0

With an unspeakable amount of problems, which I will spare you, I finally have managed to install Raspberry Pi OS and VeraCrypt.

I have used VeraCrypt (and, previously, TrueCrypt) for many years, but always on Windows and with the GUI.

I have spent significant time in the manual trying to find this out prior to asking the question. I just can't find any mention of it: https://www.veracrypt.fr/en/Command%20Line%20Usage.html

How do I actually tell VeraCrypt on the command line to encrypt the system (and only) disk? I'm not talking about mounting an existing container or creating a "file". I mean the same thing as is done in the VeraCrypt GUI by clicking:

System > Encrypt System Partition/Drive

I feel a cold sensation of confusion and worry, as if this... might not... exist. But that cannot be. It mustn't be. It would make no sense. It has to exist. The command-line version is just that: a different interface to the same underlying software. And encrypting the system disk is by far the most important feature of this software, and the most common use case. I refuse to believe that it isn't possible.

New contributor
K. Whiteing is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.
  • Documentation states partition or drive where Windows is installed so why do you think this will work for Linux? – Andyroo 2 days ago
  • @Andyroo Why do I think that a program which claims to support various OSes works on said OSes? I don't know... intuition? Seriously... What do you mean? – K. Whiteing 2 days ago
  • read second paragraph of relentlesscoding.com/posts/… ..... perhaps you have to create an encrypted volume, copy files, unmount original volume, mount encrypted volume, delete original volume – jsotola 2 days ago
  • @jsotola Hmm. That guide confuses me. Just as you mention, the second paragraph of that link talks about "already have created a partition on a drive." But that makes no sense. The task is to encrypt the system disk. The only one. Not some other one. – K. Whiteing 2 days ago
  • 1
    @K.Whiteing I do want to help you ... i read the VeraCrypt docs and could not find anything about encrypting a linux partition that contains existing files ... so, I presented the idea of only encrypting partitions that contain personal information ... I now suspect that you may not be aware that the /home directory can actually be a partition of its own ... same with any other directory ... so, the /home, /etc, /tmp directories could be in an encrypted volume ... the files in /bin and /sbin are open source, so can be unencrypted – jsotola 2 days ago
0

I did not read the VeraCrypt docs, but to determine whether it was proprietary, had mainline kernel support (which you would need if you wanted to encrypt the root fs), I did read the first line of the wikipedia article:

VeraCrypt is a source-available freeware utility used for on-the-fly encryption (OTFE). It can create a virtual encrypted disk within a file or encrypt a partition or (in Windows) the entire storage device with pre-boot authentication."

I've emphasized the "in Windows" part to make this clear. The problem with encrypting the root filesystem is that in order to unencrypt it, you need either:

  • An OS kernel which integrates the encryption (eg. LUKS).1
  • A bootloader which integrates the encryption, which is what it sounds like VeraCrypt implements -- for Windows.

  1. A normative operating system can be considered as two parts, the kernel and the userspace. The kernel is bootloaded, then mounts and starts the userland, which (in the standard Raspbian case) is the stuff in the second partition. The kernel itself is actually on the first. Neither part is much good for anything without the other, so if you encrypt the entire second partition, the kernel or something preceding it must be able to unencrypt it.

If you wanted to encrypt the entire SD card (and not just the partitions on it), I think you are out of luck; there is no room in the Pi boot process for that unless someone writes something special. Don't hold your breath.

| improve this answer | |

Your Answer

K. Whiteing is a new contributor. Be nice, and check out our Code of Conduct.

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.