Applies to SUSE Linux Enterprise Server 15 SP6

12 Encrypting partitions and files #

Encrypting files, partitions, and entire disks prevents unauthorized access to your data and protects your confidential files and documents.

You can choose between the following encryption options:

Encrypting a hard disk partition: It is possible to create an encrypted partition with YaST during installation or in an already installed system. For further info, see Section 12.1.1, “Creating an encrypted partition during installation” and Section 12.1.2, “Creating an encrypted partition on a running system”. This option can also be used for removable media, such as external hard disks, as described in Section 12.1.3, “Encrypting the content of removable media”.
Encrypting single files with GPG: To quickly encrypt one or more files, you can use the GPG tool. See Section 12.2, “Encrypting files with GPG” for more information.
Encrypting single files with Rage: You can use the Rage encryption tool to encrypt one or more files. See Section 12.3, “Encrypting files with Rage” for more information.

Warning: Encryption offers limited protection

Encryption methods described in this chapter cannot protect your running system from being compromised. After the encrypted volume is successfully mounted, everybody with appropriate permissions can access it. However, encrypted media are useful in case of loss or theft of your computer, or to prevent unauthorized individuals from reading your confidential data.

12.1 Setting up an encrypted file system with YaST #

Use YaST to encrypt partitions or parts of your file system during installation or in an already installed system. However, encrypting a partition in an already-installed system is more difficult, because you need to resize and change existing partitions. In such cases, it may be more convenient to create an encrypted file of a defined size, in which to store other files or parts of your file system. To encrypt an entire partition, dedicate a partition for encryption in the partition layout. The standard partitioning proposal, as suggested by YaST, does not include an encrypted partition by default. Add an encrypted partition manually in the partitioning dialog.

12.1.1 Creating an encrypted partition during installation #

Warning: Password input

Make sure to memorize the password for your encrypted partitions well. Without that password, you cannot access or restore the encrypted data.

The YaST expert dialog for partitioning offers the options needed for creating an encrypted partition. To create a new encrypted partition proceed as follows:

Run the YaST Expert Partitioner with System › Partitioner.
Select a hard disk, click Add, and select a primary or an extended partition.
Select the partition size or the region to use on the disk.
Select the file system, and mount point of this partition.
Activate the Encrypt device check box.
Note: Additional software required
After checking Encrypt device, a pop-up window asking for installing additional software may appear. Confirm to install all the required packages to ensure that the encrypted partition works well.
If the encrypted file system needs to be mounted when necessary, enable Do not mount partition in the Fstab Options. Otherwise enable Mount partition and enter the mount point.
Click Next and enter a password which is used to encrypt this partition. This password is not displayed. To prevent typing errors, you need to enter the password twice.
Complete the process by clicking Finish. The newly encrypted partition is now created.

During the boot process, the operating system asks for the password before mounting any encrypted partition which is set to be auto-mounted in /etc/fstab. Such a partition is then available to all users when it has been mounted.

To skip mounting the encrypted partition during start-up, press Enter when prompted for the password. Then decline the offer to enter the password again. In this case, the encrypted file system is not mounted and the operating system continues booting, blocking access to your data.

To mount an encrypted partition which is not mounted during the boot process, open a file manager and click the partition entry in the pane listing common places on your file system. You are prompted for a password and the partition is mounted.

When you are installing your system on a machine where partitions already exist, you can also decide to encrypt an existing partition during installation. In this case follow the description in Section 12.1.2, “Creating an encrypted partition on a running system” and be aware that this action destroys all data on the existing partition.

12.1.2 Creating an encrypted partition on a running system #

Warning: Activating encryption on a running system

It is also possible to create encrypted partitions on a running system. However, encrypting an existing partition destroys all data on it, and requires re-sizing and restructuring of existing partitions.

On a running system, select System › Partitioner in the YaST control center. Click Yes to proceed. In the Expert Partitioner, select the partition to encrypt and click Edit. The rest of the procedure is the same as described in Section 12.1.1, “Creating an encrypted partition during installation”.

12.1.3 Encrypting the content of removable media #

YaST treats removable media (like external hard disks or flash disks) the same as any other storage device. Virtual disks or partitions on external media can be encrypted as described above. However, you should disable mounting at boot time, because removable media is connected when the system is up and running.

If you encrypted your removable device with YaST, the GNOME desktop automatically recognizes the encrypted partition and prompts for the password when the device is detected. If you plug in a FAT-formatted removable device when running GNOME, the desktop user entering the password automatically becomes the owner of the device. For devices with a file system other than FAT, change the ownership explicitly for users other than root to give them read-write access to the device.

12.2 Encrypting files with GPG #

GNU Privacy Guard (GPG) encryption software can be used to encrypt individual files and documents.

To encrypt a file with GPG, you need to generate a key pair first. To do this, run the gpg --gen-key and follow the on-screen instructions. When generating the key pair, GPG creates a user ID (UID) to identify the key based on your real name, comments and email address. You need this UID (or just a part of it like your first name or email address) to specify the key you want to use to encrypt a file. To find the UID of an existing key, use the gpg --list-keys command. To encrypt a file use the following command:

> gpg -e -a --cipher-algo AES256 -r UID FILE

Replace UID with part of the UID (for example, your first name) and FILE with the file you want to encrypt. For example:

> gpg -e -a --cipher-algo AES256 -r Tux secret.txt

This command creates an encrypted version of the specified file recognizable by the .asc file extension (in this example, it is secret.txt.asc).

-a formats the file as ASCII text, if you want the contents to be copy-able. Omit -a to create a binary file, which in the above example would be secret.txt.gpg.

To decrypt an encrypted file, use the following command:

> gpg -d -o DECRYPTED_FILE ENCRYPTED_FILE

Replace DECRYPTED_FILE with the desired name for the decrypted file and ENCRYPTED_FILE with the encrypted file you want to decrypt.

Keep in mind that the encrypted file can be decrypted using the same key that was used for encryption. To share an encrypted file with another person, you have to use that person's public key to encrypt the file.

12.3 Encrypting files with Rage #

Rage is a secure file encryption software to encrypt files. It has keys that are easy to exchange with other people, and has secure defaults to prevent accidental misuse or leaks of sensitive data. We recommend Rage to encrypt files.

You can install Rage with:

> sudo zypper install rage-encryption

The recipient must first generate a key pair to encrypt a file with Rage:

> rage-keygen -o ~/rage.key 2 ~/rage.pub

Two files are created; rage.pub and rage.key.

rage.pub example

> cat file.pub
    Public key: age17e4g67cs07jk3lmylyq6gduv26uf7tz7nm9jrsaxn8xxx9uc9amsdg4a5e

rage.key example

>  cat file.key
    # created: 2023-05-30T16:29:20+05:30
    # public key: age17e4g67cs07jk3lmylyq6gduv26uf7tz7nm9jrsaxn8xxx9uc9amsdg4a5e

Important

file.key is a private key and should be kept confidential.

Encrypt

To encrypt a file, you need the generated public key:

> rage -e -r PUBLIC_KEY -o ENCRYPTED_FILE FILE

For example:

> rage -e -r age17e4g67cs07jk3lmylyq6gduv26uf7tz7nm9jrsaxn8xxx9uc9amsdg4a5e -o test.txt.age test.txt

Decrypt

The encrypted file can be decrypted by the recipient who has the corresponding private key. To share an encrypted file with another person, you have to use that person's public key to encrypt the file.

> rage -d -i ~/rage.key -o DECRYPTED_FILE ENCRYPTED_FILE FILE

For example:

> rage -d -i ~/rage.key -o test.txt.decrypted test.txt.age

Passphrases

You can encrypt files with passphrases with the -p or --passphrase arguments. By default, Rage automatically generates a secure passphrase, but you also have the option to enter a passphrase.

> rage -e -p -o ENCRYPTED_FILE FILE

For example:

> rage -e -p -o test.txt.age test.txt

SSH

You can encrypt files with SSH (Secure Socket Shell) keys instead of Rage keys. Rage supports ssh-rsa and ssh-ed25519 public keys,and decrypting with the respective private key file. ssh-agent and ssh-sk(FIDO) are not supported.

> rage -e -p -o ENCRYPTED_FILE FILE

For example:

> rage -e -p -o test.txt.age test.txt

For example:

>  ssh-keygen -t ed25519

To encrypt:

>  rage -e -a -R PUBLIC_KEY_FILE -o ENCRYPTED_FILE FILE

For example:

>  rage -e -a -R id_ed25519.pub -o test.txt.age test.txt

To decrypt:

>  rage -d -i SSH_PRIVATE_KEY_FILE -o DECRYPTED_FILEENCRYPTED_FILE

For example:

>  rage -d -i id_ed25519 -o test.txt.decrypted test.txt.age

Important

You must enter the path to the key and files.

Multiple identities

Rage can encrypt to multiple identities at the same time. Any of the recipient's private keys can be used to decrypt the file.

rage -e -a -R FIRST_SSH_PUBLIC_KEY-r FIRST_RAGE_PUBLIC_KEY... -o ENCRYPTED_FILE FILE

For example:

rage -e -a -R id_ed25519.pub -r age1h8equ4vs5pyp8ykw0z8m9n8m3psy6swme52ztth0v66frgu65ussm8gq0t -o -r age1y2lc7x59jcqvrpf3ppmnj3f93ytaegfkdnl5vrdyv83l8ekcae4sexgwkg test.txt.age test.txt

Tip

You can use the -h or --help argument to list all the Rage command arguments.

12.3.1 Additional Resources #

https://github.com/str4d/rage Rage Encryption GitHub repository
https://github.com/C2SP/C2SP/blob/main/age.md Age Encryption GitHub repository