I have existing systems with un-encrypted disks. I have tried unsuccessfully to encrypt them using LUKS. Has anyone out there been able to encrypt an existing system (after the fact, so to speak)?
TIA
7 thoughts on - LUKS Question
Using cryptsetup to create a LUKS encrypted disk will wipe all the data on an existing disk.
Mark
This is easy to understand if one considers them as layers: and you can not sneak anything underneath existing layer, you can only put next layer on top of existing (first is without second is with encryption):
physical or virtual disk –> filesystem
physical or virtual disk –> encryption layer –> filesystem
I hope, this helps.
Valeri
++++++++++++++++++++++++++++++++++++++++
Valeri Galtsev Sr System Administrator Department of Astronomy and Astrophysics Kavli Institute for Cosmological Physics University of Chicago Phone: 773-702-4247
++++++++++++++++++++++++++++++++++++++++
You can do that with cryptsetup-reencrypt, but it needs to be able to make space for the ~2MB LUKS header ahead of the filesystem in the partition. That’s a fairly risky operation — shrinking the filesystem slightly and shifting it over. An alternative is LUKS with a detached header, but maintaining that relationship is an administrative headache with a severe penalty for error.
the whole reencrypt process is subject to complete failure if the system reboots partly through as there’s no way to deal with partially encrypted and partially cleartext.
I’d say disk encryption in general is an admin headache with severe penalty for error.
If your requirement is for the entire system to be encrypted then I think the only is a system rebuild, but if you can convince management that a good compromise is encrypting only the applications and their data, you should be able to add encrypted storage, copy the sensitive files and wipe the old allocations. I have done this for a test system encrypting a MySQL database instance and a web server instance, in anticipation of an “encrypted at rest” directive coming down from management.
How about:
Add temporary storage, encrypted, set as a PV, add to VG. Rebuild initramfs, and reboot, confirming that it properly unlocks the storage as expected. pvmove, delete internal PV and replace with encrypted PV, pvmove back?
You’d hope that’d be quite tolerant of being interrupted in the middle.
If you’re happy that works, the same recipe should work without a reboot.
jh
John Hodrien wrote:
that a Or, as we’re doing, make sure everyone’s off, make a final full backup (I
assume you’re doing nightly backups), rebuild, then restore from backup.
7 thoughts on - LUKS Question
Using cryptsetup to create a LUKS encrypted disk will wipe all the data on an existing disk.
Mark
This is easy to understand if one considers them as layers: and you can not sneak anything underneath existing layer, you can only put next layer on top of existing (first is without second is with encryption):
physical or virtual disk –> filesystem
physical or virtual disk –> encryption layer –> filesystem
I hope, this helps.
Valeri
++++++++++++++++++++++++++++++++++++++++
Valeri Galtsev Sr System Administrator Department of Astronomy and Astrophysics Kavli Institute for Cosmological Physics University of Chicago Phone: 773-702-4247
++++++++++++++++++++++++++++++++++++++++
You can do that with cryptsetup-reencrypt, but it needs to be able to make space for the ~2MB LUKS header ahead of the filesystem in the partition. That’s a fairly risky operation — shrinking the filesystem slightly and shifting it over. An alternative is LUKS with a detached header, but maintaining that relationship is an administrative headache with a severe penalty for error.
the whole reencrypt process is subject to complete failure if the system reboots partly through as there’s no way to deal with partially encrypted and partially cleartext.
I’d say disk encryption in general is an admin headache with severe penalty for error.
If your requirement is for the entire system to be encrypted then I think the only is a system rebuild, but if you can convince management that a good compromise is encrypting only the applications and their data, you should be able to add encrypted storage, copy the sensitive files and wipe the old allocations. I have done this for a test system encrypting a MySQL database instance and a web server instance, in anticipation of an “encrypted at rest” directive coming down from management.
How about:
Add temporary storage, encrypted, set as a PV, add to VG. Rebuild initramfs, and reboot, confirming that it properly unlocks the storage as expected. pvmove, delete internal PV and replace with encrypted PV, pvmove back?
You’d hope that’d be quite tolerant of being interrupted in the middle.
If you’re happy that works, the same recipe should work without a reboot.
jh
John Hodrien wrote:
that a Or, as we’re doing, make sure everyone’s off, make a final full backup (I
assume you’re doing nightly backups), rebuild, then restore from backup.
mark