-1

With an unspeakable amount of problems, which I will spare you, I finally have managed to install Raspberry Pi OS and VeraCrypt.

I have used VeraCrypt (and, previously, TrueCrypt) for many years, but always on Windows and with the GUI.

I have spent significant time in the manual trying to find this out prior to asking the question. I just can't find any mention of it: https://www.veracrypt.fr/en/Command%20Line%20Usage.html

How do I actually tell VeraCrypt on the command line to encrypt the system (and only) disk? I'm not talking about mounting an existing container or creating a "file". I mean the same thing as is done in the VeraCrypt GUI by clicking:

System > Encrypt System Partition/Drive

I feel a cold sensation of confusion and worry, as if this... might not... exist. But that cannot be. It mustn't be. It would make no sense. It has to exist. The command-line version is just that: a different interface to the same underlying software. And encrypting the system disk is by far the most important feature of this software, and the most common use case. I refuse to believe that it isn't possible.

13
  • 1
    @Andyroo Why do I think that a program which claims to support various OSes works on said OSes? I don't know... intuition? Seriously... What do you mean? Commented Sep 15, 2020 at 16:59
  • 1
    why would you need to encrypt the system volume in linux?
    – jsotola
    Commented Sep 15, 2020 at 17:15
  • 1
    yes, it is a serious question ... why do you need to encrypt publically available programs? ... all you need to encrypt is the private data in /home and /tmp and /etc ... and any other directories that hold private info
    – jsotola
    Commented Sep 15, 2020 at 17:35
  • 1
    @K.Whiteing I do want to help you ... i read the VeraCrypt docs and could not find anything about encrypting a linux partition that contains existing files ... so, I presented the idea of only encrypting partitions that contain personal information ... I now suspect that you may not be aware that the /home directory can actually be a partition of its own ... same with any other directory ... so, the /home, /etc, /tmp directories could be in an encrypted volume ... the files in /bin and /sbin are open source, so can be unencrypted
    – jsotola
    Commented Sep 15, 2020 at 21:20
  • 2
    @K.Whiteing Welcome! But please don't mistake curtness for rudeness. I don't see anything in jsotola's comments that is meant to be insulting, unless you read stuff like "why do you need to..." and "all you need..." as chastising. Sans paranoia, the first is a semi-literal, semi-rhetorical question: Perhaps you have a specific reason, and you should explain that as part of the problem context; if not, the asker is suggesting you don't need that and that there are better/easier options.
    – goldilocks
    Commented Sep 15, 2020 at 22:11

1 Answer 1

0

I did not read the VeraCrypt docs, but to determine whether it was proprietary, had mainline kernel support (which you would need if you wanted to encrypt the root fs), I did read the first line of the wikipedia article:

VeraCrypt is a source-available freeware utility used for on-the-fly encryption (OTFE). It can create a virtual encrypted disk within a file or encrypt a partition or (in Windows) the entire storage device with pre-boot authentication."

I've emphasized the "in Windows" part to make this clear. The problem with encrypting the root filesystem is that in order to unencrypt it, you need either:

  • An OS kernel which integrates the encryption (eg. LUKS).1
  • A bootloader which integrates the encryption, which is what it sounds like VeraCrypt implements -- for Windows.

  1. A normative operating system can be considered as two parts, the kernel and the userspace. The kernel is bootloaded, then mounts and starts the userland, which (in the standard Raspbian case) is the stuff in the second partition. The kernel itself is actually on the first. Neither part is much good for anything without the other, so if you encrypt the entire second partition, the kernel or something preceding it must be able to unencrypt it.

If you wanted to encrypt the entire SD card (and not just the partitions on it), I think you are out of luck; there is no room in the Pi boot process for that unless someone writes something special. Don't hold your breath.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.