Convert and install to LUKS Encrypted Drive Ubuntu 18.04 19.10 Linux Mint and Debian Based Linux

The reason for doing this is that the installer doesn't seem to work properly for LUKS and the server installer doesn't even support LUKS anymore.  When you use the GUI install on Desktop for LUKS it won't boot and will just hang after you enter your password.  So the only reliable way is to do it ourselves.

1.) Make a default minimal install of Ubuntu


2.) Have a secondary disk on the server or VM.

3.) Create the following on the secondary disk (we assume it is /dev/sdb)
/dev/sdb1 = /boot 1G
/dev/sdb2 = / (rest of free space)

Use fdisk or gdisk

4.) Create LUKS for root on /dev/sdb2

cryptsetup --verbose --verify-passphrase luksFormat /dev/sdb2

WARNING!
========
This will overwrite data on /dev/sdb2 irrevocably.

Are you sure? (Type uppercase yes): YES
Enter passphrase for /dev/sdb2:
Verify passphrase:
Command successful.


5.) Open your LUKS partition now


#note when we say LUKSroot below that becomes the LUKS device we can mount and use in /dev/mapper/LUKSroot (LUKSroot is the name that it will be given)

cryptsetup luksOpen /dev/sdb2 LUKSroot
Enter passphrase for /dev/sdb2:

6.) Create Partitions on your LUKS partition

mkfs.ext4 /dev/mapper/LUKSroot


#let's setup our boot as well while we're at it


mkfs.ext4 /dev/sdb1

7.) Let's prepare our target for migration (target is our new LUKS enabled drive)

mkdir /target
mount /dev/mapper/LUKSroot /target
mkdir /target/boot
mount /dev/sdb1 /target/boot

8.) rsync our current OS to the new LUKS partition (target)

rsync -Pha --exclude=/mnt/* --exclude=/media/* --exclude=/proc/* --exclude=/sys/* / /target
 

9.) Prepare to chroot into our new LUKS environment


for mount in dev proc sys; do
  mount -o bind /$mount /target/$mount
done


#enter our new LUKS environment
chroot /target
 

10.) Setup our LUKS environment to boot properly (update fstab, crypttab, initramfs and grub)

We need to update /etc/fstab with the new blkid's

# blkid /dev/sdb1
/dev/sdb1: UUID="e0e4d4b6-c45d-4749-81b9-a46bdc66f7c5" TYPE="ext4"


#blkid /dev/mapper/LUKSroot
/dev/mapper/LUKSroot: UUID="ba6af9a2-6ea1-49d9-95f1-df521cbd384b" TYPE="ext4"

#fstab should now look like this:

UUID=e0e4d4b6-c45d-4749-81b9-a46bdc66f7c5 /boot ext4 defaults 0 0
/dev/mapper/LUKSroot / ext4 defaults 0 0
/swap.img       none    swap    sw      0       0



#We need to also set /etc/crypttab
#it should be the UUID of /dev/sdb2

# blkid /dev/sdb2
/dev/sdb2: UUID="00321fcc-6ebc-4440-b62c-06b79f0aed96" TYPE="crypto_LUKS"

#crypttab should now look like this
LUKSroot UUID=00321fcc-6ebc-4440-b62c-06b79f0aed96 none luks,discard


#update our grub, initramfs and install grub to our secondary grub

update-grub
update-initramfs -k all -c
update-initramfs: Generating /boot/initrd.img-4.15.0-88-generic


grub-install /dev/sdb
#if your primary boot drive is /dev/sda you should install it into /dev/sda too
grub-install /dev/sda

#now reboot


Tags:

convert, install, luks, encrypted, ubuntu, linux, mint, debian, linuxthe, installer, doesn, server, gui, desktop, password, reliable, default, minimal, secondary, disk, vm, dev, sdb, fdisk, gdisk, cryptsetup, verbose, verify, passphrase, luksformat, overwrite, irrevocably, uppercase, partition, luksroot, mount, mapper, luksopen, partitions, mkfs, ext, migration, enabled, mkdir, rsync, os, pha, exclude, mnt, proc, sys, chroot, bind, update, fstab, crypttab, initramfs, grub, etc, blkid, uuid, quot, bdc, af, ea, df, cbd, defaults, swap, img, sw, fcc, ebc, aed, crypto_luks, discard, generating, initrd, generic, primary, sda, reboot,

Latest Articles

  • Ubuntu Debian Linux Cannot Install Wine Solution - wine1.6 : Depends: wine1.6-i386 (= 1:1.6.2-0ubuntu14.2) but it is not installable wine1.4 : Depends: wine1.6 but it is not going to be installed
  • How To Install python 3.4 3.5 and up on Linux with wine - Working Solution
  • using Xvfb on virtual remote ssh server to have X graphical programs work
  • ssh Received disconnect from port 22:2: Too many authentication failures
  • named bind errors - DNSKEY: unable to find a DNSKEY which verifies the DNSKEY RRset and also matches a trusted key for '.'
  • OpenVZ vs LXC DIR mode poor security in LXC
  • httpd: Syntax error on line 221 of /etc/httpd/conf/httpd.conf: Syntax error on line 6 of /etc/httpd/conf.d/php.conf: Cannot load modules/libphp5.so into server: /lib64/libresolv.so.2: symbol __h_errno, version GLIBC_PRIVATE not defined in file libc.s
  • Radeon R3 GPU on Debian Crashing
  • MySQL 5.7 on Debian and Ubuntu - How To Reset Root Password
  • SSH and sshfs timeout settings keepalive
  • Linux How To Add User To Additional Group
  • Howto Set Static IP on boot in initramfs for dropbear or other purposes NFS, Linux, Debian, Ubuntu, CentOS
  • Convert and install to LUKS Encrypted Drive Ubuntu 18.04 19.10 Linux Mint and Debian Based Linux
  • Debian and Netplan
  • CentOS 8 how to restart the network!
  • CentOS 8 how to convert to a bootable mdadm RAID software array
  • ADATA USB Thumb Drive Issues
  • KMODE EXCEPTION NOT HANDLED - QEMU/KVM Won't Boot Windows 2016 or 10 Image or Physical Machine
  • Linux Mint / Ubuntu / Debian Mate Disable Guest Session and Hide Usernames on Lightdm Login screen GUI
  • SSH How To Create Public/Private Key Pair and with a Larger Keysize than 2048 bits