Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've been asked to encrypt the filesystem of a live server without affecting the operations or data. I normally install Redhat with encrypted filesystem, so the "how" is not the problem. I want to know if it is even possible to encrypt the filesystem without shrinking the partition, making a new partition, encrypting it, copying everything over, deleting the old partition, and resizing the new partition to fill the drives.

share|improve this question
    
Not possible. I would just setup a new server then clone the data over and make a switch. –  Tiffany Walker Jul 17 '13 at 17:41
    
It's theorically possible to do: .1 grow physically, .2 grow crypted, than .3 grow fs, or in the other way .1 shrink fs, .2 shrink crypted than .3 shrink partition, but overkill and dangerous as a little error may render your partition unreadable. –  F. Hauri Jul 17 '13 at 19:20
add comment

2 Answers

Not possible using native tools. It may be possible to encrypt in-place using third-party tools, but I have no experience doing so on RHEL.

share|improve this answer
add comment

You may be quicker by re-creating a new partition that fit target device and use another encryption for transfer:

tar --one-file-system --numeric-owner -cpC / . |gzip |gpg -e -r username >file.tgz.gpg

Care about opened files, you've better to do this in single-user-mode (init 1). Or better: if / is a crypted partition on a LVM2 parted system, you could use a snapshot with lvcreate -s, but you have to open another session of luks to decrypt them before mounting on quiet mountpoint.

lvcreate -s -L 1G -n BkVolName VolGroup/VolName
cryptsetup luksOpen /dev/mapper/VolGroup-BkVolName bk_crypted
mount -o ro /dev/mapper/bk_crypted /mnt

tar -zcpC /mnt . | gpg -e -r username >file.tgz.gpg

umount /mnt
cryptsetup luksClose bk_crypted
lvremove -f VolGroup/BkVolName

Than after moving gpg crypted tarball to destination host, re-creating crypted partition and mounting them on /mnt for sample:

cryptsetup --verbose --verify-passphrase luksFormat $DEVICE
cryptsetup luksOpen $DEVICE new_crypted
mount /dev/mapper/new_crypted /mnt

gpg -d <file.tgz.gpg | tar -zxvC /mnt

sync
umount /mnt
cryptsetup luksClose new_crypted

Doing so let you the ability of whipe file creation and use low-level network directly as:

  • on source host:

    tar --one-file-system -zcpC / . | gpg -e -r uname | nc -q 0 -l -p 9900
    
  • than when first nc -l is run, on destination host:

    nc sourceHostIPorName 9900 | gpg -d | tar -zxC /mnt
    
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.