My Question is: I'd like to use my Raspbian encrypted, just like it is standard on Debian, Ubuntu or other Linux-Distros.
My Problem: Technically, you are not installing Raspbian on a Raspberry Pi or a SD-Card, instead you are copying a prepared image from the internet. Is there a way to perform an encryption of the whole system? (maybe without /boot)
I would use TrueCrypt. Some of it's main features (from the site) include:
- Creates a virtual encrypted disk within a file and mounts it as a real disk.
- Encrypts an entire partition or storage device such as USB flash drive or hard drive.
- Encryption is automatic, real-time (on-the-fly) and transparent.
- Parallelization and pipelining allow data to be read and written as fast as if the drive was not encrypted.
- Encryption can be hardware-accelerated on modern processors.
- Provides plausible deniability, in case an adversary forces you to reveal the password:
Hidden volume (steganography) and hidden operating system.
Other Raspberry Pi forum users have tried it and found it to work pretty well. There are some instructions on that forum post on how to do it yourself. The explanation is pretty lengthy, so I won't post that here.
Also, Berryboot OS offers LUKS full disk encryption out of the box.
the full system encryption will consume too much processing power for decryption and re-encryption, so you'll effectively bring your processor down to the knees just by reading or writing a file, rendering your system too slow and useless.
you should reconsider your requirements and maybe encrypt your user files only, that's faster and easier. you may follow the following link for detailed explanation.
Kali Linux, a Debian-derived distribution, documents Raspberry Pi Disc Encryption at https://docs.kali.org/kali-dojo/04-raspberry-pi-with-luks-disk-encryption
Quoted excerpt from 2019-04-30:
Birds Eye View of the Disk Encryption Process The process described below was tried and tested successfully on a Raspberry Pi B+ and a Raspberry Pi 2/3 (henceforth collectively called “RPi”). but it should be trivial to port these instructions to any ARM device running Kali. Before we begin, let’s take a minute to quickly describe what we’ll be doing – as while this process is not complicated, it is involved. This is basically our spiel:
We download the required Kali RPi image and dd it to an SD card. We chroot to the RPi image and install/update several files in preparation for our crypted boot. We create an initramfs file which includes Dropbear and freshly generated SSH keys. We rsync the modified rootfs to a temporary backup location and then delete the rootfs partition from the SD card. We then recreate an encrypted partition to which we restore the root partition data. That’s it! If all goes well, the RPi will boot and then LUKS will kick in and ask for a password to decrypt the root drive, while simultaneously opening a Dropbear SSH session through which you can SSH in and provide the boot decryption password. Oh yeah, did we mention this image also has LUKS NUKE capabilities?
previous answer linked to: https://www.offensive-security.com/kali-linux/raspberry-pi-luks-disk-encryption/
