58

I recently installed Ubuntu 12.10 and it requires a passphrase to boot up (I installed it with an encrypted file system).

Do I have to reinstall to change to a standard unencrypted file system?

6
  • Did you encrypt the entire Ubuntu installation, or just your home directory?
    – Flimm
    Jan 19, 2013 at 21:30
  • I encrypted during install, so I'm guessing the entire install.
    – Zzealdor
    Jan 19, 2013 at 22:08
  • 3
    I'm a new user so I'm unsure how stuff works in Linux (Got totally fed up with Microsoft!)
    – Zzealdor
    Jan 19, 2013 at 22:26
  • @Rinzwind Probably not. This method (ecryptfs) encrypts the home directory and doesn't need an extra password; the login password is used.
    – Jan
    Jan 19, 2013 at 23:03
  • 1
    @user163872: The new Ubuntu versions (12 and 13) are very slow on old computers such as netbooks. You should install Lubuntu, which is designed for speed and runs very fast on older/slower computers, even with low RAM (i.e. 512MB). Lubuntu is almost same as normal Ubuntu - only the desktop/menus are a bit different. But everything that works on normal Ubuntu it will work also in Lubuntu.
    – lara
    Jan 15, 2014 at 11:50

6 Answers 6

33

If Ubuntu asks for an encryption passphrase during boot (i.e. on the text console before the login screen is displayed), this indicates that a full disk encryption method was used. (There's more than one way to do this, but I'll keep the answer general.) The encryption is handled by an extra software layer between the file system and the physical hard drive, not the file system itself.

There is no simple method or tool to undo this. With some knowledge about how Linux systems work, it can be done. You'd have to move the whole file system (or all files) to another partition (with enough free space) or external HDD. Then, remove the encrypted container, and recreate the file system without encryption. Finally, make sure that the new file system is properly recognized by the boot loader and mount -a before rebooting.

If possible, it's best to avoid this time consuming and error-prone procedure. Just do a fresh install. For a new user, this is the quickest and safest option.

PS: Chances are that you can change the encryption passphrase, possibly to an empty string. Then decrypting only requires to press Enter. Maybe you can go further and supress to (now useless) passphrase prompt. However, this does not disable the encryption. The data would still be encrypted although the encryption would be useless since the key can be trivially guessed.

2
  • 4
    In theory, should you not be able to do something like "dd if=/dev/mapper/sda5_crypt of=/dev/sda5 bs=32M" ?
    – Roy
    May 18, 2013 at 18:11
  • 2
    @Roy, I think that will work if and only if the following are true: 1. dd and the underlying drivers do not write until they have finished reading each block (there are probably flags and settings to ensure this) 2. the read/write blocks do not overlap the edges of encryption blocks (can be checked, may involve some math) 3. important header information needed for decryption is not overwritten before completion (check the underlying encryption format, perhaps process from end-to-start). I think it is possible but would need a more careful setup and analysis.
    – fuzzyTew
    Sep 24, 2013 at 14:08
26

Below it's my solution that worked. Bear in mind that I am not Linux specialist, so it may be not the best solution. Could not find better one anyway.

Migrating FDE installation to unencrypted partition

NOTE: Whenever I say, I mean

/dev/sda1 - boot partition
/dev/sda5 - encrypted partition
/dev/sda3 - clean non-encrypted EXT4 partition
/dev/sda2 - my newly created swap partition

Copying data from encrypted root filesystem

Boot from a live CD. I've used Ubuntu 13.10 32bit desktop ISO.

Mount your partition:

sudo cryptsetup luksOpen /dev/sda5 crypt1

Copy your source data to destination partition and save dd PID to pid variable:

sudo dd if=/dev/ubuntu-vg/root of=/dev/sda3 bs=1M & pid=$!

This will ping each second dd process with USR1 signal and dd results status:

while sudo kill -USR $pid; do sleep 1; done

Alternative to monitoring DD

If you don't like above 'while method', you can use watch. Open different terminal window and get the PID:

pgrep -l '^dd$' | awk '{ print $1 }'

Replace with your process ID:

watch kill -USR1 <pid>

You should see output in your dd terminal each 2s.

Configuring the new root filesystem and partitions

When it's done you can mount your non-encrpyted partition to see if it's OK:

sudo mount /dev/sda3 /mnt

After that unmount your partition:

sudo umount /dev/sda3

Release crypt partition:

sudo cryptsetup luksClose /dev/sda5

Run gparted. Delete your LUKS partition (both extended and logical). Resize your /dev/sda3 and move left. Create swap partition.

Note: Moving your /dev/sda3 left may take long. For me it took 30min on 120GB partition and SSD drive. If you have 500GB+ HDD be prepared for few hours waiting. You may want to create swap before your partition instead of moving your /dev/sda3.

Create a new swap filesystem on your swap partition:

sudo mkswap /dev/sda2 

and store somewhere the UUID.

Get your root partition UUID:

sudo blkid /dev/sda3

Edit fstab:

sudo nano /etc/fstab

Delete or comment out overlayfs and tmpfs lines.

Add line replacing with blkid result:

UUID=<uuid_root> /  ext4 errors=remount-ro 0 1
UUID=<uuid_swap> none swap sw 0 0

Remove file:

rm /etc/crypttab

Update your initramfs to avoid errors like "cryptsetup: evms_activate is not available":

sudo -i
mount /dev/sda3 /mnt
mount -t proc none /mnt/proc
mount -o bind /sys /mnt/sys
mount -o bind /dev /mnt/dev
mount /dev/sda1 /mnt/boot
chroot /mnt /bin/bash
apt-get remove --purge cryptsetup
update-initramfs -u -k all

Final notes and troubleshooting

It worked for me, however there is chance that doing above step by step may not work for you. Before I've figured out the update-initramfs method I was reinstalling kernel few times also was modifying grub. However it should not be a case for you. Remember that above instructions may delete your data, so be careful and make BACKUP, BEFORE proceeding that.

Just in case you have kernel troubles (chrooted and /boot mounted):

uname -r
sudo apt-get install --reinstall linux-image-3.X.Y-ZZ-generic

Of course replace linux-image-3.X.Y-ZZ with your kernel date from uname.

or GRUB (outside chroot):

sudo add-apt-repository ppa:yannubuntu/boot-repair && sudo apt-get update
sudo apt-get install -y boot-repair && (boot-repair &)

More details: https://help.ubuntu.com/community/Boot-Repair

Good luck

4
  • 1
    I believe that you have to replace the UUID of the swap partition in /etc/initramfs-tools/conf.d/resume manually and I would recommend copying the filesystem contents with cp -a or rsync -a as that would be faster in general and safer for SSDs.
    – LiveWireBT
    Jan 29, 2014 at 21:38
  • Thanks for making my elaboration more user friendly. I didn't do the resume change, also was scared using cp or rsync, thought that dd (raw copy from device to device) it's the proper tool for such a tasks. I was doing that on VM, but image was placed on SSD. Can you elaborate the: "safer for SSDs" please? Jan 30, 2014 at 21:27
  • Using dd copies the whole partition, even blocks that should be empty, which causes unnecessary writes to the SSD (and on some it even harms the performance writing to almost all cells). A few years ago I and some others also found that copying with dd and activating TRIM (EXT4 discard option) will cause TRIM to delete blocks that it thinks are empty and leave you with a broken installation after a few hours.
    – LiveWireBT
    Jan 31, 2014 at 7:42
  • In the first monitoring method should be USR1 instead of USR. I know it's obvious, but can be an issue for newbies like me ;)
    – goodfellow
    Feb 19, 2019 at 6:53
13

In case it is OK to keep the encryption, but to switch off the passphrase prompt, a much simpler approach is to just set a trivial password like "password" and then save that trivial password in the initramfs in cleartext. Disable the LUKS encryption password.

Essentially, add a hook script which in turn adds a "keyscript" to the initramfs. Usually these scripts are used to get the password via Bletooth, from a USB stick etc., but in this case, just make it print the trivial password.

9

It is actually possible to decrypt the partition in place without much effort. For example, see the instructions here, which are generally just as valid for Ubuntu as for Arch. In my case, I had a LUKS1 device, which apparently makes things easier. All I had to do was this:

  1. Boot into a live environment using a USB stick. I used Ubuntu 18.04.
  2. Run sudo cryptsetup-reencrypt --decrypt <device_path>.

That was it. For a 250 GB SSD, it took 20 minutes. I didn't have to do anything special to /etc/fstab, grub, or initramfs. I commented out the relevant (only) line in /etc/crypttab, but I don't even think that was necessary.

That said, I had a second machine with a 500 GB SSD, and after about 3 hours, it still claimed it was going to be another 90 minutes and the rate was only getting slower, so I gave up and just reflashed the drive.

Before doing anything, though, I recommend backing up the (decrypted) partition. Using dd as described in another answer is great. I did it while the partition was mounted before I rebooted into the live USB environment. This came in handy for the partition I ended up reflashing, as I was able to remount the backup and copy over anything I cared strongly about.

1
  • really nice. Progress: 8.7%, ETA 11:21, 19756 MiB written, speed 302.6 MiB/s
    – Tomachi
    Mar 16, 2022 at 2:34
1

@pattivacek 's short answer worked fine for me. To get rid of the start screen "Enter your password" part - i just added

apt purge cryptsetup

after that.

0

Just format the encrypted disk and run disk drill , thats what i did i just put it in the slot sata on my windows laptop dont write anything to it after you have formatted it , use disk drill and voila, an Lubuntu encrypted volume was all open to get back my files from.

1
  • can you elaborate on this? What is disk drill? You can only do this using Windows I guess?
    – Zanna
    Mar 23, 2021 at 12:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .