Manual Full System Encryption has been updated and simplified

[Paddy Landau]

The question now is whether to keep going with 18.10, or start again with 18.04…
It is crucial for work and study that my desktop (and my laptop which I will work on next) are working…

You should always stick to the LTS versions if you can't afford to experiment.

• All even-numbered .04 releases are LTS, so this would include 16.04, 18.04, 20.04, and so forth. These are the ones that you should stick to.
• Version 18.10 is an experimental version, as will be 19.04 and 19.10.
• In fact, if it's that important to you, don't upgrade an existing installation until at least three months after the release of an LTS version. Definitely avoid all other releases.
• Version 18.10 will become redundant in June 2019, and 19.04 in December 2019.
• On the other hand, version 18.04 will be supported at least until April 2021, so you won't have to upgrade until then.

To undo everything so far, can I just delete sd5 where I created system, and sd6 where I created the data-home partition, or have the installer or your script made any changes to the EFI partition that need to be undone some how?

There are changes to the EFI System Partition, but a reinstallation will redo the changes, so that's OK. Delete and recreate the relevant partitions (system and data-home), and reinstall Ubuntu 18.04 from scratch.

Or I can keep going as is, keep up with releases…

Well, you can take that risk. But, what if 19.04 doesn't work?

The following code removed the install release icon, and whatever was causing it…

Thanks. Ubiquity is the installer. I have no clue how it was installed on your 18.10 release!

18.10 custom LVM over LUKS, GParted will not start

Thanks, I'll follow this.

[Dáire Fagan]

Thanks for the info. I downloaded 18.04 LTS last night, created the USB stick with Rufus, deleted my system and data partitions, filled both with /urandom, and followed the guide again verbatim.

There is a delay of ~15 seconds after entering the system passphrase, this is not a big deal, but is this normal?

Also, the 'Install RELEASE' icon is again present at the top of the left hand panel. Same issue with gparted:

dusf@contraption:~$ sudo apt install gparted
[sudo] password for dusf: 
Reading package lists... Done
Building dependency tree       
Reading state information... Done
gparted is already the newest version (0.30.0-3ubuntu1).
0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.

dusf@contraption:~$ gparted

Command 'gparted' not found, but can be installed with:


sudo apt install gparted

I have not yet attempted to correct these issues, in case there is some diagnostics you would like me to run?

I also want to wait for input before I do anything, and I have asked for help here:

18.04: Install RELEASE icon visible in launcher after install?

18.04: 'Command 'gparted' not found... gparted is already the newest version'

Paddy also, and this probably is very inconsequential, but I did re-open/leave open GParted during the installation just to confirm partition locations when selecting them with the installer.

[Dáire Fagan]

Both issues on my desktop were resolved, the method is in each thread linked in my previous post. I can confirm both issues also occurred when I followed the guide to install 18.04 on my Dell XPS 9360.

[Paddy Landau]

@dusf Thank you for the update. In your previous post, you mentioned GPartEd being left open. To the best of my knowledge, that shouldn't have caused any problem.

[Dáire Fagan]

@dusf Thank you for the update. In your previous post, you mentioned GPartEd being left open. To the best of my knowledge, that shouldn't have caused any problem.

Thanks for that.

Paddy, I am trying to make a permanent change to my Windows 10 grub menuentry, so that it boots to \EFI\VeraCrypt\DcsBoot.efi instead of EFI\Microsoft\Boot\Bootmgfw.efi. I am getting some help with it at LinuxQuestions, but they are a bit confused by my setup so I if I could run their concerns by you, and the steps they advise I take, could you please confirm none of it will undo or mess up my install from following your guide?

Although I did edit the menuentry for VeraCrypt/Windows 10 when I installed everything a few weeks ago, and it has been working fine, it has been changed, I am guessing due to an update. This change leads to Windows 10 trying to repair itself, although thankfully Windows 10 boots fine when I press F12 on boot and manually select the VeraCrypt Bootloader. Trying to change the menuentry again now I used grub-customiser as below and saved:

Screenshot from 2019-01-22 16-59-38.jpg

I can see this change is reflected in /boot/grub/grub.cfg as:

menuentry "Windows Boot Manager (on /dev/sda1)" --class windows --class os $menuentry_id_option 'osprober-efi-E625-C979' {    insmod part_gpt
    insmod fat
    set root='hd0,gpt1'
    if [ x$feature_platform_search_hint = xy ]; then
      search --no-floppy --fs-uuid --set=root --hint-bios=hd0,gpt1 --hint-efi=hd0,gpt1 --hint-baremetal=ahci0,gpt1  E625-C979
    else
      search --no-floppy --fs-uuid --set=root E625-C979
    fi
    chainloader \EFI\VeraCrypt\DcsBoot.efi
}

I also input sudo update-grub, but despite this when I reboot and press 'e' with the Windows 10 grub menuentry selected I can see it is still set to try and boot from EFI\Microsoft\Boot\Bootmgfw.efi.

On my thread at LinuxQuestions, Making permanent change to grub boot menuentry?, following advice I:

I copied from /boot/grub/grub.cfg this:

menuentry "Windows Boot Manager (on /dev/sda1)" --class windows --class os $menuentry_id_option 'osprober-efi-E625-C979' {
    insmod part_gpt
    insmod fat
    set root='hd0,gpt1'
    if [ x$feature_platform_search_hint = xy ]; then
      search --no-floppy --fs-uuid --set=root --hint-bios=hd0,gpt1 --hint-efi=hd0,gpt1 --hint-baremetal=ahci0,gpt1  E625-C979
    else
      search --no-floppy --fs-uuid --set=root E625-C979
    fi
    chainloader \EFI\VeraCrypt\DcsBoot.efi
}

to a new file I created, /etc/grub.d/40_custom, saved it, added GRUB_DISABLE_OS_PROBER=true to /etc/default/grub, and ran sudo update-grub.

But this did not help, and I then responded to a query with the following info:

Could the issue perhaps be with the permissions of this new file (40_custom), as below?

dusf@contraption:~$ ls -la /etc/grub.d/
total 112
drwxr-xr-x   5 root root  4096 Jan 22 18:21 .
drwxr-xr-x 152 root root 12288 Jan 23 08:46 ..
-rwxr-xr-x   1 root root  9783 Jul 17  2018 00_header
-rwxr-xr-x   1 root root  6258 Jul 16  2018 05_debian_theme
-rwxr-xr-x   1 root root 12693 Jul 17  2018 10_linux
-rwxr-xr-x   1 root root 11298 Jul 17  2018 20_linux_xen
-rwxr-xr-x   1 root root  1992 Jan 28  2016 21_memtest86+
-rwxr-xr-x   1 root root   197 Jan 22 16:37 30_os-prober_proxy
-rw-r--r--   1 root root   451 Jan 22 18:21 40_custom
-rwxr-xr-x   1 root root   194 Jan 22 16:37 40_custom_proxy
-rwxr-xr-x   1 root root  1418 Jul 17  2018 42_uefi-firmware
-rwxr-xr-x   1 root root   194 Jan 22 16:37 43_custom_proxy
-rwxr-xr-x   1 root root   216 Jul 17  2018 44_custom
drwxr-xr-x   4 root root  4096 Jan 22 15:41 backup
drwxr-xr-x   2 root root  4096 Jan 22 15:41 bin
drwxr-xr-x   2 root root  4096 Jan 22 16:37 proxifiedScripts
-rw-r--r--   1 root root   483 Jul 17  2018 README
-rw-r--r--   1 root root   206 Jan 22 16:37 .script_sources.txt

I just manually edited the Windows 10 grub menuentry - when in grub at boot - to /EFI/VeraCrypt/DcsBoot.efi and I can confirm it also boots fine that way.

What is in your /boot/efi/EFI?
what is the ouput of

fdisk -l

dusf@contraption:~$ sudo fdisk -l
[sudo] password for dusf: 
Disk /dev/loop0: 89.5 MiB, 93835264 bytes, 183272 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes


Disk /dev/loop1: 13 MiB, 13619200 bytes, 26600 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes


Disk /dev/loop2: 86.9 MiB, 91099136 bytes, 177928 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes


Disk /dev/loop3: 34.6 MiB, 36216832 bytes, 70736 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes


Disk /dev/loop4: 140.7 MiB, 147496960 bytes, 288080 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes


Disk /dev/loop5: 93.7 MiB, 98205696 bytes, 191808 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes


Disk /dev/loop6: 7.5 MiB, 7811072 bytes, 15256 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes


Disk /dev/loop7: 3.7 MiB, 3887104 bytes, 7592 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes


Disk /dev/sda: 232.9 GiB, 250059350016 bytes, 488397168 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: gpt
Disk identifier: 134509C8-DD29-4256-B479-DCB8771F5F73


Device         Start       End   Sectors   Size Type
/dev/sda1       2048   1230562   1228515 599.9M EFI System
/dev/sda2    1230848   1263615     32768    16M Microsoft reserved
/dev/sda3    1263616 210978815 209715200   100G Microsoft basic data
/dev/sda4  210978816 211900415    921600   450M Windows recovery environment
/dev/sda5  211900416 342878207 130977792  62.5G Linux filesystem
/dev/sda6  342878208 488396799 145518592  69.4G Linux filesystem


Disk /dev/sdb: 1.8 TiB, 2000398934016 bytes, 3907029168 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 4096 bytes
I/O size (minimum/optimal): 4096 bytes / 4096 bytes
Disklabel type: gpt
Disk identifier: 927AF0D2-1B52-466B-ADEB-894574941E98


Device     Start        End    Sectors  Size Type
/dev/sdb1   2048 3907028991 3907026944  1.8T Microsoft basic data


Disk /dev/sdc: 931.5 GiB, 1000204886016 bytes, 1953525168 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 4096 bytes
I/O size (minimum/optimal): 4096 bytes / 4096 bytes
Disklabel type: gpt
Disk identifier: BBB14604-211B-2D46-AA3D-9162A99E1410


Device     Start        End    Sectors   Size Type
/dev/sdc1   2048 1953525134 1953523087 931.5G Linux filesystem


Disk /dev/sdd: 298.1 GiB, 320072933376 bytes, 625142448 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: gpt
Disk identifier: AFF53512-C54B-644B-99B1-69BDF4A5D175


Device     Start       End   Sectors   Size Type
/dev/sdd1   2048 625142414 625140367 298.1G Linux filesystem


Disk /dev/mapper/system: 62.5 GiB, 67058532352 bytes, 130973696 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes


Disk /dev/mapper/system-boot: 512 MiB, 536870912 bytes, 1048576 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes


Disk /dev/mapper/system-swap: 32 GiB, 34359738368 bytes, 67108864 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes


Disk /dev/mapper/system-root: 30 GiB, 32157728768 bytes, 62808064 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes


Disk /dev/loop8: 2.3 MiB, 2433024 bytes, 4752 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes


Disk /dev/loop9: 14.5 MiB, 15196160 bytes, 29680 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes


Disk /dev/loop10: 14.5 MiB, 15208448 bytes, 29704 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes


Disk /dev/loop11: 140.9 MiB, 147722240 bytes, 288520 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes


Disk /dev/loop12: 2.3 MiB, 2355200 bytes, 4600 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes


Disk /dev/loop13: 13 MiB, 13619200 bytes, 26600 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes


Disk /dev/loop14: 3.7 MiB, 3878912 bytes, 7576 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes


Disk /dev/loop15: 202.3 MiB, 212099072 bytes, 414256 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes


Disk /dev/mapper/veracrypt1: 1.8 TiB, 2000397533184 bytes, 3907026432 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 4096 bytes
I/O size (minimum/optimal): 4096 bytes / 4096 bytes
Disklabel type: dos
Disk identifier: 0x73736572


Device                       Boot      Start        End    Sectors   Size Id Type
/dev/mapper/veracrypt1-part1      1920221984 3736432267 1816210284   866G 72 unkn
/dev/mapper/veracrypt1-part2      1936028192 3889681299 1953653108 931.6G 6c unkn
/dev/mapper/veracrypt1-part3               0          0          0     0B  0 Empt
/dev/mapper/veracrypt1-part4        27722122   27722568        447 223.5K  0 Empt


Partition 4 does not start on physical sector boundary.
Partition table entries are not in disk order.


Disk /dev/mapper/data: 69.4 GiB, 74503421952 bytes, 145514496 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes


Disk /dev/mapper/data-home: 69.4 GiB, 74499227648 bytes, 145506304 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes


Disk /dev/mapper/liberty: 931.5 GiB, 1000201723392 bytes, 1953518991 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 4096 bytes
I/O size (minimum/optimal): 4096 bytes / 4096 bytes

AT the grub menu prompt hit c and post the output of

set

IMG_20190123_084349847.jpg

The response is the following, can you please tell me if the loops mounts fdisk displays are normal from following your guide, and confirm that the steps advised will not interfere with my ManualFullSystemEncryption setup?

Are you running ubuntu from a live iso? It appears to be with all the loop mounts. You have an unusual setup, ubuntu grub set normally uses /boot/grub/grub.cfg file not /EFI/ubunut/grub.cfg.
assuming your efi partition is mounted at /boot/efi, run

sudo grub-update -o /boot/efi/EFI/ubuntu/grub.cfg.

If your efi partition isn't mounted then first mount with

sudo mount sda1 /boot/efi

If /boot/efi/doesn't exist them creat it with

mkdir /boot/efi

you will have to this with any update that involves grub changes.

[Paddy Landau]

@dusf This system has not been tested with VeraCrypt.

There is a significant problem in that every time Ubuntu releases a kernel update, it doesn't play nicely, and it overwrites Grub.
That's why we have the script /usr/local/sbin/refreshgrub, to refresh Grub and initramfs properly.

I don't know enough about Grub to give you sensible advice, sorry.
All I know is that the file /etc/default/grub is involved.

Maybe, if you figure out what needs doing, you can amend refreshgrub to implement that?

I don't think that what you are being advised to do will mess up the installation. But, in case I'm wrong, simply back up every file that you change prior to changing it. You can restore the files, if necessary, using a Live CD.

[Dáire Fagan]

Thanks Paddy, I will follow that advice.

And about the loop partitions, are they anything to do with a ManualFullSystemEncryption setup?

Also, is there a way to force the refreshgrub script to run, perhaps by inputting ./usr/local/sbin/refreshgrub and is it safe to do so?

[rmendal]

Hi Paddy, I've encountered an issue with partitioning the disk and the script. I'm using 18.04.1 LTS and I'm using the entire disk here so I've created the ESP partition, 550 MiB in size, labelled and flagged it per the instructions. The rest of the disk is to be "system" so when I format it as cleared in gparted and apply the change it erases the "system" label which prevents me from using the encryptinstallation script properly as there is no "system" label that it can see so the script just loops asking for my system partition.

Since the partition is marked as clear I cannot add a label to it. I've also tried with fdisk, e2label and tune2fs and the result is the same.

[jon54]

First off, thank you Paddy for all the work you have put into this. I find it ridiculous the amount of resistance you have faced in trying to get this implemented.

I went through your documentation and, like everyone else, ran into the SecureBoot bug. As it is not an option for me to disable SecureBoot on my dual-boot system, Ubuntu is not usable for me.

That having been said, is there a good, working guide on installing Ubuntu 18.04 with encrypted root partition and unencrypted boot that works with SecureBoot? I can set up LUKS and the volume/logical groups and install the OS, it's the post-installation crypttab and grub2 installation that's hanging me up right now.
------------------------------------------------------------------

Okay, I figured it out today (system encryption without boot encryption). For future reference, here are the steps I took:

First, create your unencrypted boot partition with gparted, use ext4. I used 1GB for mine.

Follow Paddy's guide through to where you install Ubuntu, and install Ubuntu (select your unencrypted boot partition as /boot). When it is installed, close the installer (don't reboot!), and CTRL-C the terminal window.

Remove the logical volume boot (lvremove system-boot) since we created our own unencrypted /boot directory.

Then you do these things as root (sudo -i):

1. chroot into the newly installed system

mount --bind /dev/ /mnt/dev
mount --bind /dev/pts /mnt/dev/pts
mount --bind /proc /mnt/proc
mount --bind /sys /mnt/sys
mount --bind /run /mnt/run
mount /dev/<YOUR_BOOT_PARTITION> /mnt/boot
chroot /mnt

2. remove and reinstall grub-pc (choose to install grub into the unencrypted boot directory you created)

apt purge --auto-remove grub-pc
apt install grub-pc

3. create /etc/crypttab (UUID is the UUID of the filesystem (/dev/sda*) of the physical volume - do NOT use quotes)

 system UUID=xxxxx-xxxx-xxxxxx-xxxxxx-xxxxxx none luks,discard,loud

4. add GRUB_ENABLE_CRYPTODISKS=y to /etc/default/grub (I don't know if this is necessary but I did it anyway)

5. run update-grub

6. run update-initramfs

Exit multiple times until you are back at a user account and reboot the system.

[mike-freeman-3832]

I believe there's an error in section “5.1. Software compatibility” of the wiki page for ManualFullSystemEncryption.

6. Dropbox has terminated support for all Linux systems unless you use unencrypted ext4 or ext4 on plain LUKS. This method uses ext4 and LUKS, but it also uses LVM, so, you won't be able to use Dropbox on your encrypted system.

Dropbox is not incompatible with LVM stacked on LUKS. Multiple people are reporting that LVM on LUKS works with Dropbox. If you could please update the page, I think it may save people from needlessly trying to install encrypted systems without using LVM. Re: LUKS without LVM (for Dropbox).

Thanks.