2

Okay so here is some useful background before we get started. I booted a Windows 7 install disk, split the hard drive into two partitions, installed windows. Rebooted, installed Kali, then booted into Windows and encrypted the Windows partition with PGP Desktop.

When I power on I have to enter my PGP pass phrase then it loads grub and from there I can choose between Windows and Kali. While in Kali I can tell Windows is encrypted.

During the Kali install I did not choose to encrypt, So my question is: How do I encrypt Kali without re-installing. A terminal command would be nice.

3
  • 2
    Note that this whole encryption is pointless against attacks that compromise your Windows (or Kali) side to then modify the bootloader to steal your encryption password the next time you enter it; same for evil maid attacks.
    – user256743
    Feb 1, 2015 at 14:03
  • Suggestion: try to extend, what exactly do you understand on "kali linux encryption". Do you think on an encrypted root partition?
    – peterh
    Feb 3, 2015 at 23:14
  • Well i have decided to do a gutman wipe via DBAN and find a way to put the boot loader and partition on a usb. dual boot windows 7 and kali with PGP partition encryption and luks for kali. I did some reading on these two sites and honestly it's a little overwhelming with "tressor" and a few more things. crunchbang.org/forums/viewtopic.php?id=24722 grepular.com/…
    – Krea
    Feb 3, 2015 at 23:49

1 Answer 1

6

As Kali Linux is based upon Debian, instructions for encrypting an existing Debian install should be valid. These instructions are from the Setting up encryption after debian wheezy install question. I did some basic testing, and it seems to be a working solution (last tested on Kali 2016.2).

First install ecryptfs-utils (it may already be installed)

sudo apt-get install ecryptfs-utils

then boot to recovery mode and as root run

ecryptfs-migrate-home -u your_user_to_migrate

After the script runs, log out and log in as your user

exit

You might also with to run

ecryptfs-unwrap-passphrase

enter your use password when prompted and save the information in a safe place in the event you need to perform data recovery.

Last you can delete the temp files / directories created by the migration script and reboot (technically you do not need to reboot).

1
  • 4
    Note that this is not full disk encryption, but just the home folder. Feb 1, 2015 at 8:40

You must log in to answer this question.