I recently installed Ubuntu 12.10 and it requires a passphrase to boot up (I installed it with an encrypted file system).
Do I have to reinstall to change to a standard unencrypted file system?
|show 1 more comment|
If Ubuntu asks for an encryption passphrase during boot (i.e. on the text console before the login screen is displayed), this indicates that a full disk encryption method was used. (There's more than one way to do this, but I'll keep the answer general.) The encryption is handled by an extra software layer between the file system and the physical hard drive, not the file system itself.
There is no simple method or tool to undo this. With some knowledge about how Linux systems work, it can be done. You'd have to move the whole file system (or all files) to another partition (with enough free space) or external HDD. Then, remove the encrypted container, and recreate the file system without encryption. Finally, make sure that the new file system is properly recognized by the boot loader and
If possible, it's best to avoid this time consuming and error-prone procedure. Just do a fresh install. For a new users, this is the quickest and safest option.
PS: Chances are that you can change the encryption passphrase, possibly to an empty string. Then decrypting only requires to press Enter. Maybe you can go further and supress to (now useless) passphrase prompt. However, this does not disable the encryption. The data would still be encrypted although the encryption would be useless since the key can be trivially guessed.
Below it's my solution that worked. Bear in mind that I am not Linux specialist, so it may be not the best solution. Could not find better one anyway.
Migrating FDE installation to unencrypted partition
NOTE: Whenever I say, I mean
Copying data from encrypted root filesystem
Boot from a live CD. I've used Ubuntu 13.10 32bit desktop ISO.
Mount your partition:
Copy your source data to destination partition and save dd PID to pid variable:
This will ping each second dd process with USR1 signal and dd results status:
Alternative to monitoring DD
If you don't like above 'while method', you can use watch. Open different terminal window and get the PID:
Replace with your process ID:
You should see output in your dd terminal each 2s.
Configuring the new root filesystem and partitions
When it's done you can mount your non-encrpyted partition to see if it's OK:
After that unmount your partition:
Release crypt partition:
Run gparted. Delete your LUKS partition (both extended and logical). Resize your /dev/sda3 and move left. Create swap partition.
Note: Moving your /dev/sda3 left may take long. For me it took 30min on 120GB partition and SSD drive. If you have 500GB+ HDD be prepared for few hours waiting. You may want to create swap before your partition instead of moving your /dev/sda3.
Create a new swap filesystem on your swap partition:
and store somewhere the UUID.
Get your root partition UUID:
Delete or comment out overlayfs and tmpfs lines.
Add line replacing with blkid result:
Update your initramfs to avoid errors like "cryptsetup: evms_activate is not available":
Final notes and troubleshooting
It worked for me, however there is chance that doing above step by step may not work for you. Before I've figured out the update-initramfs method I was reinstalling kernel few times also was modifying grub. However it should not be a case for you. Remember that above instructions may delete your data, so be careful and make BACKUP, BEFORE proceeding that.
Just in case you have kernel troubles (chrooted and /boot mounted):
Of course replace linux-image-3.X.Y-ZZ with your kernel date from uname.
or GRUB (outside chroot):
More details: https://help.ubuntu.com/community/Boot-Repair
In case it is OK to keep the encryption, but to switch off the passphrase prompt, a much simpler approach is to just set a trivial password like "password" and then save that trivial password in the initramfs in cleartext. Disable the LUKS encryption password.
Essentially, add a hook script which in turn adds a "keyscript" to the initramfs. Usually these scripts are used to get the password via Bletooth, from a USB stick etc., but in this case, just make it print the trivial password.