Post-Install Disk Encryption?
Hey all,
been using Bazzite well for almost a long while now and I've just noticed that I had forgotten to enable disk encryption during the installation.
So my question is basically, is there a way to enable disk-encryption after the fact?
Or if not full disk encryption (due to complexities), at least just the per user home folder?
Cheers in advance!
been using Bazzite well for almost a long while now and I've just noticed that I had forgotten to enable disk encryption during the installation.
So my question is basically, is there a way to enable disk-encryption after the fact?
Or if not full disk encryption (due to complexities), at least just the per user home folder?
Cheers in advance!
Solution
For anyone in this sort of situation, you have two options realistically:
* If you really need full disk encryption, just re-install
* If you don't mind only having the home folder encrypted there is ways to do that
But if you're curious about trying to do in-place, check out https://www.johannes-bauer.com/linux/luksipc/
Otherwise for the home folder thing, as an overview of what I did
1. Shrink system volume
2. Add a new partition that will become your new /home folder (as mount point as well)
3. Encrypt it
4. Add a script to decrypt the home folder on login (as system.d)
This is because I had no luck with trying this on the standard btrfs formatted drive.
Anyhow, it was a fun experiment, but no, just reinstall and check the box on the installer.
Then remember to setup tpm unlock using
* If you really need full disk encryption, just re-install
* If you don't mind only having the home folder encrypted there is ways to do that
But if you're curious about trying to do in-place, check out https://www.johannes-bauer.com/linux/luksipc/
Otherwise for the home folder thing, as an overview of what I did
1. Shrink system volume
2. Add a new partition that will become your new /home folder (as mount point as well)
3. Encrypt it
4. Add a script to decrypt the home folder on login (as system.d)
This is because I had no luck with trying this on the standard btrfs formatted drive.
Anyhow, it was a fun experiment, but no, just reinstall and check the box on the installer.
Then remember to setup tpm unlock using
