With an unspeakable amount of problems, which I will spare you, I finally have managed to install Raspberry Pi OS and VeraCrypt.

I have used VeraCrypt (and, previously, TrueCrypt) for many years, but always on Windows and with the GUI.

I have spent significant time in the manual trying to find this out prior to asking the question. I just can't find any mention of it: https://www.veracrypt.fr/en/Command%20Line%20Usage.html

How do I actually tell VeraCrypt on the command line to encrypt the system (and only) disk? I'm not talking about mounting an existing container or creating a "file". I mean the same thing as is done in the VeraCrypt GUI by clicking:

System > Encrypt System Partition/Drive

I feel a cold sensation of confusion and worry, as if this... might not... exist. But that cannot be. It mustn't be. It would make no sense. It has to exist. The command-line version is just that: a different interface to the same underlying software. And encrypting the system disk is by far the most important feature of this software, and the most common use case. I refuse to believe that it isn't possible.

  • Documentation states partition or drive where Windows is installed so why do you think this will work for Linux? – user115418 Sep 15 '20 at 16:53
  • 1
    why would you need to encrypt the system volume in linux? – jsotola Sep 15 '20 at 17:15
  • 1
    yes, it is a serious question ... why do you need to encrypt publically available programs? ... all you need to encrypt is the private data in /home and /tmp and /etc ... and any other directories that hold private info – jsotola Sep 15 '20 at 17:35
  • 1
    @K.Whiteing I do want to help you ... i read the VeraCrypt docs and could not find anything about encrypting a linux partition that contains existing files ... so, I presented the idea of only encrypting partitions that contain personal information ... I now suspect that you may not be aware that the /home directory can actually be a partition of its own ... same with any other directory ... so, the /home, /etc, /tmp directories could be in an encrypted volume ... the files in /bin and /sbin are open source, so can be unencrypted – jsotola Sep 15 '20 at 21:20
  • 1
    @K.Whiteing Welcome! But please don't mistake curtness for rudeness. I don't see anything in jsotola's comments that is meant to be insulting, unless you read stuff like "why do you need to..." and "all you need..." as chastising. Sans paranoia, the first is a semi-literal, semi-rhetorical question: Perhaps you have a specific reason, and you should explain that as part of the problem context; if not, the asker is suggesting you don't need that and that there are better/easier options. – goldilocks Sep 15 '20 at 22:11

I did not read the VeraCrypt docs, but to determine whether it was proprietary, had mainline kernel support (which you would need if you wanted to encrypt the root fs), I did read the first line of the wikipedia article:

VeraCrypt is a source-available freeware utility used for on-the-fly encryption (OTFE). It can create a virtual encrypted disk within a file or encrypt a partition or (in Windows) the entire storage device with pre-boot authentication."

I've emphasized the "in Windows" part to make this clear. The problem with encrypting the root filesystem is that in order to unencrypt it, you need either:

  • An OS kernel which integrates the encryption (eg. LUKS).1
  • A bootloader which integrates the encryption, which is what it sounds like VeraCrypt implements -- for Windows.

  1. A normative operating system can be considered as two parts, the kernel and the userspace. The kernel is bootloaded, then mounts and starts the userland, which (in the standard Raspbian case) is the stuff in the second partition. The kernel itself is actually on the first. Neither part is much good for anything without the other, so if you encrypt the entire second partition, the kernel or something preceding it must be able to unencrypt it.

If you wanted to encrypt the entire SD card (and not just the partitions on it), I think you are out of luck; there is no room in the Pi boot process for that unless someone writes something special. Don't hold your breath.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.