16

My Question is: I'd like to use my Raspbian encrypted, just like it is standard on Debian, Ubuntu or other Linux-Distros.

My Problem: Technically, you are not installing Raspbian on a Raspberry Pi or a SD-Card, instead you are copying a prepared image from the internet. Is there a way to perform an encryption of the whole system? (maybe without /boot)

  • Wouldn't truecrypt do the job? truecrypt.org you can choose if you want full system encryption or just parts of the partition. – justanotherhobbyist Oct 11 '13 at 21:59
  • 2
    @hustlerinc TrueCrypt can only boot Windows from an encrypted disk/partition. While you could encrypt the Raspbian partition, you wouldn't be able to boot from it anymore. – n.st Oct 12 '13 at 13:17
  • 2
    Raspbian is Debian, and you should be able to use it to do the same things -- just not via an installer, obviously, which will complicate encrypting the entire system. AFAICT they use dm-crypt: en.wikipedia.org/wiki/Dm-crypt – goldilocks Oct 12 '13 at 14:39
7

I would use TrueCrypt. Some of it's main features (from the site) include:

  • Creates a virtual encrypted disk within a file and mounts it as a real disk.
  • Encrypts an entire partition or storage device such as USB flash drive or hard drive.
  • Encryption is automatic, real-time (on-the-fly) and transparent.
  • Parallelization and pipelining allow data to be read and written as fast as if the drive was not encrypted.
  • Encryption can be hardware-accelerated on modern processors.
  • Provides plausible deniability, in case an adversary forces you to reveal the password:
    Hidden volume (steganography) and hidden operating system.

Other Raspberry Pi forum users have tried it and found it to work pretty well. There are some instructions on that forum post on how to do it yourself. The explanation is pretty lengthy, so I won't post that here.


Also, Berryboot OS offers LUKS full disk encryption out of the box.

4

the full system encryption will consume too much processing power for decryption and re-encryption, so you'll effectively bring your processor down to the knees just by reading or writing a file, rendering your system too slow and useless.

you should reconsider your requirements and maybe encrypt your user files only, that's faster and easier. you may follow the following link for detailed explanation.

0

Kali Linux, a Debian-derived distribution, documents Raspberry Pi Disc Encryption at https://docs.kali.org/kali-dojo/04-raspberry-pi-with-luks-disk-encryption

Quoted excerpt from 2019-04-30:

Birds Eye View of the Disk Encryption Process The process described below was tried and tested successfully on a Raspberry Pi B+ and a Raspberry Pi 2/3 (henceforth collectively called “RPi”). but it should be trivial to port these instructions to any ARM device running Kali. Before we begin, let’s take a minute to quickly describe what we’ll be doing – as while this process is not complicated, it is involved. This is basically our spiel:

We download the required Kali RPi image and dd it to an SD card. We chroot to the RPi image and install/update several files in preparation for our crypted boot. We create an initramfs file which includes Dropbear and freshly generated SSH keys. We rsync the modified rootfs to a temporary backup location and then delete the rootfs partition from the SD card. We then recreate an encrypted partition to which we restore the root partition data. That’s it! If all goes well, the RPi will boot and then LUKS will kick in and ask for a password to decrypt the root drive, while simultaneously opening a Dropbear SSH session through which you can SSH in and provide the boot decryption password. Oh yeah, did we mention this image also has LUKS NUKE capabilities?

previous answer linked to: https://www.offensive-security.com/kali-linux/raspberry-pi-luks-disk-encryption/

  • 2
    Summarize the information from the link in your post. – tlhIngan Jun 30 '16 at 9:01
  • @jimmont - Yu should probably submit your own updated answer, rather than updating a very old post – Greenonline Apr 30 at 4:16
  • We have encouraged people to fill in the blanks on link-only answers, although otherwise I would agree w/ GOL. – goldilocks Apr 30 at 12:18

protected by goldilocks Jun 29 '16 at 17:19

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.