Ask HN: What Do You Use for Linux Full Disk Crypto? • Hacker News Board

Re: Ask HN: What Do You Use for Linux Full Disk Crypto?

#41

Post by zAy0LfpBZLC8mAC » Mon, Mar 04, 2019, 11:41 AM UTC

jason_slack wrote: post #36

Actually, this poses a question. I have disk encryption enabled on my laptop. Now I want to put in a larger hard drive and clone the current drive on to it. Without disk encryption I could use clonezilla or other tools. With disk encryption enabled I can't seem to do anything to clone. What is a solution?

Why would it matter whether the disk is encrypted? No clue what clonezilla is or does, but dd certainly doesn't care whether a partition you are copying is encrypted.

Re: Ask HN: What Do You Use for Linux Full Disk Crypto?

#42

Post by ef004 » Mon, Mar 04, 2019, 11:44 AM UTC

jason_slack wrote: post #36

Actually, this poses a question. I have disk encryption enabled on my laptop. Now I want to put in a larger hard drive and clone the current drive on to it. Without disk encryption I could use clonezilla or other tools. With disk encryption enabled I can't seem to do anything to clone. What is a solution?

prepare an encrypted partition on the new drive, then mount both the new and the old encrypted partition and rsync/cp -R everything over? i guess you need to take care of the boot loader and maybe /etc/fstab separately

alternativly, clonezilla should be able to back up your partition if you cryptsetup open it but I've never used clonezilla so I don't know for sure

Re: Ask HN: What Do You Use for Linux Full Disk Crypto?

#43

Post by convery » Mon, Mar 04, 2019, 11:51 AM UTC

Usually just Veracrypt since I can use it on Windows as well..

Re: Ask HN: What Do You Use for Linux Full Disk Crypto?

#44

Post by rca » Mon, Mar 04, 2019, 12:24 PM UTC

You can probably use luksHeaderBackup and luksHeaderRestore to make sure your recovery key will always work with the volume. Although I've never tried it so don't take my word for it, it should be pretty easy for you to try out.

Not that it will prevent any dedicated user with root rights from locking you out of the data if they wish to. It just raises friction from a simple luksRemoveKey

Re: Ask HN: What Do You Use for Linux Full Disk Crypto?

#45

Post by craftoman » Mon, Mar 04, 2019, 2:52 PM UTC

I'm using Debian with full disk encryption using the help of Debian Installer. Such a great tool, during installation and setup sometimes you might get confused when messing up with physical and encrypted partitions.

Re: Ask HN: What Do You Use for Linux Full Disk Crypto?

#46

Post by pnutjam » Mon, Mar 04, 2019, 2:56 PM UTC

zAy0LfpBZLC8mAC wrote: post #41

jason_slack wrote: post #36

Actually, this poses a question. I have disk encryption enabled on my laptop. Now I want to put in a larger hard drive and clone the current drive on to it. Without disk encryption I could use clonezilla or other tools. With disk encryption enabled I can't seem to do anything to clone. What is a solution?

Why would it matter whether the disk is encrypted? No clue what clonezilla is or does, but dd certainly doesn't care whether a partition you are copying is encrypted.

I think clonezilla uses partition specific tools for copying. You could dd to a new drive, but you would not be able to enlarge the partition. You would need to create a larger partition manually an copy data.

You might be able to do a fresh install (same version) and then copy over it with your existing installation. You'd have to mount both partitions.

Re: Ask HN: What Do You Use for Linux Full Disk Crypto?

#47

Post by Tsiklon » Mon, Mar 04, 2019, 3:39 PM UTC

jason_slack wrote: post #36

Actually, this poses a question. I have disk encryption enabled on my laptop. Now I want to put in a larger hard drive and clone the current drive on to it. Without disk encryption I could use clonezilla or other tools. With disk encryption enabled I can't seem to do anything to clone. What is a solution?

Assuming you're using Linux, if you're using LVM on LUKS:

Back everything up first.

- Boot to a live disk.

- DD the disk from the first sector to the end of /boot over to the new disk.

- open your preferred partitioning tool to fix the GPT (as no backup GPT will be present on the second disk)

- remove the partition denoting crypto-vol1 from the second disk - note the first sector

- add a new partition starting from the original start of crypto-vol1 to the end of the disk

- FSCK the partition /boot sits on

- create a second crypto volume on the new partition on the second disk

- create a single Physical volume on Crypto-Vol2.

- add the PV to the same Volume Group as the PV containing Crypto-Vol1

- PV Move everything from Crypto-Vol1 -> Crypto-Vol2

- extend your logical volumes to the desired length with lvextend, and complete the work with your filesystem's resize tool

At this point all your data is present on the new disk

From here you'll want to mount the filesystems and chroot into the system - you'll need to edit /etc/crypttab replacing the entry for Crypto-Vol1 with the UUID for Crypto-Vol2. Then you'll need to regenerate your initramfs to load the new crypttab. This will allow you to boot from the system on the new disk.

I've likely forgotten something here - It's quite an involved process - but not impossible.

Re: Ask HN: What Do You Use for Linux Full Disk Crypto?

#48

Post by rkangel » Mon, Mar 04, 2019, 4:37 PM UTC

jusssi wrote: post #12

mrkeen wrote: post #6

During installation, I tick the box that says 'full disk encryption'.

Which distro are you using? The last I tried with Ubuntu, it "just didn't work", i.e. failed with very unhelpful error message. Bonus points if it's possible to install to a partition in existing FDE container (saves a /home backup-restore external drive round trip).

Works well for me in Fedora (28 and 29).

Re: Ask HN: What Do You Use for Linux Full Disk Crypto?

#49

Post by girzel » Mon, Mar 04, 2019, 5:32 PM UTC

I have a yubikey, and this[0] tutorial has been open in a browser tab for I swear four months or more. I just haven't summoned the guts to do it -- a voice in my head keeps whispering "you'll brick your laptop, you'll brick your laptop..."

[0] https://github.com/agherzan/yubikey-full-disk-encryption

Re: Ask HN: What Do You Use for Linux Full Disk Crypto?

#50

Post by atmosx » Tue, Mar 05, 2019, 12:05 AM UTC

Biskit1943 wrote: post #15

rb666 wrote: post #5

(very soon) ZFS! It's happening: https://github.com/zfsonlinux/zfs/releases The PR started 3 years ago: https://github.com/zfsonlinux/zfs/pull/4329

Can you explain to me why i should use zfs instead of ext4?

You can compare ZFS to BTRFS, Ext4FS belongs to the late 90s. Comparing ZFS to Ext4 is like comparing a Pentium 100 Mhz to a Quad Core, asking why would someone want to use the quad core.