meta data for this page
  •  

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revision		Previous revision
linux:fs:encrypted_swap [2025/03/23 08:58] – niziaklinux:fs:encrypted_swap [2025/03/24 08:27] (current) – niziak
Line 3: Line 3:
 <code bash> <code bash>
 apt install cryptsetup apt install cryptsetup
 +
 </code> </code>
  
 ===== auto create ===== ===== auto create =====
  
-Auto create encrypted swap with random key for every boot. Problem is that given block device will be filled with random data +Auto create encrypted swap with random key for every boot. Problem is that given block device will be filled with random data when swap is created.  
-when swap is created. So label / UUID is lost for next reboot. Need to use direct device names or use symlinks like ''/dev/disk/by-id/...'' +So label / UUID is lost for next reboot. Need to use direct device names or use symlinks like ''/dev/disk/by-id/…'' which can be also unsafe and can hit another partition.
-which can be also unsafe and can hit another partition.+
  
-Workaround: +Workaround: Put LABEL / UUID once on block device and leave small gap before real swap data to do not overwrite FS signature:
-Put LABEL / UUID once on block device and leave small gap before real swap data to do not overwrite FS signature:+
  
 <code bash> <code bash>
Line 18: Line 17:
 blkid /dev/nvme0n1p3 blkid /dev/nvme0n1p3
 dev/nvme0n1p3: LABEL="cryptswap2" UUID="6b1b9a70-f50d-4d29-b3c6-6c7e2b819f39" ... dev/nvme0n1p3: LABEL="cryptswap2" UUID="6b1b9a70-f50d-4d29-b3c6-6c7e2b819f39" ...
 +
 </code> </code>
  
Line 24: Line 24:
 <file ini /etc/crypttab> <file ini /etc/crypttab>
 swap2      LABEL=cryptswap2    /dev/urandom   swap,offset=2048,cipher=aes-xts-plain64,size=512,sector-size=4096,discard swap2      LABEL=cryptswap2    /dev/urandom   swap,offset=2048,cipher=aes-xts-plain64,size=512,sector-size=4096,discard
 +
 </file> </file>
  
 Apply ''crypttab'' changes: Apply ''crypttab'' changes:
- 
 <code bash> <code bash>
 systemctl daemon-reload systemctl daemon-reload
 systemctl restart cryptsetup.target systemctl restart cryptsetup.target
 +
 </code> </code>
  
 <file ini /etc/fstab> <file ini /etc/fstab>
 /dev/mapper/swap2  none   swap    defaults,discard=once   0       0 /dev/mapper/swap2  none   swap    defaults,discard=once   0       0
 +
 </file> </file>
  
 NOTE: ''discard'' on encrypted device has security implications! NOTE: ''discard'' on encrypted device has security implications!
 +