Convert and install to LUKS Encrypted Drive Ubuntu 18.04 19.10 Linux Mint and Debian Based Linux

The reason for doing this is that the installer doesn't seem to work properly for LUKS and the server installer doesn't even support LUKS anymore.  When you use the GUI install on Desktop for LUKS it won't boot and will just hang after you enter your password.  So the only reliable way is to do it ourselves.

1.) Make a default minimal install of Ubuntu


2.) Have a secondary disk on the server or VM.

3.) Create the following on the secondary disk (we assume it is /dev/sdb)
/dev/sdb1 = /boot 1G
/dev/sdb2 = / (rest of free space)

Use fdisk or gdisk

4.) Create LUKS for root on /dev/sdb2

cryptsetup --verbose --verify-passphrase luksFormat /dev/sdb2

WARNING!
========
This will overwrite data on /dev/sdb2 irrevocably.

Are you sure? (Type uppercase yes): YES
Enter passphrase for /dev/sdb2:
Verify passphrase:
Command successful.


5.) Open your LUKS partition now


#note when we say LUKSroot below that becomes the LUKS device we can mount and use in /dev/mapper/LUKSroot (LUKSroot is the name that it will be given)

cryptsetup luksOpen /dev/sdb2 LUKSroot
Enter passphrase for /dev/sdb2:

6.) Create Partitions on your LUKS partition

mkfs.ext4 /dev/mapper/LUKSroot


#let's setup our boot as well while we're at it


mkfs.ext4 /dev/sdb1

7.) Let's prepare our target for migration (target is our new LUKS enabled drive)

mkdir /target
mount /dev/mapper/LUKSroot /target
mkdir /target/boot
mount /dev/sdb1 /target/boot

8.) rsync our current OS to the new LUKS partition (target)

rsync -Pha --exclude=/mnt/* --exclude=/media/* --exclude=/proc/* --exclude=/sys/* / /target
 

9.) Prepare to chroot into our new LUKS environment


for mount in dev proc sys; do
  mount -o bind /$mount /target/$mount
done


#enter our new LUKS environment
chroot /target
 

10.) Setup our LUKS environment to boot properly (update fstab, crypttab, initramfs and grub)

We need to update /etc/fstab with the new blkid's

# blkid /dev/sdb1
/dev/sdb1: UUID="e0e4d4b6-c45d-4749-81b9-a46bdc66f7c5" TYPE="ext4"


#blkid /dev/mapper/LUKSroot
/dev/mapper/LUKSroot: UUID="ba6af9a2-6ea1-49d9-95f1-df521cbd384b" TYPE="ext4"

#fstab should now look like this:

UUID=e0e4d4b6-c45d-4749-81b9-a46bdc66f7c5 /boot ext4 defaults 0 0
/dev/mapper/LUKSroot / ext4 defaults 0 0
/swap.img       none    swap    sw      0       0



#We need to also set /etc/crypttab
#it should be the UUID of /dev/sdb2

# blkid /dev/sdb2
/dev/sdb2: UUID="00321fcc-6ebc-4440-b62c-06b79f0aed96" TYPE="crypto_LUKS"

#crypttab should now look like this
LUKSroot UUID=00321fcc-6ebc-4440-b62c-06b79f0aed96 none luks,discard


#update our grub, initramfs and install grub to our secondary grub

update-grub
update-initramfs -k all -c
update-initramfs: Generating /boot/initrd.img-4.15.0-88-generic


grub-install /dev/sdb
#if your primary boot drive is /dev/sda you should install it into /dev/sda too
grub-install /dev/sda

#now reboot


Tags:

convert, install, luks, encrypted, ubuntu, linux, mint, debian, linuxthe, installer, doesn, server, gui, desktop, password, reliable, default, minimal, secondary, disk, vm, dev, sdb, fdisk, gdisk, cryptsetup, verbose, verify, passphrase, luksformat, overwrite, irrevocably, uppercase, partition, luksroot, mount, mapper, luksopen, partitions, mkfs, ext, migration, enabled, mkdir, rsync, os, pha, exclude, mnt, proc, sys, chroot, bind, update, fstab, crypttab, initramfs, grub, etc, blkid, uuid, quot, bdc, af, ea, df, cbd, defaults, swap, img, sw, fcc, ebc, aed, crypto_luks, discard, generating, initrd, generic, primary, sda, reboot,

Latest Articles

  • How to resize a pdf without losing much quality in Linux Mint Ubuntu Debian Redhat Solution
  • qemu: could not load PC BIOS 'bios-256k.bin' solution
  • Proxmox How To Custom Partition During Install
  • Hyper-V Linux VM Boots to Black Screen, Storage, NIC Not Found Issues
  • Ubuntu Mint How to Fix Missing/Broken /dev and /dev/pts which causes terminal to immediately close exit and not work
  • How high can a Xeon CPU get?
  • bash fix PATH environment variable "command not found" solution
  • Ubuntu Linux Mint Debian Redhat Youtube Cannot Play HD or 4K videos, dropped frames or high CPU usage with Nvidia or AMD Driver
  • hostapd example configuration for high speed AC on 5GHz using WPA2
  • hostapd how to enable and use WPS to connect wireless devices like printers
  • Dell Server Workstation iDRAC Dead after Firmware Update Solution R720, R320, R730
  • Cloned VM/Server/Computer in Linux won't boot and goes to initramfs busybox Solution
  • How To Add Windows 7 8 10 11 to GRUB Boot List Dual Booting
  • How to configure OpenDKIM on Linux with Postfix and setup bind zonefile
  • Debian Ubuntu 10/11/12 Linux how to get tftpd-hpa server setup tutorial
  • efibootmgr: option requires an argument -- 'd' efibootmgr version 15 grub-install.real: error: efibootmgr failed to register the boot entry: Operation not permitted.
  • Apache Error Won't start SSL Cert Issue Solution Unable to configure verify locations for client authentication SSL Library Error: 151441510 error:0906D066:PEM routines:PEM_read_bio:bad end line SSL Library Error: 185090057 error:0B084009:x509 certif
  • Linux Debian Mint Ubuntu Bridge br0 gets random IP
  • redis requirements
  • How to kill a docker swarm