How to encrypt an old, unencrypted pupsave file

[Boromir]

Hi. I apologize if this is a silly question, but I'm relatively new to puppy linux (and linux in general) and I cannot seem to find an answer to this question on the forums for the life of me.

I am running the latest version of fossapup and I had initially done a frugal install onto a usb stick. During the initial frugal install, I opted to create an unencrypted pupsave file. I would now like to encrypt the pupsave file, but I am unsure of how to do that in such a way that, on startup fossapup will look for that encrypted pupsave file. Everything I have read on encrypting the pupsave file has to do with selecting encrypt when creating a new pupsave file, but I am specifically wanting to encrypt this previously unencrypted pupsave file (mostly because it's taken me some work to get settings "right" and it would take me awhile to recreate what I have done).

Any help here would be deeply appreciated.

[rockedge]

@Boromir to the Kennels!

I have not done exactly the same thing as of yet, but it is an interesting question and a good idea to figure out a way to do this and post the steps how it was done!

I think soon some members will come by that have encrypted save files and give us some ideas. It should be relativity easy to encrypt an existing save file.

Try this in the mean time -> https://psearch.puppylinux.com
and search for something like LUKS and other relevant keywords. Remember there is the -> https://oldforum.puppylinux.com forums that are packed with information. Trick is finding it and psearch might help the cause. It is a specialized Google search engine that scans only the 2 forums.

[mikeslr]

Maybe someone knows how, or for certain, but I don't think it can be done. I think it has to do with how an encrypted Save formats the space on the partition. There are a couple of workarounds. One I think will work; the other I know will work.

The easiest --that I only think will work is this:
a) Change your boot-parameter so that you can boot-up without using your SaveFile/Folder: at the end of the line beginning with kernel or linuz, change pfix=fsck to pfix=ram. Reboot. This will give you the opportunity to create a new, encrypted, SaveFile.
b) Right-Click your current SaveFile, Select Properties and note its size. You'll want the encrypted SaveFile to be reasonably larger than that; some because encryption may use some space; some giving you room for more things to store.
c) Shutdown, creating an encrypted SaveFile with a name you can distinguish from your current SaveFile. IIRC, on shut-down you'll be offered the choice of 3 levels of encryption. Only the strongest provides any real deterrent.
d) Re-boot, choosing to use the encrypted SaveFile.
e) Mount (Left-Click) you old SaveFile. Click Rox's Eye to show hidden files. Select the SaveFile's contents and copy them into corresponding folders. Such copying will only be to your 'System in RAM'. But a Save will write them to your encrypted SaveFile. You can (probably should) select one top-level folder at a time for copying/Saving.

Even if the above recipe works I would NOT use it. Creating an encrypted SaveFile formats it as Linux Ext2 which is prone to corruption. There's far more chance that it will become corrupted so that you won't be able to access its contents than that your system will fall into the wrong hands.

Encrypting an entire operating system may have some propaganda value if you are Microsoft and don't want people pirating that system. Puppy is free, and freely distributed. All its applications are free, and freely distributed. The only things worth encrypting is data you don't want others to access. Do you care if someone has access to last week's shopping list? The pdf you downloaded?

This is what I recommend:
(1) Move all data files (documents, pictures, spreadsheets, videos, etc.) out of your SaveFile. [They should not have been there].
(2) Take a look at the files-systems fossapup64 uses to boot: initrd.gz, vmlinuz, puppy_fossapup64_9.X.sfs, etc. ['X', I don't know if you have the original (9.5) or new fossapup (9.6)]. Is there an adrv_possapup64_9.X.sfs but NO ydrv_possapup64_9.X.sfs?
If so, Right-Click adrv_possapup64_9.X.sfs >select rename and rename it ydrv_possapup64_9.X.sfs. ydrvs and adrvs do the same thing, but adrvs have priority. Its content will over-ride that of a ydrv. We're going to create an adrv to hold your current settings, customizations and the applications you added. It will take the place of your SaveFile, enabling you to create a new SaveFile if you want.

[Both adrv & yrdv are READ-ONLY. A hacker can't change them].

(3) Install nicOS-Utility-Suite, https://www.forum.puppylinux.com/viewto ... 983#p12983. That post shows its GUI. Use its Save2SFS module to create an adrv, choosing to exclude your current (renamed) ydrv.
(4) Boot pfix=RAM so as not to use your SaveFile. Create a folder and move your SaveFile into it so its use won't be offered on boot-up. When you're satisfied with your system you can delete it. It's there only to enable you to revert if you find a problem.
On shut-down you'll be offered the opportunity to create a SaveFile.

Step 3a Before creating the adrv you may want to install some application to encrypt folders. Jafadmin has published a front end for LUKS, https://www.forum.puppylinux.com/viewto ... 2827#p2827. But if I read that post correctly, you'll have to use Puppy Package Manager to install LUKS, itself.

Personally, I like pzip. Easy to use and can be used other than just to create and use encrypted folders. You can obtain the Portable GTK2 from here, https://peazip.github.io/peazip-linux.html. Download it. Right-Click the tar.gz which downloaded and select UExtract. Within the extraction folder will be one with a long name. Right-Click select Rename and truncate the name down to just 'peazip'. To run it, just Left-Click the binary named 'peazip' within that folder.
You can drag/drop that folder into /opt. If you book-mark the /opt folder it will be easy to use when needed even without a menu entry. [You can, of course, create one]. When you peazip a folder you'll be asked if you want to encrypt it.

[Jafadmin]

Cliff Notes version of what @mikeslr said:
If using LotsaLuks:
1) create a LUKS file the size you want formatted ext4 with default encryption settings, in the same
place as the other puppy boot files, and mount it. (name the file something simple for now)
2) copy everything from the 'fossapup64save' directory into the newly created LUKS file
3) close the newly created LUKS file
4) rename the newly created LUKS file to 'fossapup64save_luks.4fs'
5) reboot fossapup and select the new file when asked

So basically you're creating a large LUKS container(file), copying the contents of the unencrypted directory into it, renaming the encrypted file, then selecting it on reboot.

There is really no sorcery involved. I hope this helps.

[mikeslr]

Jafadmin beat me to it, sort of. While searching my stored data files for something else I ran across a relevant note. I'm running Bionicpup which doesn't have cryptsetup on it Menu (and whose repos have been archived). It's actually builtin, but to use it requires use of a terminal. If fossapup64 doesn't have cryptsetup builtin you should be able to install it using Puppy Package Manager. Jafadmin's LotsaLuks works with it.

It hadn't occurred to me to convert-by-renaming a LUKS-folder into a SaveFolder. Nice idea, jafadmin.

[Boromir]

@mikesire and @jafadmin

Thank you both so much for the feedback! Incredibly helpful. I had kinda thought about trying to copy my old pupsave file and encrypting the copied version, but I was not sure how to go about that; now I know. I really appreciate the help.

@rockedge

Thanks for the link to the old forums. I mistakenly thought "old" meant no longer relevant, so its good to know I can search through those forums as well for answers to questions. Deeply appreciate the pointer there.