Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've been asked to encrypt the filesystem of a live server without affecting the operations or data. I normally install Redhat with encrypted filesystem, so the "how" is not the problem. I want to know if it is even possible to encrypt the filesystem without shrinking the partition, making a new partition, encrypting it, copying everything over, deleting the old partition, and resizing the new partition to fill the drives.

share|improve this question
Not possible. I would just setup a new server then clone the data over and make a switch. – Tiffany Walker Jul 17 '13 at 17:41
It's theorically possible to do: .1 grow physically, .2 grow crypted, than .3 grow fs, or in the other way .1 shrink fs, .2 shrink crypted than .3 shrink partition, but overkill and dangerous as a little error may render your partition unreadable. – F. Hauri Jul 17 '13 at 19:20

You may be quicker by re-creating a new partition that fit target device and use another encryption for transfer:

tar --one-file-system --numeric-owner -cpC / . |gzip |gpg -e -r username >file.tgz.gpg

Care about opened files, you've better to do this in single-user-mode (init 1). Or better: if / is a crypted partition on a LVM2 parted system, you could use a snapshot with lvcreate -s, but you have to open another session of luks to decrypt them before mounting on quiet mountpoint.

lvcreate -s -L 1G -n BkVolName VolGroup/VolName
cryptsetup luksOpen /dev/mapper/VolGroup-BkVolName bk_crypted
mount -o ro /dev/mapper/bk_crypted /mnt

tar -zcpC /mnt . | gpg -e -r username >file.tgz.gpg

umount /mnt
cryptsetup luksClose bk_crypted
lvremove -f VolGroup/BkVolName

Than after moving gpg crypted tarball to destination host, re-creating crypted partition and mounting them on /mnt for sample:

cryptsetup --verbose --verify-passphrase luksFormat $DEVICE
cryptsetup luksOpen $DEVICE new_crypted
mount /dev/mapper/new_crypted /mnt

gpg -d <file.tgz.gpg | tar -zxvC /mnt

umount /mnt
cryptsetup luksClose new_crypted

Doing so let you the ability of whipe file creation and use low-level network directly as:

  • on source host:

    tar --one-file-system -zcpC / . | gpg -e -r uname | nc -q 0 -l -p 9900
  • than when first nc -l is run, on destination host:

    nc sourceHostIPorName 9900 | gpg -d | tar -zxC /mnt
share|improve this answer

Not possible using native tools. It may be possible to encrypt in-place using third-party tools, but I have no experience doing so on RHEL.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.