\begin{exe} {Encrypted Swap}

   In this exercise, we will be encrypting the \textbf{swap
      partition}. Data written to the swap device can contain
   sensitive information. Because swap is backed by an actual
   partition, it is important to consider the security
   implications of having an unencrypted swap partition.

   The process for encrypting is similar to the previous
   exercise, except we will not create a file system on the
   encrypted block device.

   In this case, we are also going to use the existing
   swap device by first de-activating it and then
   formatting it for use as an encrypted swap device.  It
   would be a little bit safer to use a fresh partition
   below, or you can safely reuse the encrypted partition
   you set up in the previous exercise. At the end we
   explain what to do if you have problems restoring.

   You may want to revert back to the original unencrypted
   partition when we are done by just running
   \textbf{mkswap} on it again when it is not being used, as
   well as reverting the changes in the configuration files,
   \filelink{/etc/crypttab} and \filelink{/etc/fstab}.

   \begin{enumerate}
      \item
      Find out what partition you are currently using for
      swap and then deactivate it:
      \begin{cmd}
$ cat /proc/swaps
      \end{cmd}
      \begin{response}
Filename                                Type            Size    Used    Priority
/dev/sda11                              partition       4193776 0       -1
      \end{response}
      \begin{cmd}
$ sudo swapoff /dev/sda11
      \end{cmd}
      \item Do the same steps as in the previous exercise to set up
      encryption:
      \begin{cmd}
$ sudo cryptsetup luksFormat /dev/sda11  # may use --cipher aes option
$ sudo cryptsetup luksOpen   /dev/sda11  swapcrypt
      \end{cmd}
      \item
      Format the encrypted device to use with swap:
      \begin{cmd}
$ sudo mkswap /dev/mapper/swapcrypt
      \end{cmd}
      \item
      Now test to see if it actually works by activating it:
      \begin{cmd}
$ sudo swapon /dev/mapper/swapcrypt
$ cat /proc/swaps
      \end{cmd}
      \item To ensure the encrypted swap partition can be
      activated at boot you need to do two things:
      \begin{enumerate}
         \item
         Add a line to \filelink{/etc/crypttab} so that the
         system prompts for the passphrase on reboot:
         \begin{configlst}[in \texttt{/etc/crypttab}]
swapcrypt  /dev/sda11   /dev/urandom  swap,cipher=aes-cbc-essiv:sha256,size=256
         \end{configlst}

         (Note \filelink{/dev/urandom} is preferred over
         \filelink{/dev/random} for reasons involving potential
         \textbf{entropy shortages} as discussed in the
         \textbf{man} page for \verb?crypttab?.)  You don't
         need the detailed options that follow, but we give
         them as an example of what more you can do.
         \item
         Add an entry to \filelink{/etc/fstab} so that
         the swap device is activated on boot.
         \begin{configlst}[in \texttt{/etc/fstab}]
/dev/mapper/swapcrypt  none    swap    defaults    0 0
         \end{configlst}
      \end{enumerate}
      \item You can validate the entire configuration by rebooting.
   \end{enumerate}
   To restore your original unencrypted partition:
   \begin{cmd}
$ sudo swapoff /dev/mapper/swapcrypt
$ sudo cryptsetup luksClose swapcrypt
$ sudo mkswap /dev/sda11
$ sudo swapon -a
   \end{cmd}

   If the \textbf{swapon} command fails it is likely
   because \filelink{/etc/fstab} no longer properly
   describes the swap partition.  If this partition is
   described in there by actual device node
   (\filelink{/dev/sda11}) there won't be a problem.  You can
   fix either by changing the line in there to be:
   \begin{configlst}[in \texttt{/etc/fstab}]
      /dev/sda11  swap   swap  defaults 0 0
   \end{configlst}
   or by giving a label when formatting and using it as in:
   \begin{cmd}
$ sudo mkswap -L SWAP /dev/sda11
   \end{cmd}
   and then putting in the file:
   \begin{configlst}[in \texttt{/etc/fstab}]
      LABEL=SWAP  swap   swap  defaults 0 0
   \end{configlst}
\end{exe}

