[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Advice on encrypted filesystem

On Fri, Jun 26, 2020 at 08:25:49AM -0500, David Wright wrote:
If encrypting an entire disk, scramble the disk first, then partition.
If only encrypting a partition, partition the disk first.
Alignments should be at least 2M (4096 x 512B sectors).
Scramble any sensitive pre-existing contents:

# dd bs=1M if=/dev/urandom of=/dev/sdz[9]

I personally wouldn't do this. It's slow and doesn't gain much. I definitely wouldn't do it on an SSD.

# cryptsetup --align-payload 2048 luksFormat /dev/sdz9

I also would not add this align-payload option. (If you don't, cryptsetup will query the kernel for optimal parameters.)

Reply to: