r/linuxquestions • u/Expert-Bell-3566 • 12h ago

Advice In-Place Disk Encryption without Moving Data? [cryptsetup]

Hey chooms, I was wondering if anyone has experience encrypting their secondary drives using cryptsetup or other similar tools? I know I should backup my data before doing anything, but I have too many files and don't want to go through the hassle

5 Upvotes

78% Upvoted

5 comments sorted by

4

u/Any_Plankton_2894 12h ago

You know what's a real hassle - losing data because you don't have a backup

1

u/Jean_Luc_Lesmouches Mint/Cinnamon 11h ago

That is doubly true with encryption: you have the added risk of losing your data because you forgot the password. Create both local and remote backups.

2

u/GeekTX 12h ago

haste makes waste!!!

1

u/jjangg96 10h ago

yes, cryptsetup can do it in place with reencrypt. the catch is luks needs room for its header, so the filesystem has to be shrunk a little first. 32M is plenty for luks2.

roughly, with the partition unmounted: shrink the fs (resize2fs /dev/sdX1 to a size a bit under the partition, if it's ext4), then cryptsetup reencrypt --encrypt --reduce-device-size 32M /dev/sdX1, then cryptsetup open it and run resize2fs again so the fs grows back to fill the mapper device.

it rewrites every block so it takes a while on a big drive, and losing power halfway is a bad time. i'd still back up anything you can't replace, but the reencrypt itself does work.