Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I recently installed Ubuntu 12.10 and it requires a passphrase to boot up (I installed it with an encrypted file system).

Do I have to reinstall to change to a standard unencrypted file system?

share|improve this question
    
Did you encrypt the entire Ubuntu installation, or just your home directory? –  Flimm Jan 19 '13 at 21:30
    
I encrypted during install, so I'm guessing the entire install. –  Zzealdor Jan 19 '13 at 22:08
    
I'm a new user so I'm unsure how stuff works in Linux (Got totally fed up with Microsoft!) –  Zzealdor Jan 19 '13 at 22:26
    
@Rinzwind Probably not. This method (ecryptfs) encrypts the home directory and doesn't need an extra password; the login password is used. –  Jan Jan 19 '13 at 23:03
    
I have installed also Ubuntu 12.0 with full encription in a small laptop... and then my system got very very slowly... I have already reinstalled it, even with the newste version, formatting everything without the encription option... but my system continuos to be so slowly... How can I solve it? Before I had used Ubuntu als "trial" without installing, and it was quite good... How can I get my useful laptop back? –  user163872 Jun 2 '13 at 16:45

3 Answers 3

up vote 3 down vote accepted

If Ubuntu asks for an encryption passphrase during boot (i.e. on the text console before the login screen is displayed), this indicates that a full disk encryption method was used. (There's more than one way to do this, but I'll keep the answer general.) The encryption is handled by an extra software layer between the file system and the physical hard drive, not the file system itself.

There is no simple method or tool to undo this. With some knowledge about how Linux systems work, it can be done. You'd have to move the whole file system (or all files) to another partition (with enough free space) or external HDD. Then, remove the encrypted container, and recreate the file system without encryption. Finally, make sure that the new file system is properly recognized by the boot loader and mount -a before rebooting.

If possible, it's best to avoid this time consuming and error-prone procedure. Just do a fresh install. For a new users, this is the quickest and safest option.

PS: Chances are that you can change the encryption passphrase, possibly to an empty string. Then decrypting only requires to press Enter. Maybe you can go further and supress to (now useless) passphrase prompt. However, this does not disable the encryption. The data would still be encrypted although the encryption would be useless since the key can be trivially guessed.

share|improve this answer
    
Thanks Jan, I will reinstall. –  Zzealdor Jan 19 '13 at 23:30
1  
In theory, should you not be able to do something like "dd if=/dev/mapper/sda5_crypt of=/dev/sda5 bs=32M" ? –  Roy May 18 '13 at 18:11
    
@Roy, I think that will work if and only if the following are true: 1. dd and the underlying drivers do not write until they have finished reading each block (there are probably flags and settings to ensure this) 2. the read/write blocks do not overlap the edges of encryption blocks (can be checked, may involve some math) 3. important header information needed for decryption is not overwritten before completion (check the underlying encryption format, perhaps process from end-to-start). I think it is possible but would need a more careful setup and analysis. –  fuzzyTew Sep 24 '13 at 14:08

Below it's my solution that worked. Bear in mind that I am not Linux specialist, so it may be not the best solution. Could not find better one anyway.

Migrating FDE installation to unencrypted partition

NOTE: Whenever I say, I mean

/dev/sda1 - boot partition
/dev/sda5 - encrypted partition
/dev/sda3 - clean non-encrypted EXT4 partition
/dev/sda2 - my newly created swap partition

Copying data from encrypted root filesystem

Boot from a live CD. I've used Ubuntu 13.10 32bit desktop ISO.

Mount your partition:

sudo cryptsetup luksOpen /dev/sda5 crypt1

Copy your source data to destination partition and save dd PID to pid variable:

sudo dd if=/dev/ubuntu-vg/root of=/dev/sda3 bs=1M & pid=$!

This will ping each second dd process with USR1 signal and dd results status:

while sudo kill -USR $pid; do sleep 1; done

Alternative to monitoring DD

If you don't like above 'while method', you can use watch. Open different terminal window and get the PID:

pgrep -l '^dd$' | awk '{ print $1 }'

Replace with your process ID:

watch kill -USR1 <pid>

You should see output in your dd terminal each 2s.

Configuring the new root filesystem and partitions

When it's done you can mount your non-encrpyted partition to see if it's OK:

sudo mount /dev/sda3 /mnt

After that unmount your partition:

sudo umount /dev/sda3

Release crypt partition:

sudo cryptsetup luksClose /dev/sda5

Run gparted. Delete your LUKS partition (both extended and logical). Resize your /dev/sda3 and move left. Create swap partition.

Note: Moving your /dev/sda3 left may take long. For me it took 30min on 120GB partition and SSD drive. If you have 500GB+ HDD be prepared for few hours waiting. You may want to create swap before your partition instead of moving your /dev/sda3.

Create a new swap filesystem on your swap partition:

sudo mkswap /dev/sda2 

and store somewhere the UUID.

Get your root partition UUID:

sudo blkid /dev/sda3

Edit fstab:

sudo nano /etc/fstab

Delete or comment out overlayfs and tmpfs lines.

Add line replacing with blkid result:

UUID=<uuid_root> /  ext4 errors=remount-ro 0 1
UUID=<uuid_swap> none swap sw 0 0

Remove file:

rm /etc/crypttab

Update your initramfs to avoid errors like "cryptsetup: evms_activate is not available":

sudo -i
mount /dev/sda3 /mnt
mount -t proc none /mnt/proc
mount -o bind /sys /mnt/sys
mount -o bind /dev /mnt/dev
mount /dev/sda1 /mnt/boot
chroot /mnt /bin/bash
apt-get remove --purge cryptsetup
update-initramfs -u -k all

Final notes and troubleshooting

It worked for me, however there is chance that doing above step by step may not work for you. Before I've figured out the update-initramfs method I was reinstalling kernel few times also was modifying grub. However it should not be a case for you. Remember that above instructions may delete your data, so be careful and make BACKUP, BEFORE proceeding that.

Just in case you have kernel troubles (chrooted and /boot mounted):

uname -r
sudo apt-get install --reinstall linux-image-3.X.Y-ZZ-generic

Of course replace linux-image-3.X.Y-ZZ with your kernel date from uname.

or GRUB (outside chroot):

sudo add-apt-repository ppa:yannubuntu/boot-repair && sudo apt-get update
sudo apt-get install -y boot-repair && (boot-repair &)

More details: https://help.ubuntu.com/community/Boot-Repair

Good luck

share|improve this answer
    
I believe that you have to replace the UUID of the swap partition in /etc/initramfs-tools/conf.d/resume manually and I would recommend copying the filesystem contents with cp -a or rsync -a as that would be faster in general and safer for SSDs. –  LiveWireBT Jan 29 at 21:38
    
Thanks for making my elaboration more user friendly. I didn't do the resume change, also was scared using cp or rsync, thought that dd (raw copy from device to device) it's the proper tool for such a tasks. I was doing that on VM, but image was placed on SSD. Can you elaborate the: "safer for SSDs" please? –  NeverEndingQueue Jan 30 at 21:27
    
Using dd copies the whole partition, even blocks that should be empty, which causes unnecessary writes to the SSD (and on some it even harms the performance writing to almost all cells). A few years ago I and some others also found that copying with dd and activating TRIM (EXT4 discard option) will cause TRIM to delete blocks that it thinks are empty and leave you with a broken installation after a few hours. –  LiveWireBT Jan 31 at 7:42

In case it is OK to keep the encryption, but to switch off the passphrase prompt, a much simpler approach is to just set a trivial password like "password" and then save that trivial password in the initramfs in cleartext. Disable the LUKS encryption password.

Essentially, add a hook script which in turn adds a "keyscript" to the initramfs. Usually these scripts are used to get the password via Bletooth, from a USB stick etc., but in this case, just make it print the trivial password.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.