How would I encrypt my whole Linux filesystem with Veracrypt?

Question

I'm running Kali Dojo 2.0 and I'd like to encrypt the entire drive.

I've encrypted my Windows 7 Home Premium drive with Veracrypt, and it was a simple setup and I'd like to do something similar on this drive.

On that drive, everything was encrypted, aside from boot files, and thats what I would like to do with this drive as well. It doesn't have to be Veracrypt that is just a preference.

Unless it is my only option, I do not want to make a container to put certain files in.

Solution

Linux has supported boot/system volume encryption like Veracrypt for a long time using its own separate integrated system called LUKS, which is not compatible with Truecrypt/Veracrypt.

Veracrypt (if it's like Truecrypt) is implemented on Linux via FUSE. FUSE is a way to implement filesystems without writing a kernel driver, the cost of this is speed. LUKS is part of the kernel and is faster than Veracrypt would be, so this is why LUKS is preferred if you are using Linux.

LUKS is well supported by Debian and other distribution installers, it's fairly simple to encrypt your full system, or full Linux partition, except for a small boot partition containing the kernel and initial RAM disk. This is equivalent to everything being encrypted on Truecrypt/Veracrypt except the bootloader, which has to be unencrypted so the BIOS/UEFI can read it.

I have never used Kali, but if it uses the standard Debian installer, you do this to encrypt the full partition (reference):

To create an encrypted partition, you must first assign an available partition for this purpose.

To do so, select a partition and indicate that it is to be used as a “physical volume for encryption”. After partitioning the disk containing the physical volume to be made, choose “Configure encrypted volumes”.

The software will then propose to initialize the physical volume with random data (making the localization of the real data more difficult), and will ask you to enter an “encryption passphrase”, which you will have to enter every time you boot your computer in order to access the content of the encrypted partition.

Once this step has been completed, and you have returned to the partitioning tool menu, a new partition will be available in an “encrypted volume”, which you can then configure just like any other partition.

In most cases, this partition is used as a physical volume for LVM so as to protect several partitions (LVM logical volumes) with the same encryption key, including the swap partition (see sidebar SECURITY Encrypted swap partition).

One thing to note is that I don't believe there is a tool that will encrypt/decrypt a currently running system like Truecrypt/Veracrypt does.

It's technically possible to mount the root filesystem via FUSE - meaning I believe it's possible to boot Linux off of a Veracrypt-encrypted partition if you really wanted to, but since it provides inferior speed to LUKS under Linux, it's not surprising if no one has developed this method.

Comments

[btf1998]

After doing a little reading, it seems that I have to back up data and reload it onto the partition that LUKS creates. Am I right in saying that? Also, you've said that you don't think there is a tool to decrypt/encrypt a running system. Does that mean that LUKS encrypts and decrypts everything at startup/shutdown? Also, is there a special process by which I would have to shut down my system to ensure it re-encrypts? And thank you for the reference and the help you have given me already

[LawrenceC]

LUKS encrypts/decrypts in realtime. It takes a partition like /dev/sda1 and creates an "encrypted version" /dev/mapper/something. You (or a script) mount/use the /dev/mapper device, anything read/written is de/encrypted automatically.

[LawrenceC]

You can't change a volume from unencrypted to encrypted while it is mounted/you are using it like TrueCrypt does for Windows system volumes. LUKS volumes can only start off encrypted in the first place.