--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Full disk encryption with Raspberry Pi and dracut
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
This tutorial describes how to enable full disk encryption on a Raspberry Pi using dracut instead of initramfs-tools. Please note that this setup is not supported in any way and might break without warning. Only continue, if you can recover your pi from not booting.
Requirements
- Backups (or use a fresh installation)
- A raspberry pi running a recent version of Raspberry Pi OS (tested on bookworm)
- Linux kernel 5.0 or later
- A usb stick the same size as your sd card (or bigger).
Important: everything on the stick will be overwritten!
Back up everything and update your system
You will overwrite your system partition during this process. If something goes wrong you can't go back without a backup.
Update your installation.
sudo apt update
sudo apt full-upgrade
Reboot
reboot
Install required software
This tutorial uses cryptsetup (>= 2.0.6) and dracut.
sudo apt install cryptsetup dracut
sudo apt autoremove
Configure the kernel command line paramters
Edit /boot/firmware/cmdline.txt (On older OS versions the file should be /boot/cmdline.txt)
Change root=/dev/mmcblk0p2 or root=PARTUUID=<something> to root=/dev/mapper/sdcard
Remove the splash paramater if it is there.
Update partition configuration
Edit /etc/fstab
Replace PARTUUID=<something> or /dev/mmcblk0p2 with /dev/mapper/sdcard for mount point /
Edit /etc/crypttab
Add sdcard /dev/mmcblk0p2 none luks
Configure dracut
Edit /etc/dracut.conf.d/include-software.conf
Add install_items+=" /usr/sbin/cryptsetup /usr/bin/dd /usr/sbin/e2fsck /usr/sbin/resize2fs "
Add add_dracutmodules+=" dm "
Regenerate the initramfs
sudo dpkg-reconfigure dracut
Reboot
Shutting down might fail. You can just force a reset (unplug the power cable). The system will fail to boot. Wait for the timeout and press enter to go to the recovery shell. !!This seems broken on trixie!!
Back up your current system partition
Check the partition
e2fsck -f /dev/mmcblk0p2
Resize the filesystem in order to save space and speed up transfer.
resize2fs -fM -p /dev/mmcblk0p2
The command will print the number of 4k blocks of your resized file system.
Remember this number. It will be used to backup and restore the system partition.
Now insert the usb-stick.
Copy the filesystem to the stick. Replace <blockCount> with the number of 4k blocks optained after the previous command. Replace /dev/sda with the path to your stick.
This command will overwrite your usb stick!
dd bs=4k count=<blockCount> if=/dev/mmcblk0p2 of=/dev/sda
Create an encrypted partition
Important: This will overwrite your system partition!
You can modify the encryption paramters to your liking.
cryptsetup --type luks2 --cipher xchacha20,aes-adiantum-plain64 luksFormat /dev/mmcblk0p2
Type 'YES' and enter a strong password.
Restore your system partition
Open the encrypted volume.
cryptsetup luksOpen /dev/mmcblk0p2 sdcard
Copy the data from the usb stick onto the enrypted partition. Replace <blockCount> with the number of 4k blocks from before. Replace /dev/sda with the path to your stick.
dd bs=4k count=<blockCount> if=/dev/sda of=/dev/mapper/sdcard
Check the restored filesystem.
e2fsck -f /dev/mapper/sdcard
Resize the filesystem.
resize2fs -f /dev/mapper/sdcard
Boot into your encrypted system
exit
Regenerate the initramfs
Add the encrypted partition to the kernel paramters.
echo "$(cat /boot/firmware/cmdline.txt) rd.luks.name=$(blkid -o value -s UUID /dev/mmcblk0p2)=sdcard" | sudo tee /boot/firmware/cmdline.txt
sudo dpkg-reconfigure dracut
Reboot
There should be a prompt asking for your password.
Troubleshooting
Issue: Can't reboot / shutdown, instead dropping to recovery shell. This might help:
Edit /etc/dracut.conf.d/hostonly.conf
Add hostonly="yes"
sudo dpkg-reconfigure dracut
Message me. I might be able to help you. (Don't complain about lost data. I warned you!)
Credits
This tutorial is based on this one: https://rr-developer.github.io/LUKS-on-Raspberry-Pi/