Enable Hibernate With Encrypted Swap

Raison d'Etre

• Many people have asked how to get hibernation to work with encrypted folders. The problem is that the swap partition is also encrypted, but with a random key, so on restarting there is no way to resume.

• Now sharney, who uses Linux Mint, has found a way to solve this problem (on Mint, of course). The idea is to replace the random key with a password of your choice (you could use the same password as your login, but see Disclaimers & Warnings below, point 6).

• I thought I'd see whether or not I could get this working on Ubuntu, which is a little different from both Mint (despite Mint's origins in Ubuntu) and sharney, who uses full-disk encryption. I succeeded! Hence, this how-to.
• Of course, as new information comes to light or as errors are discovered, I shall update this first post.

Disclaimers and Warnings

1. This tutorial presumes that you know how to use the Terminal. (This how-to is quite advanced, so if you don't know how to use the terminal, this how-to is not for you.)

2. This procedure was tested both on a virtual machine using Virtual Box and on a native installation. The Virtual Box had a strange problem — when resuming, the screen remained black, although the applications were still open. But the native installation worked correctly.

3. This procedure was tested on Ubuntu 12.04 (fully updated). Do not assume it will work on other versions/distributions.

4. Canonical does not support this function (yet), so use it at your own risk.

5. Please follow the instructions carefully, otherwise you may find your system unable to boot (but you can recover with the Recovery Option or a Live CD).

6. If more than one person uses your machine, every user will need to know the encryption password for the swap.

Explanation

• Your existing encrypted swap partition uses a random key, generated each time you boot.
• You will be replacing that random key method with a fixed key using a password of your choice.
• It is possible to replace the password with a file, meaning that you wouldn't have to remember an extra password — but that file would be visible to anyone with physical access to your computer (e.g. via a Live USB).
• If you forget your password, you will still be able to boot (after trying three times), but you won't have a swap partition. However, you can repeat this How-To to set it up again, so it's not a big deal.

Preparation

1. Your computer must already be set up for encryption. If not, follow instructions here first.

2. Think of a password (or passphrase) for your swap partition. You can use the same as your log-in — but don't do that if other people have accounts on your computer! (See Disclaimers & Warnings point 6.)

3. Find out which is your encrypted swap partition.

    swapon -s

   You should see output similar to

    Filename                        Type            Size    Used    Priority
    /dev/mapper/cryptswap1          partition       1998844 0       -1

   If output is dissimilar to example given above, the partition is not encrypted.

   Next run

    sudo cryptsetup status cryptswap1

   Output should be similar to

    /dev/mapper/cryptswap1 is active and is in use.
      type:    PLAIN
      cipher:  aes-cbc-essiv:sha256
      keysize: 256 bits
      device:  /dev/sda1
      offset:  0 sectors
      size:    3997696 sectors
      mode:    read/write

   Make a note of the device. The one in the example says /dev/sda1 — but yours could say something else, e.g. /dev/sdb3.

4. Back up.

How to Set Up Hibernation

1. Turn off swap.

    sudo swapoff /dev/mapper/cryptswap1

2. Undo the existing mapping.

    sudo cryptsetup luksClose /dev/mapper/cryptswap1

3. Set up swap again, but this time with your chosen passphrase. The command will prompt you, twice, for your passphrase. Replace /dev/sdXN with the device from Preparation point 3.

    sudo cryptsetup luksFormat --cipher aes-cbc-essiv:sha256 --verify-passphrase --key-size 256 /dev/sdXN

   Output should be:

    WARNING!
    ========
    This will overwrite data on /dev/sda1 irrevocably.
    Are you sure? (Type uppercase yes):
    Enter LUKS passphrase:]
    Verify passphrase:

   Enter your passphrase.
   

4. Re-map the swap. Replace /dev/sdXN with the device from Preparation point 3.

     sudo cryptsetup luksOpen ''/dev/sdXN'' cryptswap1

5. Set up the partition as swap.

    sudo mkswap /dev/mapper/cryptswap1

6. Turn on the swap (so you have swap again).

    sudo swapon --all

7. Check that it is working. You should see output similar to this (the numbers may differ).

    swapon -s
    Filename                        Type            Size    Used    Priority
    /dev/mapper/cryptswap1          partition       1996796 0       -1

8. Edit (using gksudo with your favourite editor - default for Ubuntu is gedit) the file /etc/crypttab. Comment out the existing line by adding # to the front (or just delete the line), and add the following line. Replace /dev/sdXN with the device from Preparation point 3.

    cryptswap1   ''/dev/sdXN''   none   luks

9. Edit the file /usr/share/initramfs-tools/scripts/local-top/cryptroot. Search for the following line (should be line 288, but this could change over time):

    message "cryptsetup: unknown error setting up device mapping"

   Skip to the next blank line (should be 291, before FSTYPE=), and insert the following line. Replace /dev/sdXN with the device from Preparation point 3.

    /sbin/cryptsetup luksOpen ''/dev/sdXN'' cryptswap1

10. Edit the file /etc/acpi/hibernate.sh. At the first blank line, insert the following line.

     DEVICE='/dev/mapper/cryptswap1'

11. Edit the file /etc/initramfs-tools/conf.d/resume. Replace the existing RESUME line with the following line.

     RESUME=/dev/mapper/cryptswap1

12. Register these changes.

     sudo update-initramfs -u -k all

13. Ubuntu disables the Hibernate option in the menu. Restore it as follows. Create (using gksudo with your favourite editor) the file: /etc/polkit-1/localauthority/50-local.d/com.ubuntu.enable-hibernate.pkla Fill the file with the following text and save.

     [Re-enable hibernate by default]
     Identity=unix-user:*
     Action=org.freedesktop.upower.hibernate
     ResultActive=yes

New Swap First Time Use

* Use Hibernate from the shut-down menu

Or:

* Press Alt-F2 and type

   gksudo pm-hibernate

(If you do this from a terminal, you can use sudo instead of gksudo)

Once your machine has shut down, restart. Did your programs resume normally? If so, hibernate and resume work!

Originally posted The Ubuntu Forums (ubuntuforums.org)