1

I am trying to install *20.04.01 on my desktop with full (or almost full as Tj puts it) disk encryption including encrypted swap partition that allows hibernation, and btrfs.

The last few years I am using ManualFullSystemEncryption but even being careful to make sure I do not turn my system off after an update before the grub fix script automatically runs, these updates or *Windows updates if dual booting, have broken grub and I have often had to boot to a live USB and run fix-grub.sh.

Yesterday I followed Tj's Full_Disk_Encryption_Howto_2019 but when I got to the point of formatting /dev/mapper/ubuntu--vg-root I searched to see if I needed to do anything extra to use btrfs and ext3. I have since learned that using btrfs is not as simple as just selecting another filesystem from the dropdown.

This next brought me to Willi Mutschler's Ubuntu 20.04 with btrfs-luks full disk encryption including /boot and auto-apt snapshots with Timeshift which is very similar to Tj's, although it includes many extra steps for optimising btrfs and SSD. This is almost perfect for my intention, the only issue is that Willi sets it up so that swap is encrypted with a random password as he does not use hibernation:

export SWAPUUID=$(blkid -s UUID -o value /dev/vda2)echo "cryptswap UUID=${SWAPUUID} /dev/urandom swap,offset=1024,cipher=aes-xts-plain64,size=512" >> /etc/crypttab
cat /etc/crypttab
# cryptdata UUID=8e893c0f-4060-49e3-9d96-db6dce7466dc none luks
# cryptswap UUID=9cae34c0-3755-43b1-ac05-2173924fd433 /dev/urandom swap,offset=1024,cipher=aes-xts-plain64,size=512

He references Archlinux's dm-crypt/Swap encryption which I have looked through, and it would seem I need to set up some kind of hook for swap, but I have not been able to make much more sense of it than that.

Last night I found Félix Saparelli's Full-disk encryption with Btrfs, swap, and hibernation. It gives commands for setting up encrypted swap but not the rest of the install, so I had planned today to try and use it in conjunction with Willi's guide to achieve my desired install.

I wanted to post and ask if this is the best approach, or if there is better way to do this or a more complete guide?

Edit: HOWTO - GPT/UEFI install with full disk encryption: BTRFSonLUKS with separate root, home and pkg subvolumes; hibernation with a swapfile; auto-snapshots with easy system rollback (GUI); boot into snapshots describes the kind of install I am trying to get to although I am not sure exactly how to change it to work with Ubuntu.

*I would prefer to install Ubuntu Server edition on my desktop and then manually install my desktop environment as I have read this is an even more stripped down version of Ubuntu than the minimal install. Unfortunately when following Tj's guide, which is not intended for Server, after selecting the partitions the installer errored. Willi's guide references files for optimising btrfs in /usr/lib/partman which is not contained in the server installer and the same files do not exist anywhere else and it does not seem I can just install a package for partman.

*I was running a setup with Windows 10 on the same drive encrypted with VeraCrypt. This time I am not dual booting.

3
  • Doing a standard install of 20.04, at Installation type I used "Erase disk and install Ubuntu" and then select "Advanced features". then "Use LVM with the new Ubuntu installation" and then "Encrypt the new Ubuntu installation for security". I recall that I set up hibernation okay but I was not able to increase the swap file size enough to save much during hibernation. I was able to make a good size swap file but only got a black screen on resume. I may have got confused with all the UUID's or offset. Sep 9 '20 at 11:34
  • As documented in the guides I have linked, unfortunately the installer will not encrypt the full disk, and it will not allow optimising btrfs for SSD/nvme. A swap partition is also required for hibernation, and this is not possible with a swap file. Please correct me if I am wrong.
    – dusf
    Sep 9 '20 at 12:09
  • Hibernation is possible with a swapfile, I will find something in a few minutes. Sep 9 '20 at 12:14
2

Swap File and Hibernation

A computer can have multiple swap partitions and a fresh install of Ubuntu will use them all, even if they are not listed in fstab, In addition the computer can use a single swap file if it is listed in fstab.

Even Live and Persistent bootable USB devices will use all the swap partition(s) they find.

Ubuntu 20.04 will create a swap file during installation as long as there are no existing swap partitions on the computer.

Once the swap file has been added to fstab the computer will not use any swap partition that are not listed in fstab.

Security:

A swap file is part of the root partition and automatically gets encrypted along with it.

To replace a swap partition with a swap file:

  • Check the swap that is in use:

    sudo swapon -s

  • If swap partition(s) found:

    sudo swapoff -a

    sudo nano -Bw /etc/fstab

  • Add "# " before the UUID of the swap partition(s):

    # UUID=XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX none swap sw 0 0

  • Add a line for the swapfile:

    swapfile none swap sw 0 0

  • Create the swap file:

    sudo fallocate -l XG /swapfile

Where X is the swapfile size in GB

    sudo mkswap /swapfile

    sudo chown 0600 /swapfile

    sudo swapon /swapfile
  • Reboot:

    sudo reboot

To Enable Hibernation:

  • Increase swap file size to match RAM size up to 8GB per above as required.

  • Edit /etc/default/grub to add resume location and offset to grub.cfg:

GRUB_CMDLINE_LINUX_DEFAULT="quiet splash resume=UUID=XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX resume_offset=XXXXX"

  • Use UUID from root.

  • Use offset from sudo filefrag -v /swapfile |grep " 0:"| awk '{print $4}'

  • Update GRUB

    sudo update-grub

  • Test hibernation

    sudo systemctl hibernate

A hibernate button can be added using gnome extensions.

NOTES:

  • There is a slight possibility of getting holes in a swapfile when creating it with fallocate. /var/log/syslog can be searched for the phrase swapon: swapfile has holes to ensure there will be no data loss.
5
  • Thanks but I have learned that your method will not work for btrfs. There is more detail here Hibernation into a swap file.
    – dusf
    Sep 9 '20 at 18:18
  • Thank you for the info, at least it is good to know that swap files do work with btrfs. Sep 10 '20 at 1:12
  • I have this working now and I will post the solution soon.
    – dusf
    Sep 10 '20 at 12:03
  • I will stay tuned. Sep 10 '20 at 12:56
  • Thanks, solution works fine for me. To avoid warnings I set different owner for the swapfile sudo chown 0.0 /swapfile
    – VadzimV
    Jun 3 at 14:21
0

With some help from the reddit user /u/hack1z0 I was able to configure resuming Ubuntu Mate 20.04.1 (which was installed using Willi Mutschler's guide) from hibernation in a swap file with the following steps:

When creating the swap file make it large enough (for my 16GB of RAM Ubuntu recommends 20GB but I stuck with the 2x rule and chose 32GB).

Calculate resume offset according to Hibernation into a swap file on Btrfs

Get UUID of the /swap subvolume from /etc/fstab.

In /etc/default/grub edit the line 'Edit the line: GRUB_CMDLINE_LINUX_DEFAULT=""' to one similar to: 'GRUB_CMDLINE_LINUX_DEFAULT="resume=UUID=X resume_offset=X quiet splash"', where the X values are those from the previous steps.

sudo update-grub

For this install at least, contrary to other documentation, no editing of initramfs is necessary, just reboot.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.