12

Using the pre-installed Ubuntu Desktop 20.10 disk image for the Raspberry Pi 4 (64-bit ARM), you do not get an option to encrypt the disk using LUKS when you install the system, as you do with the x86 USB-based installers.

For reference, I followed the instructions here to get the system installed to an external SSD: https://ubuntu.com/tutorials/how-to-install-ubuntu-desktop-on-raspberry-pi-4#1-overview

In all, I am very satisfied with the install, but I would prefer if I was able to encrypt the whole drive. I don't want to bother figuring out how to just encrypt the home folder, so if anybody know hows to get a 20.10 install encrypted w/ LUKS at the time the OS is installed, I would appreciate hearing how you did it. Thanks!

davetronics
  • 121

4 Answers4

12

EDIT: I misread the original question, but everything still applies. Using /dev/mmcblk0p2 below is for installing to the microSD card. To install to an external SSD/HD the device will likely be /dev/sda2. Use the appropriate device when editing cmdline.txt, crypttab, and booting for the first time via (initramfs).

The latest Ubuntu image includes cryptsetup, so you can convert the "writeable" (root) partition to LUKS using your desktop PC. I began with the 20.10 64-bit Server image.

  1. Prepare your SD card but do not install into the RPi. Keep it on your desktop PC.

  2. Unmount the SD card (/dev/sdc2 is my "writeable" (root) partition - yours may be different).

    sudo umount /dev/sdc2

  3. Check the partition: sudo e2fsck -f /dev/sdc2

  4. Shrink the partition: sudo resize2fs -M /dev/sdc2

  5. Encrypt the partition (RPi does not have hardware AES support, Adiantum seems to perform better)...

    sudo cryptsetup-reencrypt --new --reduce-device-size=16M --type=luks2 -c xchacha12,aes-adiantum-plain64 -s 256 -h sha512 --use-urandom /dev/sdc2

  6. Decrypt the LUKS partition: sudo cryptsetup luksOpen /dev/sdc2 rootfs

  7. Expand the partition: sudo resize2fs /dev/mapper/rootfs

  8. Mount the partition: sudo mkdir mnt; sudo mount /dev/mapper/rootfs mnt;

  9. Edit etc/crypttab... sudo vim mnt/etc/crypttab

    • Add rootfs /dev/mmcblk0p2 none luks

  10. Edit etc/fstab... sudo vim mnt/etc/fstab

    • Change the first line to /dev/mapper/rootfs / ext4 defaults,noatime 0 0

  11. On the system-boot partition, edit cmdline.txt...

    • change root=LABEL=writable to root=/dev/mapper/rootfs
    • remove splash (so it prompts for the passphrase on boot)
    • add cryptdevice=/dev/mmcblk0p2:sdcard to the end of the line

  12. It should look like this...

    dwc_otg.lpm_enable=0 console=serial0,115200 console=tty1 root=/dev/mapper/rootfs rootfstype=ext4 elevator=deadline rootwait fixrtc quiet cryptdevice=/dev/mmcblk0p2:sdcard

  13. Unmount the microSD card and install into the Raspberry Pi. It will fail to boot and enter (initramfs) because initramfs hasn't been updated yet.

  14. Manually decrypt from initramfs: (initramfs) cryptsetup luksOpen /dev/mmcblk0p2 rootfs

  15. Continue booting: (initramfs) exit

  16. Login (ubuntu/ubuntu) and update initramfs: sudo update-initramfs -u

  17. Reboot: sudo reboot

It should reboot, prompt for the passphrase, then start the OS.

Pablo Bianchi
  • 17,552
Cameron
  • 121
  • I am stuck with 2 things,

    (1) aes-adiantum-plain64 is not available on my machine, I wasted sometime on getting it but settled for aes-xts-plain64, it's much slower.

    (2) cryptsetup is not available in initramfs on debian 10 images for raspi 4, tried a couple of things to get it but nothing as worked so far! :-(

    Any further read ups would be appreciated. :-)

     – atb00ker Jan 10 '21 at 14:45
  • If cryptsetup isn't already in the kernel, I'd think you'd have to chroot the image and emulate (arm) on your PC to install the needed packages, but that's above my level of expertise. This link might be helpful to get started. – Cameron Jan 12 '21 at 20:18
  • 1
    any way to do this fully headless? – nisc Jul 05 '21 at 06:52
  • When executing sudo mkdir mnt; sudo mount /dev/mapper/rootfs mnt I get: mount: /home/blahblah/mnt: wrong fs type, bad option, bad superblock on /dev/mapper/rootfs, missing codepage or helper program, or other error. – astroboy Dec 09 '23 at 09:31
  • Answer below from @hsivonen helped me solve my issue. – astroboy Dec 16 '23 at 17:24
  • Hi @Cameron, after updating initramfs with sudo update-initramfs -u, I did a reboot but instead of prompting for passphrase, the initramfs shell is being loaded again. I need to manually decrypt the rootfs... – Preeti May 13 '24 at 14:22
  • @nisc, I wrote a detailed answer about doing this headless on Ubuntu Server 24.04 LTS, hope it helps – Nullcaller Apr 26 '25 at 17:23
4

Just adding to Cameron's answer, the Ubuntu 20.10 Desktop image for Pi 4 does not include cryptsetup in the initramfs. The easiest solution is to boot into unencrypted Ubuntu after writing it to SD card, connect to network, and then apt install cryptsetup-initramfs

After doing that, Cameron's steps worked perfectly for me. It also works for USB boot (after you have followed Ubuntu's instructions to update the eeprom and change the boot order) by replacing /dev/mmcblk0p2 with /dev/sda2

I thought it wasn't working at first and nearly gave up because the display was showing a single blinking underscore and not failing into the initramfs prompt. All I had to do was wait 7 minutes. I also had USB device read errors when trying to boot from USB, using an unpowered hub resolved that for some reason. I tried doing this on a Debian laptop first but it doesn't have Adiantum in cryptsetup. Then I tried a laptop booting Ubuntu from live USB and it failed to mount the Pi encrypted partition, I don't know why. I only had success after I installed Ubuntu 20.10 onto a laptop.

Clint
  • 61
1

I used the most recent "daily" Ubuntu 22.04 desktop image. In Cameron's answer, the steps for resizing the encrypted partition didn't work.

This worked:

  1. Using the Disks app, restore the install image onto the card.
  2. Delete the "writable" root partition.
  3. In the empty space after the system-boot partition, create a new encrypted ext4 partition called "writable".
  4. Open the encryption of that partition.
  5. Using blockdev --getsize64 /dev/mapper/whatever check the size of the inside of the encrypted partition and make a note of the number.
  6. Restore the install image onto the card again.
  7. Put the card into the Raspberry Pi and boot.
  8. Go through the setup with a password that you don't intend to keep. Watch the post-install script remove cryptsetup-initramfs.
  9. After the reboot, sudo apt install cryptsetup-initramfs
  10. Bring the card back to the other computer.
  11. Make sure the writable partition is not mounted.
  12. In the Disks app, resize the writable partition to the exact number of bytes that you noted in step 5.
  13. Using dd, make a disk image of the writable partition: dd if=/dev/something of=/some/place/else.img bs=1M
  14. Using the Disks app, remove the writable partition.
  15. In the empty space after the system-boot partition, create a new encrypted ext4 partition called "writable".
  16. Open the encryption of the new encrypted partition but keep the file system in it unmounted.
  17. Copy the image into encrypted partition: dd if=/some/place/else.img of=/dev/mapper/something bs=1M.
  18. Continue from Cameron's step 8.
hsivonen
  • 2,677
  • Thank you good sir! You saved me (: Some notes: in step 3, create encrypted ext4 partition of length for example 6400 MB, do not create a partition hundred gigs in size. Because you won't be able to later create an image of such size. – astroboy Dec 16 '23 at 17:22
0

I have tried the above approach and this one https://github.com/ViRb3/pi-encrypted-boot-ssh/tree/8044e5036f2218146a6be443f480f289d860944a for 2 days and failed.

The solution was to use BerryBoot https://berryterminal.com/doku.php/berryboot that has luks encryption option at Ubuntu install time encrypt disk check

SergiuPol
  • 1
  • While this link may answer the question, it is better to include the essential parts of the answer here and provide the link for reference. Link-only answers can become invalid if the linked page changes. - From Review – Pilot6 Jun 30 '22 at 18:10