About Swap Encryption

Encrypting a systems swap file can be a good idea to protect sensitive information. A program which has sensitive data stored in memory is ok, but if the OS decides to swap some memory pages to disk so it can free memory for other applications there is a theoretical chance that the sensitive data could be retrieved from the disk.

How to do it

1. cryptsetup v0.1
2. kernel support for the device mapper and the encryption cipher you want to use (if encryption works for you with dmsetup/cryptsetup then you have this)

Find your swap device(s) by running (commands are shown in bold):

As you can see from the output from this command my swap device is /dev/hda2. If there are more than one device returned you would have to encrypt those devices as well.
If you have multiple swap devices, read this page and then read MultipleEncryptedSwapDevices

Run the following two commands (commands are shown in bold):

We are looking for the line containing swapon -a, and we can see it is contained in the file called localmount. This was done on a Gentoo system (Debian: most probably mountall.sh, Slackware: "/etc/rc.S")

Open the file in your favourite editor and create a new line before the line that contains the swapon -a. Insert the following commands:


In this example we used the blowfish algorithm (-c) with a 64 bit key (-s) and we used /dev/urandom as our key file (-d).

Note! If you decide to take the default algorithm (AES), you need to supply "-s 256" instead of "-s 64", because AES has a different-sized key. Failure to make the keysize match the algorithm will lead to the otherwise-inscrutable error "Command failed: device-mapper ioctl cmd 9 failed: Invalid argument" and will write (for example) "kernel: [4369391,541000] device-mapper: error adding target to table" into /var/log/messages.

Also make sure the dm_mod module is automatically loaded at boot so dmsetup is able to map the device.

Also change the swap entry in /etc/fstab to point to /dev/mapper/swap0 so a call to swapon -a won't try to mount the unencrypted swap partition. (Note: this is not very important, swapon will report an error about the device being busy).


After the next reboot run (commands are shown in bold):

This shows you the active swap devices. If the new swap0 device does not show up in your listing something did not work.
Possible problems:

• If dm_mod is compiled as a module, check that the dm_mod module gets loaded before the cryptsetup command is run. An easy way to make sure that the dm_mod module is loaded is to put modprobe dm_mod above the commands you inserted to your boot script.
• If this does not fix your problem, try to run the commands as root line by line in a console window and look for errors. (don't put in the 2>/dev/null parts which hides error messages).
• If all else fails, try the mailing lists or contact one of the authors of this article.

Note: If you still have problems, don't give up and run you system without swap!

This page was first written by Perlbroker who used this setup on a Debian Woody stable release. 15th April 2004.
Feel free to contact him if there is any problem by clicking on the below Perlbroker link.

cleanup and "de-debianisation", change to cryptsetup by Alexander Wigen.