It is sensible that if you have any sort of block device encryption implemented on your GNU/Linux system, to encrypt your swap partition too, as any decrypted data may be written in cleartext at any time to the swap.

Looking at the debian man page for "crypttab" I see an example of creating a randomly keyed swap partition on boot-up, so the key is set randomly as the boot proceeds and known only to the system itself:

# Encrypted swap device
cswap /dev/sda6 /dev/urandom cipher=aes-cbc-essiv:sha256,hash=ripemd160,size=256,swap

In this example the swap device is referred to by a conventional dev path i.e. /dev/sda6

Absolute device paths are subject to change and be re-assigned at boot-up if, say a usb drive is plugged in, for example. A user would be very unhappy if /dev/sda6 happened to be a different partition than expected and it was subsequently overwritten with random swap data!!

So the solution would seem to be: use a UUID instead of a device path (as a UUID shouldn't change), replacing /dev/sda6 with /dev/disk/by-uuid/<whatever the uuid of dev/sda6 is>

BUT ... here's the problem: Every time cryptsetup recreates the encrypted swap partition at boot time it generates a new UUID for it! Doh!

So we need to preserve the UUID of this encrypted filesystem somehow. I think cryptsetup can do this with its --offset switch, allowing for preservation of the LUKS header and thus the UUID.

I have found this URL: https://wiki.archlinux.org/index.php/System_Encryption_with_LUKS#Using_UUIDs_with_encrypted_swap_partitions

Does anyone know how to implement the solution described for Arch Linux on the Debian OS? The init scripts referred to in the document seem not to exist on the Debian OS


EDIT One could use ecryptfs to achieve the same ends (encrypted swap space) using the command: ecryptfs-setup-swap Without the problems that beset block device encryption. Have a look at this AskUbuntu query

  • "One could use ecryptfs to achieve the same ends [...] Without the problems that beset block device encryption." No, because ecryptfs-setup-swap is just a helper that configures dm-crypt/crypttab for you. As ecryptfs is a file-level driver, it doesn't handle entire partitions, so it farms that off to dm-crypt. You might find this method more user-friendly, but you are ultimately not achieving anything different. If anything, the quirks of this method (including the UUID) probably made me more confused than if I had just done it myself from first principles... though I learned more. – underscore_d Sep 23 '15 at 22:52

Every time cryptsetup recreates the encrypted swap partition at boot time it generates a new UUID for it! Doh!

In /etc/crypttab, use /dev/disk/by-id instead of /dev/disk/by-UUID to refer to your swap partition. For example, your /etc/fstab entry for swap might be

#<file system> <mount point> <type> <options> <dump> <pass>
/dev/mapper/cswap none swap sw 0 0

Then the correct corresponding entry in /etc/crypttab would be something like

# <name> <device> <password> <options>
cswap /dev/disk/by-id/ata-SAMSUNG_SSD_830_Series_S0XYNEAC762041-part5 /dev/urandom swap,cipher=aes-cbc-essiv:sha256,size=256

Notice that the device above is referred to by /dev/disk/by-id which you can find out for your drive by typing the following at the CLI:

ls -lF /dev/disk/by-id
| improve this answer | |
  • Note that the by-id name refers to both the model and serial number, which is extremely unlikely to overlap with any other device you might plug in. – cscracker May 23 '15 at 6:15
  • ...which, for the benefit of readers who might be wondering, is a very good thing. You don't want to configure your encrypted swap as /dev/sdaN then plug in another disk some day and find that your kernel naming order has been shifted and one of your non-swap partitions has been trashed. UUID would be nice, too, but I think the key problem is that it's stored in the first few bytes of the partition, so we get the insoluble chicken-and-egg scenario that's discussed here. – underscore_d Sep 23 '15 at 22:58

In my /etc/crypttab, I have

# <target name>  <source device>        <key file>   <options>
swap             /dev/mapper/cswap      /dev/random  swap

Here /dev/mapper/cswap is a logical volume created by LVM, which takes care of correctly assigning logical volume names regardless of the drive letter names. It also allows me to easily resize my swap partition.

| improve this answer | |

Try implementing the rest of the solution, ignoring the init file. It looks like that bit of init script is only there to protect you. Either Debian doesn't protect you in that way, or it will give you an error message when you try to boot with it that will hopefully lead you to the right place.

I'd also be careful that IIRC Debian and ArchLinux have different formats for /etc/crypttab (crazy, I know, but I moved from Ubuntu to Arch a couple years ago and eventually decided to use straight bash rather than meddle with crypttabs).

| improve this answer | |
  • Thanks for your response. Yes I would agree the the Arch script is a sanity check to make sure the partition appears to be a swap partition. But I'm imagining having left a USB drive plugged in and rebooting to find a non-swap partition being used. I think I would cry real tears... I'm grateful for all the sanity checks I can get! – Geeb Oct 1 '11 at 22:23
  • That shouldn't happen because you're using its UUID to find it in the first place. So all it'll find is the swap partition, or nothing. – idupree Oct 18 '11 at 18:33

run ecryptfs-setup-swap or manually:

This Configuration uses randomly generated keys at boot and will not support Hibernation to hard disk! You Should Disable Hibernation through your respectie DE Power Management Utility and set it to Shutdown on Critical to avoid Data Loss!

Switch to an admin/root account

su root or sudo for each command

Disable Swap

swapoff -a

Locate the existing Swap Partition


example: sda3 8:3 0 8G 0 part [SWAP]

Overwrite Old Swap

dd if=/dev/zero bs=1024000 of=/dev/sda<#>

example: dd if=/dev/zero bs=1024000 of=/dev/sda3

FSTAB setup

vim /etc/fstab

Replace old SWAP device with crypttab mapper name: /dev/mapper/cswap

OLD UUID=d03f3d8e-7888-48a5-b3cc-41de8dbbcfdc swap swap defaults 0 0


/dev/mapper/cswap none swap pri=1,defaults 0 0

Crypto Setup

ls -lF /dev/disk/by-id

Example: ata-HGST_HTS545050A7E680_TEK55D4F0BU3GV-part3 -> ../../sda3

vim /etc/crypttab

cswap /dev/disk/by-id/ata-HGST_HTS545050A7E680_TEK55D4F0BU3GV-part3 /dev/urandom swap,cipher=aes-cbc-essiv:sha256,size=256

Active Encrypted Swap

Reboot The Computer

Verify Enctypted Swap Operations

dmsetup -C info

Example: cswap 253 0 L--w 2 1 0 CRYPT-PLAIN-cswap


Example ├─sda3 8:3 0 8G 0 part
│ └─cswap 253:0 0 8G 0 crypt [SWAP]

cat /proc/swaps

example: Filename Type Size Used Priority /dev/dm-0 partition 8385532 0 -1

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.