Ttyjfyk

When you want to use hibernation and you care for security, you'd like to have the swap encrypted. But not with the random password, chosen for you at startup, but with a fixed one, supplied by you at the boot time, so the hibernated state would be available for resuming upon next boot.

There was a cool way to do this, that worked up until Mint 15: How to: get the whole system encrypted

This doesn't work anymore on Petra. Can anyone help me with working it out? The main culprit, the /usr/share/initramfs-tools/scripts/local-top script didn't change, so I guess it has something to do with the kernel. It looks like the recent kernel just ignores all the scirpt, or at least the part that asks for a password for swap.

Oh, and I was able to get the password prompt, when I accidentally booted the Mint 16 with the kernel from Mint 15.

See also a related question:

How to ask for a password to mount crypted swap at boot time on Linux Mint 16 with initramfs-tools?

Some debug info

After opening the swap device with sudo cryptsetup luksOpen /dev/sda5 cryptswap:

sudo lsblk -o name,uuid

NAME UUID
sda 
├─sda1 F251-38C0
├─sda2 c66b8e51-dd1b-4d92-8605-a3ba7df6af83
├─sda3 77af32db-038d-4c10-b302-039634cf943a
├─sda4 7a3cde35-ab80-4618-ad76-7aa064d55f56
├─sda5 fc068dd2-759c-4779-b521-c73cc5499e86
│ └─cryptswap (dm-1) 964eafeb-c88b-49c8-8b5e-6f8395e040b4
├─sda6 926fa7cc-6f97-4672-85a7-a1ed8f5bd842
├─sda7 804b9c88-907b-43d9-b23f-964c32ecc2ac
└─sda8 ce2cd926-133f-4e20-86f8-45bc4844271c
 └─adama-docs (dm-0) 61a32b98-3b65-4af6-81ff-da090cae039f
sr0 

cat /etc/crypttab

#cryptswap1 /dev/sda5 /dev/urandom swap,cipher=aes-cbc-essiv:sha256
swap UUID=fc068dd2-759c-4779-b521-c73cc5499e86 none luks

cat /etc/fstab

UUID=926fa7cc-6f97-4672-85a7-a1ed8f5bd842 / btrfs defaults,subvol=@,compress,autodefrag 0 1
# /boot was on /dev/sda2 during installation
UUID=c66b8e51-dd1b-4d92-8605-a3ba7df6af83 /boot ext3 defaults 0 2
# /boot/efi was on /dev/sda1 during installation
UUID=F251-38C0 /boot/efi vfat defaults 0 1
# /home was on /dev/sda6 during installation
UUID=926fa7cc-6f97-4672-85a7-a1ed8f5bd842 /home btrfs defaults,subvol=@home 0 2
# /mnt/ext4 was on /dev/sda7 during installation
UUID=804b9c88-907b-43d9-b23f-964c32ecc2ac /mnt/ext4 ext4 defaults 0 0
# swap was on /dev/sda5 during installation
UUID=964eafeb-c88b-49c8-8b5e-6f8395e040b4 none swap sw 0 0

/etc/initramfs-tools/conf.d/resume

RESUME=/dev/disk/by-uuid/964eafeb-c88b-49c8-8b5e-6f8395e040b4

update:

When I setup everything like above, the system does display the familiar password prompt. It doesn't do that every time, and if it does, it is a fraction of second before the login screen (Linux Mint uses mdm for login). I guess there is racing condition; the mounting of swap is done parallel with the system booting; I expect the system to wait booting until the swap is mounted, and do it as early as possible. Otherwise how could it resume the hibernated state?

There is a similar question for Ubuntu: https://askubuntu.com/questions/396136/encrypted-home-partition-encrypted-swap-working-hibernate It seems, that it worked for someone if he encrypted the root as well.

I still don't know what setup you have, and what actually is going on when you try to hibernate your machine, but I'll try to answer the question.

I have debian testing distro, but I think there shouldn't be a problem to set this up on your pc. Just look at my setup, maybe you'll figure out what's wrong in your case.

This is my test disk:

root:~# lsblk -o name,uuid
NAME UUID
sda
├─sda1 727035387035047F
├─sda2 c55b13b7-ca46-488e-a78c-ac229cb6634c
├─sda3 1c379414-bac2-45d9-85c5-25163c663341
│ └─sda3_crypt (dm-0) 44cd4817-c27f-47aa-a7d5-b64276817a74
└─sda4 7774cf98-35fd-42fd-9891-7255c916fe02
 └─sda4 (dm-1) 0905595d-db03-4cc9-93d6-7d1262c140a4

sda2 is for boot partition, sda3, there's my linux, and sda4 is the swap partition. sda3 and sda4 are encrypted, and you want to unlock the swap partition at boot. You have to edit some files to do so.

/etc/fstab file:

UUID=0905595d-db03-4cc9-93d6-7d1262c140a4 swap swap defaults 0 0

/etc/initramfs-tools/conf.d/resume file:

RESUME=/dev/disk/by-uuid/0905595d-db03-4cc9-93d6-7d1262c140a4

/etc/crypttab file:

swap UUID=7774cf98-35fd-42fd-9891-7255c916fe02 none luks

Now you have to regenerate the initramfs:

update-initramfs -u -k all

This solution works for me on my testing debian. I didn't do anything else, booting, unlocking and hibernation work without a problem.

UPDATE

I think I figured that out. I installed the system and did what I had written in the answer, but this didn't work. Maybe it's because of upstart -- I'm using sysvinit. So I installed the system again, now using the encrypted build-in feature. Then I checked all the three files, and only the /etc/fstab file was different -- it appears that you can't use UUIDs in /etc/fstab when you want to mount or interact with encrypted devices. So, I installed the system once more (unencrypted), and I created a separate partition for swap. The two files /etc/initramfs-tools/conf.d/resume and /etc/crypttab stay the same, but in the /etc/fstab file I added the following line:

/dev/mapper/swap none swap sw 0 0

And it worked -- I had splash password screen, and it stopped booting until the right password was given. I also checked whether hibernation works, and it works as expected.