up vote 18 down vote favorite
10

When I installed Ubuntu, I setup an encrypted home partition. Now I have come to an issue where I am running out of memory because I haven't setup swap. How can I setup an encrypted swap file?

A couple of times while booting I've seen some reference to cryptswap. I've also got these lines contained in /etc/fstab

# swap was on /dev/sda6 during installation
#UUID=1ba8a53b-1842-4de7-8e38-2d6c79f3a1ab none            swap    sw              0       0
/dev/mapper/cryptswap1 none swap sw 0 0
share|improve this question
    
In newer ubuntu-versions (tested 14.10). You have to run /etc/init.d/cryptdisks-early reload @Adam Ryczkowski could you post your startup script? – Jan B Jan 23 '15 at 13:02
up vote 17 down vote accepted

Thanks to this guide I have setup an encrypted swap file (can't be used for hiberation). On debian based distributions, you will need the cryptsetup package for these instructions.

  1. Firstly create an appropriately sized file (here 4 gigabytes) to store the swap data

    fallocate -l 4G /cryptswap

  2. Add the following to /etc/crypttab

    cryptswap /cryptswap /dev/urandom swap

  3. Activate the newly created encrypted drive

    service cryptdisks reload

  4. Add the following to /etc/fstab

    /dev/mapper/cryptswap none swap sw 0 0

  5. Activate the new swap file

    swapon -a

share|improve this answer
    
This encrypted swap is the only secure option for hibernation. With a little change to /etc/crypttab and a startup script (to ask user for mount password) – Adam Ryczkowski Feb 5 '14 at 15:23
    
@AdamRyczkowski if you're around, another user was asking for that startup script, if you made one. See comment on the question. – muru Jan 23 '15 at 21:20
    
@muru On Ubuntu 14.04 there is no need for such script. If I recall correctly, the early booting scripts parse the /etc/crypttab for a line like cryptswap /dev/sda5 none luks and asks the user for a password autmatically – Adam Ryczkowski Jan 24 '15 at 10:39
3  
Instead of truncate use fallocate to allocate inode to file; the mkswap step is useless as it is overwritten later when encrypted swap is setup. – solsTiCe May 28 '15 at 9:49
2  
Nice summary. However, anyone wanting to read more will find that your link "this guide" is dead. – underscore_d Jul 28 '16 at 20:06
up vote 2 down vote

Skip the reboot:

sudo cryptdisks_start cryptswap

where cryptswap is the name in /etc/crypttab

share|improve this answer
    
I don't understand how that addresses the question. Could you please explain? As far as I understand it, OP wants to know how to set up (encrypted) swap space properly. Your answer just describes how to start a previously defined encrypted volume but not how to use it for swapping. -1 – David Foerster Mar 6 '17 at 22:10

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.