---
title: Raspberry Pi Full Disk Encryption
short: ""
description: ""
type: page
date: 2022-01-18T07:22:48+01:00
author: Semjon Wilhelm
bio: ""
canonical: https://truebloomhub.com/pages/posts/tech/raspberry-pi-encrypted-rootfs
site_name: True Bloom Hub
llms_txt: /llms.txt
---

As the Raspberry Pi boots from the SD card by default and there are no other
boot options, the r/w speed on the SD card is quite limited.

Therefore, this tutorial covers full disk encryption with LUKS and configuring
the rootfs on a different drive.

## Initial Encryption

First of all, install cryptsetup:
```
sudo apt install cryptsetup
```

With the GitHub tutorial mentioned in [1] the initial encryption is setup on
another host PC. If you are planning to move your rootfs from e.g. `mmcblk0p2`
on another drive, this is not needed.

Instead, download the raspberry pi image of your choice (I used Ubuntu for this)
and let the Pi boot from the SD card. Then attach your external drive (e.g. SSD
with USB3.0 to SATA adapter).

This is easier, as cryptsetup on the Pi will use the correct encryption which
has hardware support. Otherwise, check out the tutorial in [1] for the suggested
encryption flags for the Pi.

Now, encrypt and partition the drive:
```
sudo cryptsetup luksFormat /dev/sda
sudo cryptsetup open /dev/sda crypted
sudo mkfs.ext4 /dev/mapper/crypted
```

## Copy system files

It should be sufficient to sync all existing data to the new drive. You can do
this also on another PC. Use sudo to keep all permissions the same. If you do
this while the system is running, make sure to exclude the mountpoint of the
external drive.
```
sudo rsync --archive --hard-links --acls --xattrs --one-file-system --numeric-ids --info="progress2" /mnt/original/* /mnt/chroot/
```

## Update Boot Configuration

Edit `/etc/fstab` with the new root entry for your drive:
```
/dev/mapper/crypted    /               ext4    discard,errors=remount-ro    0 1
LABEL=system-boot      /boot/firmware  vfat    defaults                     0 1
```

Check the UUID of your partitions (crypted and decrypted):
```
$ blkid
/dev/mapper/crypted: UUID="aaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa" TYPE="ext4"
/dev/mmcblk0p1: LABEL_FATBOOT="system-boot" LABEL="system-boot" UUID="aaaa-aaaa" TYPE="vfat" PARTUUID="aaaaaaaa-aa"
/dev/sda1: UUID="aaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa" TYPE="crypto_LUKS" PARTUUID="aaaaaaaa-aa"
```

Add an entry for your encrypted partition in `/etc/crypttab`.
```
crypted UUID=aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa none luks,initramfs
```

Update the root entry in the U-Boot configuration `/boot/cmdline.txt`. Keep all
other configurations in this file as you need.
```
root=/dev/mapper/crypted cryptdevice=UUID=aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa:crypted
```

## Dropbear Configuration

First, install Dropbear. Unfortunately for Ubuntu 20.04 LTS the dropbear
packages are not up to date and are missing the latest security updates.
However, they are available in the Debian repositories or in the newer, non LTS
Ubuntu repositories. You can find the Debian dropbear package under [6].

There should be no problem installing the newer version of dropbear as the
dependencies are the same.

The following packages need to be installed. For reference, the apt command is
included here. Replace it with `dpkg -i <deb file> ...` to install the
manually downloaded packages.

```
sudo apt install dropbear dropbear-bin dropbear-initramfs
```

All dropbear needs to know are your authorized keys, so it is possible to just
copy the file:
```
sudo cp ~/.ssh/authorized_keys /etc/dropbear/initramfs/
```

With the latest dropbear version, dropbear also accepts the ed25519 keytype.

Dropbear generates a new host key by default, so if you do not want to change it
with the `dropbearkey` command (see its manpage [5]) add a special host configuration
for your SSH client like:
```
Host box-initramfs
	Hostname 192.168.0.30
	User root
	UserKnownHostsFile ~/.ssh/known_hosts.initramfs
```

To get the key format of your dropbear key for your known_hosts file run:
```
sudo dropbearkey -y -f /etc/dropbear-initramfs/dropbear_ed25519_host_key
```

If you only want to allow the unlocking of the boot volume, change the dropbear
options in `/etc/dropbear-initramfs/dropbear.conf` like:
```
DROPBEAR_OPTIONS="-sjk -c cryptroot-unlock"
```

Update the initramfs afterwards:
```
sudo update-initramfs -u
```

For more options see the dropbear manpage [4].

## References and further information

 [1] [Github ViRb3/pi-encrypted-boot-ssh](https://github.com/ViRb3/pi-encrypted-boot-ssh)

 [2] [Decrypting boot drives remotely using dropbear](https://thej6s.com/articles/2019-03-05__decrypting-boot-drives-remotely/)

 [3] [Cyberciti - How to unlock LUKS using Dropbear SSH keys remotely in Linux](https://www.cyberciti.biz/security/how-to-unlock-luks-using-dropbear-ssh-keys-remotely-in-linux/)

 [4] [Dropbear Manpage](https://linux.die.net/man/8/dropbear)

 [5] [Dropbearkey Manpage](https://linux.die.net/man/8/dropbearkey)

 [6] [Debian Dropbear Package](https://packages.debian.org/bullseye/dropbear)