Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

Ubuntu 13.04 installation disk has an option to install Ubuntu encrypted using LUKS. However, there is no option to perform an encrypted installation along-side existing partitions for a dual-boot scenario.

How can I install Ubuntu encrypted alongside another partition from the live disk?

share|improve this question
add comment

1 Answer

up vote 10 down vote accepted

First of all, if you want to install Ubuntu encrypted on a hard disk, replacing any existing partitions and operating systems, you can do this directly from the graphical installer. This manual process is only required for dual-booting.

This answer has been tested with Ubuntu 13.04.

  1. Boot from an Ubuntu live DVD or USB stick, and select "Try Ubuntu".

  2. Create two partitions using GParted included in the live disk. The first partition should be unformatted and should be large enough for root and swap, in my example, this is /dev/sda3. The second partition should be several hundred megabytes big and formatted in ext2 or ext3, it will be unencrypted and mounted to /boot (in my example this is /dev/sda4).

    In this screenshot, I have an existing unencrypted Ubuntu installation in two partitions: /dev/sda1 and /dev/sda5, highlight in the circle to the left. I have created an unformatted partition in /dev/sda3 and an ext3 partition in /dev/sda4, intended for the encrypted Ubuntu installation, higlighted in the circle to the right:

    GParted screenshot

  3. Create a LUKS container using these commands. Replace /dev/sda3 with the unformatted partition created earlier, and cryptcherries with a name of your choice.

    sudo cryptsetup luksFormat /dev/sda3
    sudo cryptsetup luksOpen /dev/sda3 cryptcherries
    
  4. Inside the mounted LUKS container, create an LVM physical volume, a volume group and two logical volumes. The first logical volume will be mounted at /, and the second one will be used as swap. vgcherries is the name of the volume group, and lvcherriesroot and lvcherriesswap are the names of the logical volumes, you can choose your own.

    sudo pvcreate /dev/mapper/cryptcherries
    sudo vgcreate vgcherries /dev/mapper/cryptcherries
    sudo lvcreate -n lvcherriesroot -L 7.5g vgcherries
    sudo lvcreate -n lvcherriesswap -L 1g vgcherries
    
  5. Create filesystems for the two logical volumes: (You can also do this step directly from the installer.)

    sudo mkfs.ext4 /dev/mapper/vgcherries-lvcherriesroot
    sudo mkswap /dev/mapper/vgcherries-lvcherriesswap
    
  6. Install Ubuntu using the graphical installer, choosing manual partitioning. Assign / to /dev/mapper/vgcherries-lvcherriesroot and /boot to the unencrypted partition created in step 2 (in this example,/dev/sda4).

  7. Once the graphical installer is finished, select "continue testing" and open a terminal.

  8. Find the UUID of the LUKS partitions (/dev/sda3 in this case), you will need it later:

    $ sudo blkid /dev/sda3
    /dev/sda3: UUID="8b80b3a7-6a33-4db3-87ce-7f126545c74af" TYPE="crypto_LUKS"
    
  9. Mount the appropriate devices to the appropriate locations in /mnt, and chroot into it:

    sudo mount /dev/mapper/vgcherries-lvcherriesroot /mnt
    sudo mount /dev/sda4 /mnt/boot
    sudo mount --bind /dev /mnt/dev
    sudo chroot /mnt
    > mount -t proc proc /proc
    > mount -t sysfs sys /sys
    > mount -t devpts devpts /dev/pts
    
  10. Create a file named /etc/crypttab in the chrooted environment to contain this line, replacing the UUID value with the UUID of the LUKS partition, and vgcherries with the name of the volume group:

    # <target name> <source device> <key file> <options>
    cryptcherries UUID=8b80b3a7-6a33-4db3-87ce-7f126545c74af none luks,retry=1,lvm=vgcherries
    
  11. Create a file named /etc/initramfs-tools/conf.d/cryptroot in the chrooted environment to contain this line, replacing cryptcherries with the name used to open the LUKS container, and the UUID value with the UUID of the LUKS partition:

     CRYPTROOT=target=cryptcherries,source=/dev/disk/by-uuid/8b80b3a7-6a33-4db3-87ce-7f126545c74af
    
  12. Run the following command in the chrooted environment:

    update-initramfs -k all -c
    
  13. Edit the file named /etc/default/grub in the chrooted envirnoment, find the line that looks like this:

    GRUB_CMDLINE_LINUX=""
    

    Change it to look like this, replacing cryptcherries, vgcherries and the UUID value with the appropriate values:

    GRUB_CMDLINE_LINUX="cryptopts=target=cryptcherries,source=/dev/disk/by-uuid/8b80b3a7-6a33-4db3-87ce-7f126545c74af,lvm=vgcherries"
    
  14. Run the following command in the chrooted environment:

    update-grub
    
  15. Reboot and boot into the encrypted Ubuntu. You should be prompted for a password.

  16. Check that you're using the encrypted partition for / by running mount:

    $ mount
    /dev/mapper/vgcherries-lvcherriesroot on / type ext4 (rw,errors=remount-ro)
    /dev/sda4 on /boot type ext3 (rw)
    # rest of output cut for brevity
    
  17. Check that you're using the encrypted swap partition (not any unencrypted swap partitions from any other installations) by running this command:

    $ swapon -s
    Filename                              Type      Size   Used Priority
    /dev/mapper/vgcherries-lvcherriesswap partition 630780 0    -1
    
  18. Check that you can boot into recovery mode, you don't want to find out later during an emergency that recovery mode doesn't work :)

  19. Install any updates, which are likely to rebuild the ramdisk and update the grub configuration. Reboot and test both normal mode and recovery mode.

share|improve this answer
    
This is how I got an encrypted LVM setup on Elementary OS Luna as well. Commenting here so I can find it again and for SEO. –  sirlancelot Oct 14 '13 at 20:04
    
Excellent tutorial! A little suggestion: explain how to "Assign" mount points in the graphical installer, and maybe have a screenshot of the final configuration. It took me a while to figure out because it was behind the “change” button, which looked like it was just for reformatting partitions. –  Kevin Reid Nov 16 '13 at 0:15
    
Here's a rejected suggested edit that might actually be correct, I haven't had time to look at it properly: askubuntu.com/review/suggested-edits/228261 –  Flimm Feb 27 at 13:03
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.