# Encrypting Your Root File System on RASPBERRY PI - using LUKS & dm-crypt **URL:** \ **Category:** Encrypting File System\ **Created:** [May 15, 2017, 6:22am UTC](https://community.zymbit.com/t/encrypting-your-root-file-system-on-raspberry-pi-using-luks-dm-crypt/150 "2017-05-15T06:22:09Z")\ **Posts on this page:** 17\ **Page:** 11
**Author:** ![Bob\_of\_Zymbit](https://avatars.discourse-cdn.com/v4/letter/b/82dd89/32.png) [@Bob\_of\_Zymbit](https://community.zymbit.com/u/Bob_of_Zymbit)\ **Post date:** [December 5, 2020, 12:59am UTC](https://community.zymbit.com/t/encrypting-your-root-file-system-on-raspberry-pi-using-luks-dm-crypt/150/203 "2020-12-05T00:59:09Z")
@mayank The fact that /dev/mapper/cryptrfs does not exist means the encryption process did not complete the second part after the first reboot. It would probably be best to start fresh. A couple of things to note: - The Zymkey must be installed and bound properly before moving on to encryption. The blue LED should be flashing once every three seconds. - Start with a reformatted USB stick for the encryption process. The USB stick should be twice the size of your SD card. - During the encryption process, the LED will stop flashing once every three seconds and will flash constantly. - After the first reboot, login and run “journalctl -fu cfg\_SD\_crfs”. That will show you progress of the second half of the encryption process. If you see an error there, let us know. - Once the entire process completes, the Zymkey will return to flashing once every three seconds. Hope that helps, Bob ---
**Author:** ![mayank](https://yyz1.discourse-cdn.com/flex027/user_avatar/community.zymbit.com/mayank/32/923_2.png) [@mayank](https://community.zymbit.com/u/mayank)\ **Post date:** [December 6, 2020, 2:27pm UTC](https://community.zymbit.com/t/encrypting-your-root-file-system-on-raspberry-pi-using-luks-dm-crypt/150/204 "2020-12-06T14:27:45Z")
@Bob_of_Zymbit, I checked the logs…phase 1 complete successfully but in phase 2 I got logs mentioned below - Dec 06 14:21:12 ubuntu cfg\_SD\_crfs.sh[1205]: Creating LUKS key…done. Dec 06 14:22:09 ubuntu cfg\_SD\_crfs.sh[1205]: Formatting crypto file system on /dev/mmcblk0p2…done. Dec 06 14:22:09 ubuntu cfg\_SD\_crfs.sh[1205]: Creating ext4 partition on /dev/mmcblk0p2… Dec 06 14:22:09 ubuntu cfg\_SD\_crfs.sh[2577]: mke2fs 1.45.5 (07-Jan-2020) Dec 06 14:22:24 ubuntu cfg\_SD\_crfs.sh[1205]: done. Dec 06 14:22:24 ubuntu cfg\_SD\_crfs.sh[1205]: Copying files to crypto fs… Dec 06 14:22:24 ubuntu cfg\_SD\_crfs.sh[2620]: mkdir: cannot create directory ‘/mnt/cryptrfs’: Read-only file system Dec 06 14:22:24 ubuntu cfg\_SD\_crfs.sh[2621]: mount: /mnt/cryptrfs: mount point does not exist. Dec 06 14:22:24 ubuntu systemd[1]: cfg\_SD\_crfs.service: Main process exited, code=exited, status=32/n/a Dec 06 14:22:24 ubuntu systemd[1]: cfg\_SD\_crfs.service: Failed with result ‘exit-code’. Thanks! ---
**Author:** ![Bob\_of\_Zymbit](https://avatars.discourse-cdn.com/v4/letter/b/82dd89/32.png) [@Bob\_of\_Zymbit](https://community.zymbit.com/u/Bob_of_Zymbit)\ **Post date:** [December 6, 2020, 9:11pm UTC](https://community.zymbit.com/t/encrypting-your-root-file-system-on-raspberry-pi-using-luks-dm-crypt/150/205 "2020-12-06T21:11:31Z")
Dec 06 14:22:24 ubuntu cfg\_SD\_crfs.sh[2620]: mkdir: cannot create directory ‘/mnt/cryptrfs’: Read-only file system That “mkdir /mnt/cryptrfs” is trying to create the directory on the USB stick and can’t because the / file system on the USB stick is mounted read-only. For this phase, the system boots up on the USB stick. A guess would be that Ubuntu found errors on your USB stick and booted up read-only. Do you happen to have a different USB drive you can try? Also, as one of the people noticed earlier in this thread, if you are using a USB 2.0 device, try that device in a USB 2.0 port (black ones) instead of a USB 3.0 port (blue ones). Bob ---
**Author:** ![peterg](https://avatars.discourse-cdn.com/v4/letter/p/977dab/32.png) [@peterg](https://community.zymbit.com/u/peterg)\ **Post date:** [December 14, 2020, 8:25pm UTC](https://community.zymbit.com/t/encrypting-your-root-file-system-on-raspberry-pi-using-luks-dm-crypt/150/206 "2020-12-14T20:25:36Z")
I’ve setup my device in Developer mode (for now) using _Option 2 - Migrate existing SD card to external LUKS storage device_ - all seems to work well. However, is it possible to copy/backup LUKS headers so that in the event of a problem I can hopefully rescue the situation? ---
**Author:** ![Bob\_of\_Zymbit](https://avatars.discourse-cdn.com/v4/letter/b/82dd89/32.png) [@Bob\_of\_Zymbit](https://community.zymbit.com/u/Bob_of_Zymbit)\ **Post date:** [December 16, 2020, 4:04pm UTC](https://community.zymbit.com/t/encrypting-your-root-file-system-on-raspberry-pi-using-luks-dm-crypt/150/207 "2020-12-16T16:04:09Z")
@peterg The LUKS key is protected by the Zymkey in Zymkey hardware only and is not recoverable by design should something go wrong. Copying the header would be of limited use. It is possible to add an additional key to LUKS encryption at the time of encryption but that would be outside of normal Zymkey operation. Bob ---
**Author:** ![peterg](https://avatars.discourse-cdn.com/v4/letter/p/977dab/32.png) [@peterg](https://community.zymbit.com/u/peterg)\ **Post date:** [December 16, 2020, 4:53pm UTC](https://community.zymbit.com/t/encrypting-your-root-file-system-on-raspberry-pi-using-luks-dm-crypt/150/208 "2020-12-16T16:53:21Z")
Thanks Bob, that makes perfect sense. Very impressed with this little device! ---
**Author:** ![jorritsmit](https://avatars.discourse-cdn.com/v4/letter/j/9f8e36/32.png) [@jorritsmit](https://community.zymbit.com/u/jorritsmit)\ **Post date:** [May 17, 2021, 1:57pm UTC](https://community.zymbit.com/t/encrypting-your-root-file-system-on-raspberry-pi-using-luks-dm-crypt/150/209 "2021-05-17T13:57:31Z")
Hi, we are having some issues with slow boot time. Specifically the kernel boot time is somewhat slow. 12s compared to 2s normal, any idea why? I read that luks performance in the raspberry pi 4 can be improved by using adiantum instead of aes for encryption, but i would suspect this would not improve boot time? systemd-analyze: Startup finished in 11.849s (kernel) + 16.883s (userspace) = 28.732s ---
**Author:** ![Bob\_of\_Zymbit](https://avatars.discourse-cdn.com/v4/letter/b/82dd89/32.png) [@Bob\_of\_Zymbit](https://community.zymbit.com/u/Bob_of_Zymbit)\ **Post date:** [May 17, 2021, 2:31pm UTC](https://community.zymbit.com/t/encrypting-your-root-file-system-on-raspberry-pi-using-luks-dm-crypt/150/210 "2021-05-17T14:31:03Z")
The Zymkey time portion should be negligible but I can take a look at the startup times. Which OS are you running? Bob ---
**Author:** ![jorritsmit](https://avatars.discourse-cdn.com/v4/letter/j/9f8e36/32.png) [@jorritsmit](https://community.zymbit.com/u/jorritsmit)\ **Post date:** [May 17, 2021, 2:53pm UTC](https://community.zymbit.com/t/encrypting-your-root-file-system-on-raspberry-pi-using-luks-dm-crypt/150/211 "2021-05-17T14:53:41Z")
Raspberry Pi OS Lite 32 bit. I am flexibel on that by the way. i am currently incrementally adding functionality to see when the kernel time increases. ---
**Author:** ![Bob\_of\_Zymbit](https://avatars.discourse-cdn.com/v4/letter/b/82dd89/32.png) [@Bob\_of\_Zymbit](https://community.zymbit.com/u/Bob_of_Zymbit)\ **Post date:** [May 17, 2021, 4:37pm UTC](https://community.zymbit.com/t/encrypting-your-root-file-system-on-raspberry-pi-using-luks-dm-crypt/150/212 "2021-05-17T16:37:20Z")
Try systemd-analyze blame. ---
**Author:** ![jorritsmit](https://avatars.discourse-cdn.com/v4/letter/j/9f8e36/32.png) [@jorritsmit](https://community.zymbit.com/u/jorritsmit)\ **Post date:** [May 17, 2021, 4:48pm UTC](https://community.zymbit.com/t/encrypting-your-root-file-system-on-raspberry-pi-using-luks-dm-crypt/150/213 "2021-05-17T16:48:27Z")
Systemd-analyze starts when systems is initialised so after kernel right? ---
**Author:** ![haydon](https://avatars.discourse-cdn.com/v4/letter/h/f05b48/32.png) [@haydon](https://community.zymbit.com/u/haydon)\ **Post date:** [July 6, 2021, 11:07am UTC](https://community.zymbit.com/t/encrypting-your-root-file-system-on-raspberry-pi-using-luks-dm-crypt/150/214 "2021-07-06T11:07:26Z")
I’m trying to set this up on a RPI CM4 with eMMC so need to follow the additional steps: 1. Upgrade the bootloader version: Jan. 16 2021 2. Set the boot order to allow booting off USB: 0xf15 3. Modify /boot/config.txt and add the line “otg\_mode=1” under [all]. This replaces the line, “dtoverlay=dwc2,dr\_mode=host” if adde Only I’m struggling to achieve steps 1 & 2. Does anyone have any guides on how to do this? I tried doing step 1 via ‘raspi-config’ but then ran into issues doing step 2 the same way but then recieved an error ‘No EEPROM bin file for version 2021-01-10 - aborting’ Any pointers would be great! ---
**Author:** ![Bob\_of\_Zymbit](https://avatars.discourse-cdn.com/v4/letter/b/82dd89/32.png) [@Bob\_of\_Zymbit](https://community.zymbit.com/u/Bob_of_Zymbit)\ **Post date:** [July 6, 2021, 7:24pm UTC](https://community.zymbit.com/t/encrypting-your-root-file-system-on-raspberry-pi-using-luks-dm-crypt/150/215 "2021-07-06T19:24:19Z")
Hi Haydon, You use rpiboot to update your CM4. An overview of the steps can be found on the raspberry pi site: > **[Teach, Learn, and Make with Raspberry Pi](https://www.raspberrypi.org/documentation/hardware/computemodule/cm-emmc-flashing.md)** > > The Raspberry Pi is a tiny and affordable computer that you can use to learn programming through fun, practical projects. Join the global Raspberry Pi community. If you need additional help, post back and I’ll see if I can get you going. ---
**Author:** ![kevinresol](https://yyz1.discourse-cdn.com/flex027/user_avatar/community.zymbit.com/kevinresol/32/1031_2.png) [@kevinresol](https://community.zymbit.com/u/kevinresol)\ **Post date:** [July 27, 2021, 3:53am UTC](https://community.zymbit.com/t/encrypting-your-root-file-system-on-raspberry-pi-using-luks-dm-crypt/150/216 "2021-07-27T03:53:12Z")
There are a lot of useful information buried in the comments. It would be nice if they can be included in the main post. 1. How to check if system matches the default parameters: USB on /dev/sda and root FS on /dev/mmcblk0p2 etc 2. How to monitor status after phase 1 reboot (`journalctl -fu cfg_SD_crfs`) 3. How to confirm FS is a) encrypted and b) the key is protected by Zymkey ---
**Author:** ![mhe](https://avatars.discourse-cdn.com/v4/letter/m/b5e925/32.png) [@mhe](https://community.zymbit.com/u/mhe)\ **Post date:** [August 23, 2021, 7:25pm UTC](https://community.zymbit.com/t/encrypting-your-root-file-system-on-raspberry-pi-using-luks-dm-crypt/150/217 "2021-08-23T19:25:00Z")
I’ve set up a raspberry pi with zymkey 4i and encrypted the root fs like explained here. I now want to clone this setup. I think it would have been better to first set everything up, make backups, then add the encryption and to not keep developing on the encrypted system, right? Can I just make a decrypted backup, like undoing the encryption and backing everything up to another sd card? As the zymkey and the sd card are bound together, I cannot just dd the sd card itself to another one. Can I just dd if=/dev/mapper/cryptrfs of=/dev/sda to some usb stick? I think I cannot decrypt the sd card again using official methods, as I would have to boot from an USB stick or another device and decrypt the sd card using a key, but the key is stored on the zymkey, I don’t have it. Adding a key is also not possible as I don’t have an existing key… What is the best way to do it? ---
**Author:** ![Bob\_of\_Zymbit](https://avatars.discourse-cdn.com/v4/letter/b/82dd89/32.png) [@Bob\_of\_Zymbit](https://community.zymbit.com/u/Bob_of_Zymbit)\ **Post date:** [August 23, 2021, 8:16pm UTC](https://community.zymbit.com/t/encrypting-your-root-file-system-on-raspberry-pi-using-luks-dm-crypt/150/218 "2021-08-23T20:16:55Z")
You are correct in that the Zymkey and SD card are bound together, along with the PI. You cannot dd to another SD-card. The encrypted rootfs will not be unlocked on the new SD card. When you have your original SD card up and the rootfs is unlocked, you could always just transfer all the files to some other backup location. The other option is if you still have the USB stick you used as temporary storage it could be used to create another encrypted SD card. The files as they were at the time of your original encryption are left in a tar file so that if you run the process again, you don’t have to copy the whole rootfs again. ---
**Author:** ![Michelle\_of\_Zymbit](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michelle\_of\_Zymbit](https://community.zymbit.com/u/Michelle_of_Zymbit)\ **Post date:** [August 24, 2021, 5:28pm UTC](https://community.zymbit.com/t/encrypting-your-root-file-system-on-raspberry-pi-using-luks-dm-crypt/150/219 "2021-08-24T17:28:10Z")
[Previous page](https://community.zymbit.com/t/encrypting-your-root-file-system-on-raspberry-pi-using-luks-dm-crypt/150.md?page=10)