LUKS is a disk partition encryption system for Linux.

Installing antiX on an encrypted LUKS partition

I installed antiX on the LUKS partition in my own way.

0) Loading antiX from LiveCD.

1) Disk partitioning in GParted

• /dev/sda1 bios_grub - 8 MB unformatted, bios_grub flag
• /dev/sda2 boot partition - 1500 MB ext4 type, boot flag
• esp partition - 500 MB for UEFI only, esp flag. We do not create for outdated PCs with a BIOS system.
• /dev/sda3 swap partition - 4 GB linux-swap type
• /dev/sda4 is the main partition for the operating system (contains the root / and the home folder /home).

2) Enable LUKS encryption for the main partition on the hard drive and connect it to the OS loaded from the LiveCD:

cryptsetup -y -v --type luks2 luksFormat /dev/sda4
cryptsetup luksOpen /dev/sda4 home

3) Install antiX on physical and logical partitions according to the diagram in the picture or tables:

Physical hard drive sda:

Virtual devices:

Where the physical encrypted partition crypto_LUKS is mounted with the luksOpen command as a virtual device "home", which will be mounted to the root "/" when the OS boots.

4) Reboot (remove the bootable LiveCD media and in BIOS Setup select the priority of devices to boot: instead of a “flash drive” - a hard drive).

5) When loading the OS after the Grub menu, the message “Please unlock disk home” will be displayed on the screen.

Enter the answer passphrase using the keyboard.

6) After entering the password, the LUKS virtual partition named "home" will be decrypted and antiX Linux will boot normally from the root partition "/".

Changing the LUKS partition passphrase

The passphrase for the encrypted LUKS partition can be changed while in the operating system loaded from the LUKS partition.

1) Find out the name of the LUKS section

lsblk

My LUKS partition name is "/dev/sda4", but it may be different. For example, "/dev/sda3".

2) Find out the LUKS slot number

sudo cryptsetup open -v -test-passphrase /dev/sda4

or

sudo cryptsetup luksDump /dev/sda4

where instead of /dev/sda4 you need to specify the name of the LUKS partition (see point 1).

In the extended message, due to the use of the -v (--verbose) switch, the slot number will be displayed.
For example: "Key slot 0 is unlocked."

This means the slot number is 0.

3) Setting a new passphrase for the encrypted LUKS partition

sudo cryptsetup luksChangeKey /dev/sda4 -S 0

where instead of "/dev/sda4" you need to specify the partition name LUKS from step 1,
and instead of "0" you need to indicate the slot number from step 2.

I entered the old LUKS password and the new one and confirmed the new password - the LUKS section received a new passphrase.

sudo apt install gnome-disk-utility
sudo gnome-disks

Select the LUKS section - the "gear" icon - click the "Change password..." menu item.

Sources:

• How To Linux Hard Disk Encryption With LUKS
• How to change LUKS disk encryption passphrase in Linux

Related publications

Linux Cinnamon Desktop Applets for Listening to Internet Radio Stations

Passing a parameter to a Linux module/driver

Installing the TP-Link Archer T600U Nano Wi-Fi adapter driver in Debian 13 "Trixie"

Installing the audio equalizer pulseaudio-equalizer-ladspa on Linux

Установка Sparky Linux (Debian) на раздел LVM