# SolydXK System Settings Encryption Help

## Description

Encrypt partitions of your system with LUKS.

## Important

SolydXK System Settings will create and restore a backup of the data of the partition you are going to encrypt or decrypt. Mount a partition or external drive for this purpose before you start.

You cannot encrypt a booted root or home partition with SolydXK System Settings. If you wish to do so you can download the latest ISO from our main site and run SolydXK System Settings in a live session. Note that you need an unencrypted boot partition if you want to encrypt your root partition and that Grub2 will be installed on the disk where the root partition is.

Only those partitions that are mounted in fstab are saved to fstab. If you wish to include new partitions in fstab you need to manually add them before you run SolydXK System Settings.

## Examples

When you start SolydXK System Settings you will see a list of partitions that you can either encrypt or decrypt. An encrypted partition shows this icon: and an unencrypted partition shows this icon: . Your selection will decide which actions can be taken on that partition. Removable media will show these icons: and .

Following are some examples on how to use SolydXK System Settings:

### Encrypt a USB pen drive

Insert a USB pen drive and mount it. Hit the refresh button to list the pen drive and select the partition of that drive drive you wish to encrypt. Fill in your passphrase twice and hit the "Encrypt" button.

### Encrypt the root (and swap) partition

WARNING: do this at your own risk!

You will need an unecrypted /boot partition. If you do not have a /boot partition, here's how to create one. In a live session you start GParted and create a partition of at least 200 MB of free space. This partition can be created from existing unallocated space, or by shrinking another partition and using the newly-created free space. In this example I've created a new partition: /dev/sda1 which I want to mount as /boot into the root partition /dev/sda2. Change the partition paths accordingly to your situation.

Open a terminal, and run these commands as root:

    # mkdir /mnt/boot /mnt/root
    # mount /dev/sda1 /mnt/boot
    # mount /dev/sda2 /mnt/root
    # cp -a /mnt/root/boot/* /mnt/boot/
    # echo "UUID=$(blkid -o value -s UUID /dev/sda1)    /boot   ext4    defaults    0   0" >> /mnt/root/etc/fstab

You can now reboot your system and check if the boot partition is properly mounted:

    $ mount | grep sda2

To encrypt the root (and swap) partition, you need to start a live session again, start SolydXK System Settings and select the root partition (and any other partition you'd like to encrypt).

### Change the passphrase of an encrypted partition

Select an encrypted partition from the list, fill in your passphrase twice and hit the "Change Passphrase" button.

### Create a key file for a selection of encrypted partitions

Select several encrypted partitions from the list, fill in your passphrase twice and hit the "Manually create key file" button. The first encrypted partition will hold the key file while the other partitions are automatically opened with that key file.

### Decrypt a partition

Select an encrypted partition from the list, fill in your passphrase twice and hit the "Decrypt" button. SolydXK System Settings will search for a partition with enough free space to create a temporary backup of the partition you want to decrypt. You will be asked for a backup medium if it cannot find enough free space to continue.

## Troubleshooting

Please help improve this application. You can find the source on our GitHub page.

If for some reason your system does not mount the newly encrypted partition, please visit our forum and post your issue there.

Don't forget to attach the log file when you post an issue on our forum: /var/log/solydxk-system.log