disk encryption

[Jeffrey Ross]

I installed Fedora 23 on a Laptop a while back and I decided to use disk 
encryption.  At this point I find the disk encryption to be more of a 
hindrance and would like to remove it.

Am I correct that it may simply be easier to re-install the system 
rather than try to remove the encryption or is there an easy way to 
remove it?

Thanks, Jeff

[Susi Lehtola]

On 01/14/2016 06:40 PM, Jeffrey Ross wrote:
> I installed Fedora 23 on a Laptop a while back and I decided to use disk
> encryption.  At this point I find the disk encryption to be more of a
> hindrance and would like to remove it.
>
> Am I correct that it may simply be easier to re-install the system
> rather than try to remove the encryption or is there an easy way to
> remove it?

You're not saying if you encrypted the whole system or no.

To remove the encryption, you'll need to reformat any encrypted 
partitions, which means moving your data somewhere else.

Now, if you only encrypted the /home partition and had enough space on 
other partitions, you could move the data away, reformat the partition 
/home is situated, and move the data back.

In general you'll have to reinstall.

[Jeffrey Ross]

> On 01/14/2016 06:40 PM, Jeffrey Ross wrote:
> > I installed Fedora 23 on a Laptop a while back and I decided to use disk
> > encryption.  At this point I find the disk encryption to be more of a
> > hindrance and would like to remove it.
> >
> > Am I correct that it may simply be easier to re-install the system
> > rather than try to remove the encryption or is there an easy way to
> > remove it?
>
> You're not saying if you encrypted the whole system or no.
>
> To remove the encryption, you'll need to reformat any encrypted
> partitions, which means moving your data somewhere else.
>
> Now, if you only encrypted the /home partition and had enough space on
> other partitions, you could move the data away, reformat the partition
> /home is situated, and move the data back.
>
> In general you'll have to reinstall.

can't look at the system at the moment to know what filesystem type I
used, I probably used xfs and I did encrypt all volumes as I think that
was the default when I chose filesystem encryption at install time.

filesystems are (from memory) /boot, /, /home

so maybe luksipc may or may not be an option.

Based upon the responses and how little I've actually done on the system
it may simply be easier to just do a re-install.

Thanks Jeff

[Ranjan Maitra]

I think you can get rid of disk encryption using luksipc.

Here is what I did when I had to do the reverse process:

https://lists.fedoraproject.org/pipermail/users/2015-December/467195.html

Not completely sure it will help, but I think luksipc should have the potential to work.
Best wishes,
Ranjan

On Thu, 14 Jan 2016 21:40:56 -0500 Jeffrey Ross  wrote:
> I installed Fedora 23 on a Laptop a while back and I decided to use disk 
> encryption.  At this point I find the disk encryption to be more of a 
> hindrance and would like to remove it.
>
> Am I correct that it may simply be easier to re-install the system 
> rather than try to remove the encryption or is there an easy way to 
> remove it?
> Thanks, Jeff
>
> users mailing list
> [e-mail]
> To unsubscribe or change subscription options:
> https://admin.fedoraproject.org/mailman/listinfo/users
> Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct
> Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines
> Have a question? Ask away: http://ask.fedoraproject.org

[Chris Murphy]

Slightly off topic: Android and Cyanogenmod have an encryption option, it
converts the user data volume in place, and its reversible.

Does anyone know what they're leveraging to do this? If it were only in
Google's Android I might guess it's one of those proprietary parts, but
it's definitely in Cyanogenmod also. Seems like that could be leveraged,
not in the O.P.'S case, but by desktop Linux.

Kind annoying this is an install option only right now.

Chris Murphy

[Chris Murphy]

On Fri, Jan 15, 2016 at 1:52 AM, Chris Murphy  wrote:
> Slightly off topic: Android and Cyanogenmod have an encryption option, it
> converts the user data volume in place, and its reversible.
>
> Does anyone know what they're leveraging to do this? If it were only in
> Google's Android I might guess it's one of those proprietary parts, but it's
> definitely in Cyanogenmod also. Seems like that could be leveraged, not in
> the O.P.'S case, but by desktop Linux.
>
> Kind annoying this is an install option only right now.

Well look at that, looks like a new LUKS format is in our future. And
so is live conversion.
https://devconfcz2016.sched.org/event/5nsA/the-future-of-disk-encryption-wit...

[Robert Nichols]

On 01/14/2016 08:40 PM, Jeffrey Ross wrote:
> I installed Fedora 23 on a Laptop a while back and I decided to use disk
> encryption.  At this point I find the disk encryption to be more of a
> hindrance and would like to remove it.
>
> Am I correct that it may simply be easier to re-install the system
> rather than try to remove the encryption or is there an easy way to
> remove it?

It can be done, but you'd damned well better have a good backup since
any mistake or glitch will probably be fatal.

1. Determine the size of the LUKS header. (I'll use /dev/sda1 as the
    encrypted partition -- yours may differ.)
       cryptsetup luksDump /dev/sda1 | grep "Payload offset"
    That offset is the number of 512-byte sectors, probably 4096. If
    different, replace "4096" with the correct number in everything
    that follows.
2. Unlock the partition:
       cryptsetup luksOpen /dev/sda1 mysource
3. Copy the decrypted data directly back to the partition at the
    correct offset (4096 sectors assumed here):
       dd if=/dev/mapper/mysource bs=$((4096*512)) of=/dev/sda1 seek=1
4. Adjust the partition table to add 4096 sectors to the starting
    LBA for sda1 without moving the ending LBA.
5. Zero out the LUKS header:
       dd if=/dev/zero bs=$((4096*512)) count=1 of=/dev/sda1
6. Make adjustments to /etc/fstab and any GRUB references to the
    formerly encrypted partition.
7. Say a prayer and boot your system.

Oh yes, it's absolute necessary to do this from some recovery media
with the partition unmounted.

[Roberto Ragusa]

On 01/15/2016 04:58 PM, Robert Nichols wrote:
> Copy the decrypted data directly back to the partition at the
> correct offset (4096 sectors assumed here):
>    dd if=/dev/mapper/mysource bs=$((4096*512)) of=/dev/sda1 seek=1
> Adjust the partition table to add 4096 sectors to the starting
> LBA for sda1 without moving the ending LBA.

You are decrypting in place and then moving forward the beginning
of the partition to skip over the missing luks header (which
you then clean in step 5).

Wouldn't be better to decrypt while shifting everything back
and then (eventually) resize the filesystem to gain the extra
space at the end of the partition?
The final partition layout would be certainly cleaner and the
process is simpler (remove "seek=1" and skip step 4 and step 5)

(but I agree that your approach is easier to revert)

Regards.

[Robert Nichols]

On 01/15/2016 11:52 AM, Roberto Ragusa wrote:
> On 01/15/2016 04:58 PM, Robert Nichols wrote:
> > Copy the decrypted data directly back to the partition at the
> >  correct offset (4096 sectors assumed here):
> >     dd if=/dev/mapper/mysource bs=$((4096*512)) of=/dev/sda1 seek=1
> > Adjust the partition table to add 4096 sectors to the starting
> >  LBA for sda1 without moving the ending LBA.
>
> You are decrypting in place and then moving forward the beginning
> of the partition to skip over the missing luks header (which
> you then clean in step 5).

OOPS!! There is a nasty mistake on my part there. Zeroing out the
first two megabytes _after_ adjusting the partition table would wipe
out the first two megabytes of the filesystem. Steps 4 and 5 have
to be reversed:

1. Determine the size of the LUKS header. (I'll use /dev/sda1 as the
    encrypted partition -- yours may differ.)
       cryptsetup luksDump /dev/sda1 | grep "Payload offset"
    That offset is the number of 512-byte sectors, probably 4096. If
    different, replace "4096" with the correct number in everything
    that follows.
2. Unlock the partition:
       cryptsetup luksOpen /dev/sda1 mysource
3. Copy the decrypted data directly back to the partition at the
    correct offset (4096 sectors assumed here):
       dd if=/dev/mapper/mysource bs=$((4096*512)) of=/dev/sda1 seek=1
4. Zero out the LUKS header:
       dd if=/dev/zero bs=$((4096*512)) count=1 of=/dev/sda1
5. Adjust the partition table to add 4096 sectors to the starting
    LBA for sda1 without moving the ending LBA.
6. Make adjustments to /etc/fstab and any GRUB references to the
    formerly encrypted partition.
7. Say a prayer and boot your system.