Linux Tutorial

Linux File/Directory Management

Linux Packaging And Compression

Vim Text Editor

Linux Text Processing

Linux Software Installation

Linux User/User Group Management

Linux Permission Management

Linux Filesystem Management

Linux Advanced Filesystem Management

Linux System Management

Linux Backup and Recovery

Linux System Service Management

Linux System Log Management

Linux Boot Management

LAMP/LNMP Environment

SELinux Management

Linux GRUB Encryption (2 Encryption Methods)

In this tutorial, we'll explain how to encrypt your Linux system and configure GRUB to support booting from an encrypted partition. We'll use LUKS (Linux Unified Key Setup) for encryption and LVM (Logical Volume Manager) to manage the partitions.

Note that this tutorial assumes you are setting up a fresh Linux installation, and all data on your target drive will be wiped during the process. Backup any important data before proceeding.

  • Boot into a Linux live environment using a live USB or CD.

  • Open a terminal and identify your target drive:

sudo fdisk -l

In this tutorial, we'll assume that the target drive is /dev/sda.

  • Create a new GPT partition table:
sudo parted /dev/sda mklabel gpt
  • Create a boot partition (replace X with the appropriate drive letter):
sudo parted /dev/sdX mkpart primary ext4 1MiB 513MiB
sudo mkfs.ext4 /dev/sdX1
  • Create a partition for LVM that will hold the encrypted data:
sudo parted /dev/sdX mkpart primary 513MiB 100%
  • Setup LUKS encryption on the LVM partition:
sudo cryptsetup luksFormat /dev/sdX2
sudo cryptsetup luksOpen /dev/sdX2 lukslvm
  • Create an LVM physical volume, volume group, and logical volumes:
sudo pvcreate /dev/mapper/lukslvm
sudo vgcreate vg /dev/mapper/lukslvm
sudo lvcreate -L 8G -n swap vg
sudo lvcreate -l 100%FREE -n root vg

Adjust the size of the swap partition as needed.

  • Create filesystems on the logical volumes:
sudo mkfs.ext4 /dev/mapper/vg-root
sudo mkswap /dev/mapper/vg-swap
  • Mount the newly created filesystems:
sudo mount /dev/mapper/vg-root /mnt
sudo mkdir /mnt/boot
sudo mount /dev/sdX1 /mnt/boot

  • Begin the Linux installation process, choosing the "Something else" or "Manual partitioning" option when asked about disk partitioning.

  • Assign the /mnt directory as the root filesystem and the /mnt/boot directory as the boot filesystem.

  • Complete the installation process, but do not restart the system when prompted.

  • Chroot into the newly installed system:

sudo chroot /mnt
  • Install and configure GRUB to support encrypted boot:
sudo apt-get update && sudo apt-get install -y cryptsetup lvm2 grub-efi
echo "GRUB_ENABLE_CRYPTODISK=y" | sudo tee -a /etc/default/grub
sudo grub-install --target=x86_64-efi --efi-directory=/boot --bootloader-id=grub
sudo update-grub
  • Exit the chroot environment, unmount the filesystems, and reboot the system:
exit
sudo umount /mnt/boot
sudo umount /mnt
sudo reboot

Your Linux system should now be encrypted, and GRUB will prompt you for the encryption passphrase during the boot process.

Copyright © devanddep.com | All Rights Reserved