After setting up a Debian system which did not choose to use encryption during the installer, do these steps to encrypt sda3 partition so we have encrypted rootfs. Follow these steps when booted from another disk so we can off-line encrypt the rootfs:
- Mount the btrfs rootfs to /mnt:
mount /dev/sda3 /mnt - See the current size and devid of the btrfs filesystem (likely your filesystem will be devid 1):
btrfs filesystem show --mbytes /mnt - Resize the filesystem to be 32MiB smaller so we can fit a LUKS header at the end of the partition:
btrfs filesystem resize 1:-32M /mnt - Verify that the filesystem is actually smaller now:
btrfs filesystem show --mbytes /mnt - Unmount the filesystem:
umount /mnt - Check the filesystem to ensure no errors:
btrfs check /dev/sda3 - Encrypt the filesystem in-place (this will take a while):
cryptsetup reencrypt --encrypt --verify-passphrase --reduce-device-size 32M /dev/sda3 - Unlock the partition and name it "ssd" so we can mount it:
cryptsetup open /dev/sda3 ssd - Mount it:
mount /dev/mapper/ssd /mnt - Get the UUID of the partition which we'll add to the crypttab:
ls -l /dev/disk/by-uuid/ | grep sda3 | awk '{print $9}' - Append to /mnt/etc/crypttab to add a line at the end:
echo "ssd UUID=<uuid_from_above> none" >> /mnt/etc/crypttab - Get the UUID of the filessytem which we'll need for fstab (this assumes you only have dm-0 showing up which is the encrypted partition via devmapper, adjust as needed based on output of
ls -l /dev/mapper/to see which is "ssd"):ls -l /dev/disk/by-uuid/ | grep dm-0 | awk '{print $9}' - Make sure that /mnt/etc/fstab is set the filesystem UUID for the / root partition (it probably is if you've previously booted the system)
- Mount needed filesystems so we can chroot into the encrypted rootfs:
mount --bind /dev /mnt/dev
mount --bind /proc /mnt/proc
mount --bind /sys /mnt/sys
mount --bind /run /mnt/run
mount /dev/sda1 /mnt/boot/efi
- Then chroot into the new encrypted rootfs:
chroot /mnt - Install the cryptsetup tools (this may show some errors since we're in a chroot, that's OK):
apt install cryptsetup cryptsetup-initramfs - Update all the initramfses:
update-initramfs -u -k all - Exit the chroot:
exit - Unmount the new filesystem:
umount --recursive /mnt - Close out the encrypted device:
cryptsetup close ssd - Reboot and cross your fingers