How to resize LUKS partition (shrink or extend encrypted luks partition) in

In this article I will share the steps to resize LUKS partition. You can reduce or extend encrypted LUKS partition depending upon the backend file system and device type. I am using RHEL/CentOS 7/8 for verifying steps from this article. In my last article I shared the steps to auto mount LUKS encrypted partition during reboot stage using keys instead of passphrase in Linux.

Below are some more articles on LUKS based Disk Encryption

• How to Encrypt Hard Disk (partition) using LUKS in Linux
• How to auto mount LUKS encrypted partition using fstab at boot in Linux
• How to encrypt root partition and entire file system using LUKS in Linux
• How to resize LUKS partition (shrink or extend encrypted luks volume) in Linux
• Configure LUKS Network Bound Disk Encryption with clevis & tang server to boot without password

Can I resize a dm-crypt or LUKS partition?

Disclaimer:Official Page of cryptsetup

Yes, you can, as neither dm-crypt nor LUKS stores partition size. Whether you should is a different question. Personally I recommend backup, recreation of the encrypted partition with new size, recreation of the filesystem and restore. This gets around the tricky business of resizing the filesystem. Resizing a dm-crypt or LUKS container does not resize the filesystem in it. The backup is really non-optional here, as a lot can go wrong, resulting in partial or complete data loss. Using something like gparted to resize an encrypted partition is slow, but typically works. This will not change the size of the filesystem hidden under the encryption though.

You also need to be aware of size-based limitations. The one currently relevant is that aes-xts-plain should not be used for encrypted container sizes larger than 2TiB. Use aes-xts-plain64 for that.

As you see performing resize LUKS partition, extend or shrink encrypted LUKS partition are not recommend.

Now earlier I had shared steps to encrypt partition device /dev/sdb1 using LUKS but here I would like to use LVM as backend storage device to perform resize LUKS partition with ext4 as file system. As With LVM it is easier to reduce/shrink and extend encrypted LUKS partitions (logical volumes).

My Lab Environment

I am using VM running on Oracle VirtualBox installed on my Linux Server with CentOS 8 to execute these steps to resize LUKS partition and perform extend or shrink encrypted LUKS partition.

So it is safe to say the same steps would work on RHEL 8. Earlier I had executed the same set of steps on RHEL/CentOS 7. If you face any problems while executing these steps then please report the same using the comment section below this article.

Create LUKS Encrypted LVM with cryptsetup

So I will quickly create LVM based LUKS encrypted partition.

[root@centos-8 ~]# pvcreate /dev/sdb1
  Physical volume "/dev/sdb1" successfully created.

After adding new physical volume, verify the available list of physical volumes using pvs:

[root@centos-8 ~]# pvs
  PV         VG   Fmt  Attr PSize   PFree
  /dev/sda2  rhel lvm2 a--  <14.50g     0
  /dev/sdb1       lvm2 ---   <8.00g <8.00g

Get the list of available volume groups using vgs

[root@centos-8 ~]# vgs
  VG   #PV #LV #SN Attr   VSize   VFree
  rhel   1   2   0 wz--n- <14.50g    0

I will extend my existing VG rhel instead of creating a new one:

[root@centos-8 ~]# vgextend rhel /dev/sdb1
  Volume group "rhel" successfully extended

Verify the new size of your volume group:

[root@centos-8 ~]# vgs
  VG   #PV #LV #SN Attr   VSize   VFree
  rhel   2   2   0 wz--n- <14.50g    0

Check the list of available logical volumes:

[root@centos-8 ~]# lvs
  LV   VG   Attr       LSize   Pool Origin Data%  Meta%  Move Log Cpy%Sync Convert
  root rhel -wi-ao----  13.56g
  swap rhel -wi-ao---- 956.00m

I will create a new logical volume “secret” which will act as device for LUKS encrypted partition

[root@centos-8 ~]# lvcreate -n secret -L 2G  rhel
  Logical volume "secret" created.

Check the new list of logical volumesr

[root@centos-8 ~]# lvs
  LV     VG   Attr       LSize   Pool Origin Data%  Meta%  Move Log Cpy%Sync Convert
  root   rhel -wi-ao----  13.56g
  secret rhel -wi-a-----   2.00g
  swap   rhel -wi-ao---- 956.00m

Initialize LUKS partition

Now create the LUKS formatted encrypted volume /dev/mapper/secret that is password protected.

[root@centos-8 ~]# cryptsetup luksFormat /dev/rhel/secret

WARNING!
========
This will overwrite data on /dev/rhel/secret irrevocably.

Are you sure? (Type uppercase yes): YES
Enter passphrase for /dev/rhel/secret:
Verify passphrase:

We will use luksOpen to open the encrypted partition and map it to /dev/mapper/secret. Here /dev/mapper/secret will be created.

[root@centos-8 ~]# cryptsetup luksOpen /dev/rhel/secret secret
Enter passphrase for /dev/rhel/secret:

I will use ext4 file system for my LUKS partition, you can choose a file system type as per your requirement to resize LUKS partition

[root@centos-8 ~]# mkfs.ext4 /dev/mapper/secret
mke2fs 1.44.3 (10-July-2018)
Creating filesystem with 522240 4k blocks and 130560 inodes
Filesystem UUID: d6b707da-04c5-4c19-9c9d-5e1df2332488
Superblock backups stored on blocks:
        32768, 98304, 163840, 229376, 294912

Allocating group tables: done
Writing inode tables: done
Creating journal (8192 blocks): done
Writing superblocks and filesystem accounting information: done

Now to access the LUKS partition, mount it on a mount point. I had already created a mount point /secret in my previous articles so I will use the same path:

[root@centos-8 ~]# mount /dev/mapper/secret /secret/

Verify if the LUKS partition is properly mounted

[root@centos-8 ~]# mount | grep secret
/dev/mapper/secret on /secret type ext4 (rw,relatime)

Resize LUKS Partition

Now this was all our pre-requisite to set up lab environment. From here on we will start with the steps to resize LUKS partition.

First let us extend encrypted LUKS partition. Currently my LUKS partition is of 2GB which we will resize and extend to 3GB. We have around 8GB space available in our rhel VG so we can easily resize and extend encrypted LUKS partition with additional 1GB.

Grow or Extend Encrypted LUKS partition volume

Since our LUKS encrypted volume is mapped to /dev/mapper/secret volume, we will use the same volume to extend encrypted LUKS partition with additional 1GB space. Use df to inspect the file system that needs to be extended, e.g.:

[root@centos-8 ~]# df -h /secret/
Filesystem          Size  Used Avail Use% Mounted on
/dev/mapper/secret  2.0G   47M  2.0G   3% /secret

The current size of /dev/mapper/secret LUKS volume is 2GB. Figure out what the backing device is by querying the MAPPING

[root@centos-8 ~]# cryptsetup status secret
/dev/mapper/secret is active and is in use.
  type:    LUKS2
  cipher:  aes-xts-plain64
  keysize: 256 bits
  key location: keyring
  device:  /dev/mapper/rhel-secret
  sector size:  512
  offset:  16384 sectors
  size:    4177920 sectors
  mode:    read/write

The backing device will always be listed on the “device: /dev/XXXX” line. In the above example the backing device is “/dev/mapper/rhel-secret”

Un-mount the file system before we extend encrypted LUKS partition

[root@centos-8 ~]# umount /secret

Close out the dm-crypt volume with cryptsetup luksClose MAPPING

[root@centos-8 ~]# cryptsetup luksClose secret

Next extend encrypted LUKS partition using lvextend command. Here we wish to add 1GB to our existing LUKS volume

[root@centos-8 ~]# lvextend -L +1G /dev/rhel/secret
  Size of logical volume rhel/secret changed from 2.00 GiB (512 extents) to 3.00 GiB (768 extents).
  Logical volume rhel/secret successfully resized.

Verify the new size of the secret logical volume

[root@centos-8 ~]# lvs
  LV     VG   Attr       LSize   Pool Origin Data%  Meta%  Move Log Cpy%Sync Convert
  root   rhel -wi-ao----  13.56g
  secret rhel -wi-a-----   3.00g
  swap   rhel -wi-ao---- 956.00m

Next open the LUKS encrypted partition /dev/mapper/secret to perform resize

[root@centos-8 ~]# cryptsetup luksOpen /dev/rhel/secret secret
Enter passphrase for /dev/rhel/secret:

Check the new size of the LUKS encrypted volume

[root@centos-8 ~]# cryptsetup status secret
/dev/mapper/secret is active.
  type:    LUKS2
  cipher:  aes-xts-plain64
  keysize: 256 bits
  key location: keyring
  device:  /dev/mapper/rhel-secret
  sector size:  512
  offset:  16384 sectors
  size:    6275072 sectors
  mode:    read/write

Compare the size with the command output from your last execution which we did earlier in this article. Earlier the size of secret volume was 4177920 while the new size is 6275072 sectors. Here resize LUKS partition is not yet complete.

Perform a file system check before performing the final steps to extend encrypted LUKS partition

[root@centos-8 ~]# e2fsck -f /dev/mapper/secret
e2fsck 1.44.3 (10-July-2018)
Pass 1: Checking inodes, blocks, and sizes
Pass 2: Checking directory structure
Pass 3: Checking directory connectivity
Pass 4: Checking reference counts
Pass 5: Checking group summary information
/dev/mapper/secret: 11/65280 files (0.0% non-contiguous), 13574/260096 blocks

Since the file system check has passed, execute resize2fs to resize LUKS partition

[root@centos-8 ~]# resize2fs -p /dev/mapper/secret
resize2fs 1.44.3 (10-July-2018)
Resizing the filesystem on /dev/mapper/secret to 784384 (4k) blocks.
The filesystem on /dev/mapper/secret is now 784384 (4k) blocks long.

Next mount the LUKS encrypted partition to it’s mount point

[root@centos-8 ~]# mount /dev/mapper/secret /secret/

Verify the new partition size

[root@centos-8 ~]# df -h /secret/
Filesystem          Size  Used Avail Use% Mounted on
/dev/mapper/secret  3.0G   54M  3.0G   2% /secret

Reduce or Shrink encrypted LUKS partition volume

To shrink encrypted LUKS partition you can use lvreduce command. Make sure the disk is unmounted, so this must be done when there is no need for activity on the disk.

[root@centos-8 ~]# umount /secret

Before you resize LUKS partition, it is important to run a file system check to verify data integrity:

[root@centos-8 ~]# e2fsck -f /dev/mapper/secret
e2fsck 1.44.3 (10-July-2018)
Pass 1: Checking inodes, blocks, and sizes
Pass 2: Checking directory structure
Pass 3: Checking directory connectivity
Pass 4: Checking reference counts
Pass 5: Checking group summary information
/dev/mapper/secret: 11/195840 files (0.0% non-contiguous), 22022/784384 blocks

I hope the LUKS partition is still in Open state to shrink LUKS encrypted partition, if not map the LUKS partition on a device mapper using luksOpen

[root@centos-8 ~]# cryptsetup luksOpen /dev/rhel/secret secret
Enter passphrase for /dev/rhel/secret:

Here we will shrink LUKS encrypted partition /dev/mapper/secret logical volume:

[root@centos-8 ~]# blkid /dev/mapper/secret
/dev/mapper/secret: UUID="d6b707da-04c5-4c19-9c9d-5e1df2332488" TYPE="ext4"

Execute lvreduce with the size of the LUKS volume which you wish to have after shrinking. Here my LUKS volume was 3GB, and I wish to remove 1GB from this volume so the final size should be 2GB for my LUKS encrypted volume.

[root@centos-8 ~]# lvreduce -r -L 2G /dev/rhel/secret
fsck from util-linux 2.32.1
/dev/mapper/secret: clean, 11/195840 files, 22022/784384 blocks
resize2fs 1.44.3 (10-July-2018)
Resizing the filesystem on /dev/mapper/secret to 522240 (4k) blocks.
The filesystem on /dev/mapper/secret is now 522240 (4k) blocks long.

Enter passphrase for /dev/mapper/rhel-secret:
  Size of logical volume rhel/secret changed from 3.00 GiB (768 extents) to 2.00 GiB (512 extents).
  Logical volume rhel/secret successfully resized.

Next mount the LUKS volume to it’s mount point

[root@centos-8 ~]# mount /dev/mapper/secret /secret/

Verify the new size of secret volume to make sure you were able to shrink LUKS encrypted partition size

[root@centos-8 ~]# df -h /secret/
Filesystem          Size  Used Avail Use% Mounted on
/dev/mapper/secret  2.0G  6.0M  1.9G   1% /secret

Lastly I hope the steps from the article to resize LUKS volume, extend or shrink LUKS encrypted partition in CentOS/RHEL 7/8 Linux was helpful. So, let me know your suggestions and feedback using the comment section.

References:
How to shrink an LVM Logical Volume
How to reduce LVM size in Linux step by step (online without reboot)