Linux LUKS encrypt and cloning machines

It is possible to perform an in-place encryption but I would strongly suggest that you take a backup first. I wrote an experimental tool that I called inCrypt which can convert between raw (unencrypted), plain (dm-crypt) and LUKS formats.

Converting an unencrypted device to LUKS requires that any pre-existing data on the device needs to be shifted to leave a space of around 2MiB at the beginning so that a header can be installed there. Alternatively you can detach the header and store it on a separate device (such as a USB key).

If you use a detached LUKS header or choose plain-mode dm-crypt instead then there is no need to shift the data, it can be converted in-situ.

I wrote up the theory with examples here and you can also read about right-shifting and its inherent problems in this question.

To summarise, you can perform in-place encryption using dd to copy into a dm-crypt device mapper from the underlying raw device:

$ cryptsetup open "${raw_device}" crypt_device --type plain ${cryptsetup_args} $ dd if="${raw_device}" conv=notrunc of=/dev/mapper/crypt_device $ cryptsetup close crypt_device 

(the variables are placeholders for you to supply the relevant parameters for your environment; it's more completely explained in the script and linked pages above)

This is a risky operation - if it fails part-way through (power loss, fat fingers, or for any other reason) then you are stuffed. Take a backup first.

Note that I used the words backup, experimental and theory. Caveat Emptor, and all that!

Perhaps the most straight forward way is to create and configure the master image with LUKS encryption enabled.

Of course, if you just clone this master disk all devices share the same encryption key - which is bad.

But you can reencrypt an already encrypted LUKS partition.

Thus, you could script the following workflow:

1. dd the master image to a new drive /dev/sdX
2. get the UUID of existing device: cryptsetup luksUUID /dev/sdXY
3. reencrypt with: cryptsetup reencrypt /dev/sdXY
4. reset UUID to old one: cryptsetup luksUUID --uuid $olduuid /dev/sdXY

The reset of the UUID is necessary because the grub config and/or initramfs (i.e. via dracut) has it baked in such that it's unlocked during boot.

Alternatively, you have to update the UUID in those places.

Depending on how often you want to clone your master image perhaps you want to use another process - since the cryptsetup reencrypt method isn't necessary the fastest one.

You could start with the master image that is again fully configured with LUKS encryption.

From that image you dump the partition table with sfdisk -d. Next you dump all unencrypted images into separate files (usually this would be just the boot partition). Finally, you cryptsetup open the system partition from the master image (e.g. via a loop device) and dump its content to another image file (say root.img).

With those pieces the clone procedure would look like this:

1. partition the device with < part.dump sfdisk /dev/sX
2. dd the unecrypted partition(s) to - say - /dev/sX1
3. format the system partition: cryptsetup luksFormat --uuid $olduuid /dev/sXY
4. open the new LUKS device
5. dd the root.img to the new LUKS device

Unless it's LVM all data has to be moved to make room at the beginning for the LUKS header (2MiB). So it's not a straightforward / risk-free process.