Difference between revisions of "Removing System Encryption"

Revision as of 22:08, 24 July 2013

This article or section needs language, wiki syntax or style improvements.

Reason: written in first person. (Discuss in Talk:Removing System Encryption#)

Removing system encryption with dm-crypt and LUKS.

Prerequisites

An encrypted root filesystem or other filesystem that cannot be umounted while booted into the operating system.
Enough drive space to store a backup.
An Arch Linux (or other) live CD.
A few hours.

Note: As of late 2012 new tools have been added to cryptsetup to add or remove encryption to/from an existing file system. While they are still considered experimental, they may help considerably with such an effort. More information is available with man cryptsetup-reencrypt.

Boot into a Live Environment

Download and burn the latest archlive cd, reboot system and boot to cd.

Activate Partitions

Note About Different Setups

An example setup is shown here:

disk
ntfs	myvg(lvm)		ntfs
other os	cryptswap(lv)	cryptroot(lv)	Shared
	luks	luks
	swap	root(xfs)

The grey sections only add a frame of reference and can be disregarded. The green partitions will be modified. Green text must match your system's setup. The yellow partition will be used as storage space and may be changed at will. In the example system: myvg contains lvs called cryptroot and cryptswap. they are located at /dev/mapper/myvg_cryptroot and /dev/mapper/myvg_cryptswap. Upon boot, luks is used along with a few crypttab entries to create /dev/mapper/root and /dev/mapper/swap. Swap will not be unencrypted as part of this guide, as undoing the swap encryption does not require any complex backup or restoration.

The example system is not indicative of all systems. Different filesystems require different tools to effectively backup and restore their data. LVM can be ignored if not used. XFS requires xfs_copy to ensure an effective backup and restore, DD is insufficient. DD may be used with ext2,3,and 4. (Someone please comment on jfs, reiserfs and reiser4fs)

Once Partitions Are Located

Load necessary modules:

modprobe dm-mod #device mapper/lvm
modprobe dm-crypt #luks

Activate lvm volume group:

pvscan #scan for Physical Volumes
vgscan #scan for volume groups
lvscan #scan for logical volumes
lvchange -ay myvg/cryptroot

Open the encrypted filesystem with luks so it can be read:

cryptSetup luksOpen /dev/mapper/myvg_cryptroot root

Enter password. Note: The only partition that will be operated on that should be mounted at this point is the backup partition. If a partition other than the backup partition is already mounted, it can be safely umounted it now.

Mounting backup space

Only if using NTFS to store the backup

# pacman -S ntfs-3g

The next step is important for backup storage.

# mount -t ntfs-3g -o rw /dev/sda5 /media/Shared

or use netcat to store the backup on a remote system

TODO: add netcat instructions.

Backup Data

Using xfs_copy:

xfs_copy -db /dev/mapper/root /media/Shared/backup_root.img

Note: -d flag preserves uuids and -b ensures direct IO is not attempted to any of the target files.

Using dd:

dd if=/dev/mapper/root of=/media/Shared/backup_root.img

Undo Encryption

Now the crucial moment, the point of no return if you will. Make sure you are ready to do this. If you plan to undo this later, you will have to almost start from scratch. You know how fun that is.

cryptsetup luksClose root
lvm lvremove myvg/cryptroot

Restore Data

We have to create a new logical volume to house our root filesystem, then we restore our filesystem.

lvm lvcreate -l 100%FREE -n root myvg
xfs_copy -db /media/Shared/backup_root.img /dev/mapper/myvg-root #notice the second drive name is changed now.

Reconfigure the Operating System

You need to boot into your operating system and edit /etc/crypttab, /etc/mkinitcpio.conf, /etc/fstab, and possibly /boot/grub/menu.lst.

@@ Line 1: / Line 1: @@
-=Prerequisites=
+[[Category:Security]]
-*an encrypted root filesystem or other filesystem you cannot umount while booted into your operating system
+{{Poor writing|written in first person.}}
-*enough drive space somewhere to store a backup
-*an Arch Linux (or other) live CD
-*a few hours
-=Boot into a Live Environment=
+Removing system encryption with [[dm-crypt with LUKS|dm-crypt and LUKS]].
-Download and burn the latest archlive cd, stick it in, reboot your system and boot to cd
-=Activate Your Partitions=
+== Prerequisites==
-==Note About Different Setups==
+*An encrypted root filesystem or other filesystem that cannot be umounted while booted into the operating system.
-I'm using a setup that looks like this:
+*Enough drive space to store a backup.
+*An Arch Linux (or other) live CD.
+*A few hours.
+{{Note|As of late 2012 new tools have been added to {{ic|cryptsetup}} to add or remove encryption to/from an existing file system. While they are still considered experimental, they may help considerably with such an effort. More information is available with {{ic|man cryptsetup-reencrypt}}.}}
+==Boot into a Live Environment==
+Download and burn the latest archlive cd, reboot system and boot to cd.
+==Activate Partitions==
+===Note About Different Setups===
+An example setup is shown here:
 {|border=1 style="text-align: center;"
 |colspan=4|disk
 |-
-|style="background-color: #888888;"| ntfs ||colspan=2|lvm ||style="background-color: yellow;"| ntfs
+|style="background-color: #888888;"| ntfs ||colspan=2|myvg(lvm) ||style="background-color: yellow;"| ntfs
 |-
 |rowspan=3 style="background-color: #888888;"| other os
-|vol0 ||style="background-color: green;"| vol1
+|cryptswap(lv) ||style="background-color: green;"| cryptroot(lv)
 |rowspan=3 style="background-color: yellow;"| Shared
 |-
@@ Line 24: / Line 33: @@
 |}
-Disregard the grey stuff, it only adds a frame of reference.
+The grey sections only add a frame of reference and can be disregarded.
-The green partitons are the ones we're going to be modifying.  you should make sure any green text matches your system's setup.
+The green partitions will be modified. Green text must match your system's setup.
-the yellow parition is the one we're going to be using as storage space.  you should feel free to change this at will.
+The yellow partition will be used as storage space and may be changed at will.
+In the example system:
+<span style="color: green;">myvg</span> contains lvs called <span style="color: green;">cryptroot</span> and <span style="color: green;">cryptswap</span>.  they are located at <span style="color: green;">/dev/mapper/myvg_cryptroot</span> and <span style="color: green;">/dev/mapper/myvg_cryptswap</span>.  Upon boot, luks is used along with a few crypttab entries to create <span style="color: green;">/dev/mapper/root</span> and <span style="color: green;">/dev/mapper/swap</span>.  Swap will not be unencrypted as part of this guide, as undoing the swap encryption does not require any complex backup or restoration.
-on my system, I have
+The example system is not indicative of all systems. Different filesystems require different tools to effectively backup and restore their data. LVM can be ignored if not used.
-<span style="color: green;">myvg</span> contains lvs called <span style="color: green;">cryptroot</span> and <span style="color: green;">crtpyswap</span>.  they are located at <span style="color: green;">/dev/mapper/myvg_cryptroot</span> and <span style="color: green;">/dev/mapper/myvg_cryptswap</span>.  Upon boot, luks is used along with a few crypttab entries to create <span style="color: green;">/dev/mapper/root</span> and <span style="color: green;">/dev/mapper/swap</span>.  I won't be unencrypting my swap as part of this guide, as undoing the swap encryption doesn't require any complex backup or restoration.
+XFS requires xfs_copy to ensure an effective backup and restore, DD is insufficient. DD may be used with ext2,3,and 4.  (Someone please comment on jfs, reiserfs and reiser4fs)
-Your setup WILL be different.  different filesystems require different tools to effectively backup and restore their data.  Most of you will not be using LVM and can ignore that part.
+===Once Partitions Are Located===
-XFS requires xfs_copy to ensure an effective backup and restore.  DD is insufficient.  you can use DD with ext2,3,and 4.  (Someone please comment on jfs, reiserfs and reiser4fs)
-==Now That You Know Where Your Partitions Are...==
+Load necessary modules:
-Load necessary modules
   modprobe dm-mod #device mapper/lvm
   modprobe dm-crypt #luks
-activate your lvm volume group
+Activate lvm volume group:
   pvscan #scan for Physical Volumes
   vgscan #scan for volume groups
   lvscan #scan for logical volumes
   lvchange -ay <span style="color: green;">myvg/cryptroot</span>
-open the encrypted filesystem with luks so we can read it
+Open the encrypted filesystem with luks so it can be read:
   cryptSetup luksOpen <span style="color: green;">/dev/mapper/myvg_cryptroot</span> root
-enter your password.
+Enter password.
-Note: do not mount the partitions you intend to operate on except the backup partition.  if you've already mounted a partition other than your backup partition, you can safely umount it now.
+Note: The only partition that will be operated on that should be mounted at this point is the backup partition. If a partition other than the backup partition is already mounted, it can be safely umounted it now.
-Once you've identifed and activated your partitions, you're ready to move on to step 3
+====Mounting backup space====
+Only if using NTFS to store the backup
+ # pacman -S ntfs-3g
+The next step is important for backup storage.
+ # mount -t ntfs-3g -o rw <u>/dev/sda5 /media/Shared</u>
+or use netcat to store the backup on a remote system
-Mounting your backup space
- <span style="color: yellow;">pacman -Sy ntfs-3g</span> #only if you're using NTFS to store your backup like I am
- mount -t ntfs-3g -o rw <span style="color: yellow;">/dev/sda5 /media/Shared</span> #this step will look different for you, but it is important.  without it, where will you store your backup?
-or you can use netcat to store your backup on a remote system
 TODO: add netcat instructions.
-=Backup Your Data=
+==Backup Data==
-using xfs_copy:
+Using xfs_copy:
-  xfs_copy -db <span style="color: green;">/dev/mapper/root</span> <span style="color: yellow;">/media/Shared/backup_root.img</span>
+  xfs_copy -db <span style="color: green;">/dev/mapper/root</span> <u>/media/Shared/backup_root.img</u>
-note: -d tells xfs_copy to preserve uuids and -b tells xfs_copy to work with filesystems that don't allow direct io (like ntfs-3g).
+Note: -d flag preserves uuids and -b ensures direct IO is not attempted to any of the target files.
-using dd:
+Using dd:
-  dd if=<span style="color: green;">/dev/mapper/root</span> of=<span style="color: yellow;">/media/Shared/backup_root.img</span>
+  dd if=<span style="color: green;">/dev/mapper/root</span> of=<u>/media/Shared/backup_root.img</u>
-Now walk away, get yourself something to eat or drink, or do some homework.  this will take a while.
-=Undo Encryption=
+==Undo Encryption==
-Now the crucial moment, the point of no return if you will.  Make sure you're ready to do this, if you plan to un-do this later, you'll have to almost start from scratch.  you know how fun that is.
+Now the crucial moment, the point of no return if you will.  Make sure you are ready to do this. If you plan to undo this later, you will have to almost start from scratch. You know how fun that is.
   cryptsetup luksClose root
   lvm lvremove <span style="color: green;">myvg/cryptroot</span>
-=Restore Data=
+==Restore Data==
-now we have to create a new logical volume to house our root filesystem and restore our filesystem.
+We have to create a new logical volume to house our root filesystem, then we restore our filesystem.
   lvm lvcreate <span style="color: green;">-l 100%FREE -n root myvg</span>
-  xfs_copy -db <span style="color: yellow;">/media/Shared/backup_root.img</span> <span style="color: green;">/dev/mapper/myvg-root</span> #notice the second drive name is changed now.
+  xfs_copy -db <u>/media/Shared/backup_root.img</u> <span style="color: green;">/dev/mapper/myvg-root</span> #notice the second drive name is changed now.
-=Reconfigure the Operating System=
+==Reconfigure the Operating System==
-you need to boot into your operating system and edit /etc/crypttab, /etc/mkinitcpio.conf, /etc/fstab, and possibly /boot/grub/menu.lst
+You need to boot into your operating system and edit /etc/crypttab, /etc/mkinitcpio.conf, /etc/fstab, and possibly /boot/grub/menu.lst.

Difference between revisions of "Removing System Encryption"

Revision as of 22:08, 24 July 2013

Contents

Prerequisites

Boot into a Live Environment

Activate Partitions

Note About Different Setups

Once Partitions Are Located

Mounting backup space

Backup Data

Undo Encryption

Restore Data

Reconfigure the Operating System

Navigation menu

Views

Personal tools

Navigation

Search

interaction

Tools