013, 11:43 AM   #4
DavidMcCann
LQ Veteran
 
Registered: Jul 2006
Location: London
Distribution: PCLinuxOS, Debian
Posts: 6,142

Rep: Reputation: 2314Reputation: 2314Reputation: 2314Reputation: 2314Reputation: 2314Reputation: 2314Reputation: 2314Reputation: 2314Reputation: 2314Reputation: 2314Reputation: 2314
Ideally, one needs to have started by installing a distro that asks you if you want encryption during the installation! But you can encrypt /home later with a bit of hard work. I've never tried it, but the information is (as ever) out there:
http://robert.penz.name/145/home_par...s_under_linux/
https://www.cs.arizona.edu/computing...ncryption.html
 
Old 01-10-2013, 12:39 PM   #5
edwardcode
Member
 
Registered: Apr 2010
Posts: 161

Original Poster
Rep: Reputation: 17
what if I boot off of a disk and then encrypt the disk? Will that work or will any way I encrypt a disk reformat the disk?
 
Old 01-10-2013, 03:57 PM   #6
NyteOwl
Member
 
Registered: Aug 2008
Location: Nova Scotia, Canada
Distribution: Slackware, OpenBSD, others periodically
Posts: 512

Rep: Reputation: 139Reputation: 139
You can do a full disk encryption (all but a small boot aprtition) from most distro isntall disks. Just do your reading and planning ahead of time. It is not possible to encrypt a drive in situ in Linux.
 
Old 01-13-2013, 09:32 PM   #7
sundialsvcs
LQ Guru
 
Registered: Feb 2004
Location: SE Tennessee, USA
Distribution: Gentoo, LFS
Posts: 10,659
Blog Entries: 4

Rep: Reputation: 3941Reputation: 3941Reputation: 3941Reputation: 3941Reputation: 3941Reputation: 3941Reputation: 3941Reputation: 3941Reputation: 3941Reputation: 3941Reputation: 3941
... and may I repeat ... it's quite inefficient (IMHO) to do this sort of thing in software.

What you're really trying to guard against, I think, is the possibility that the disk is stolen, or unscrupulously duplicated. A disk controller, or in some cases the drive itself, can have hardware encryption facilities which encrypt, decrypt, and validate the data with no loss of speed. Many government contracts (including non-classified ones) mandate the use of such facilities, so the technology is out there. To the properly-authorized computer, the drive is "perfectly ordinary." But if you steal it, it's useless to you. Furthermore, if you attempt to use the wrong key, it knows you're trying to use the wrong key, and it won't let you do anything ... but of course you can't deduce what 'the right key' is.

(Alice and Bob can use their data as they ordinarily would, and as quickly, without suffering inconvenience, while Eve says, "curses! foiled again!" Exactly as good encryption ought to be ...)

Last edited by sundialsvcs; 01-13-2013 at 09:36 PM.
 
Old 01-14-2013, 10:36 AM   #8
rknichols
Senior Member
 
Registered: Aug 2009
Distribution: Rocky Linux
Posts: 4,779

Rep: Reputation: 2212Reputation: 2212Reputation: 2212Reputation: 2212Reputation: 2212Reputation: 2212Reputation: 2212Reputation: 2212Reputation: 2212Reputation: 2212Reputation: 2212
Quote:
Originally Posted by NyteOwl View Post
It is not possible to encrypt a drive in situ in Linux.
Actually, recent versions of cryptsetup (currently 1.6.0) include an optional re-encryption tool that is capable of adding LUKS encryption to an existing partition. But, you really need to know what you are doing (e.g., shrinking the filesystem to make space for the LUKS header), and have a current backup. The (lengthy) process can be suspended and resumed, but there are many opportunities for unrecoverable errors, especially when the filesystem is being shifted to make space for the LUKS header.
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
disk full, encryption dawee Ubuntu 2 07-03-2012 02:46 AM
[SOLVED] disk encryption question Dave_P Linux - General 5 09-29-2011 04:59 PM
dd and disk encryption Feeg Linux - Security 6 12-13-2008 05:55 PM
NAS + disk encryption Chris594 Linux - Networking 4 07-11-2006 12:31 PM
disk encryption ankscorek Linux - Security 5 05-03-2006 12:59 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 05:12 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration