Swap not working on clean 14.04 install using encrypted home

Known Bug

There is a bug (see below) that overwrites the UUID for the partition as soon as data is written to it. Therefore, you cannot use the UUID to reference the partition to use for encrypted swap.

These days, swap space is hardly ever used. On my machine, swap is only used when I open my 40th tab. When I have no swap, suddenly my computer starts lagging and the browser closes itself. Or in the case of the Chromium browser, a lot of tabs will suddenly 'die'.
For this reason, referencing /dev/disk/by-uuid/ in your /etc/crypttab might seem to be working for a while, but as soon as your swap space is actually used, it will overwrite the UUID because the entire partition is used for encrypted data storage.

Easy Fix

The easy fix is to reference the swap partition by device in your /etc/crypttab, e.g.:

cryptswap1 /dev/sda5 /dev/urandom swap,cipher=aes-cbc-essiv:sha256

Warning: this is probably safe on a laptop (I use it like this), but if you are on a desktop with swappable drives or have other reasons for changing the drive/partition layout, you don't want to do this, as a normal storage partition might suddenly be used for swap.

Note: You need to reboot for this change to take effect, because only when booting will /dev/mapper/cryptswap1 be created.

Proper Fix

The proper way to fix this is to make sure the part of the raw partition that stores the UUID is not overwritten by encrypted swap data, so it will still be there on reboot. However, I'm not sure where the UUID is written and how much bytes it takes up. You could, at your own risk, test it like so:

cryptswap1 UUID=abe3c568-c8fd-4dfb-b8e9-0520d442dd61 /dev/urandom swap,offset=36,cipher=aes-cbc-essiv:sha256

Note the offset=36.

Please if you have an Ubuntu One account log in and go to Bug #1310058 on Launchpad and choose (or click here): "This bug affects me too" so the bug will gain 'popularity' and is more prone to get fixed.

---

Update 2014-10-27

I also stumbled upon this. Not verified by me. It looks like offset trick with more verbosity and comments about rebuilding a broken swap.

https://bugs.launchpad.net/ubuntu/+source/ecryptfs-utils/+bug/1310058/comments/22

I was having the same exact problem in Ubuntu 14.04 and came across this thread; this link that mutant provided worked well for me. I used the /dev/disk/by-id reference rather than the /dev/sdXY, as that reference is not always pointing to the same physical partition. My /etc/crypttab ended up like:

cryptswap1 /dev/disk/by-id/wwn-0x500...-part6 /dev/urandom swap, cipher=aes-cbc-essiv:sha256

Just use an unencrypted swap

... and keep /home encrypted

I tried a couple of the other solutions suggested here. Even though they kept working after a hot reboot, eventually they all failed after a shutdown and cold restart.

This tells us we are actually dealing with a double bug:

1. The UUID of the swap drive gets overridden by the encryption system, and
2. There is a timeout issue during booting.

These thoughts are also reflected in the comments to the pertaining bug filed at Launchpad. However, with the pending move from Upstart to systemd, little is done to resolve the bug on current LTS systems.

At this point, the following thoughts crossed my mind:

1. During system installation, I asked to only encrypt my \home partition, nothing else.
2. The risks involved with not having an encrypted swap partition are rather limited.
3. It is up to Canonical to clean up their act. I will waste no more time with this.

So, here is my solution to restore the swap as a normal, unencrypted swap without having to reinstall the whole operating system.

1. If you have not done so already, install blkid: $ sudo apt-get install blkid
2. Edit /etc/crypttab and delete the whole cryptswap1 line: $ sudo nano /etc/crypttab
3. Start GParted from the system Settings menu.
4. You will see a partition with an exclamation mark. This should be the faulty swap partition. Carefully select it and reformat it to a linux-swap partition. After having applied this operation, you are informed about the new UUID of the restored normal swap partition. You are offered an opportunity to save this information. If you do not, know that you can always retrieve the new UUID from the command line with blkid: $ sudo blkid

5. Now, it is time to restore /etc/fstab to its old glory: $ sudo nano /etc/fstab

   • Remove the entire line containing a reference to /dev/mapper/cryptswap1.
   • Uncomment the old swap line by removing the hash # in front of UUID=....
   • Now, replace the old UUID with the new one obtained earlier.
   • Write the file out by hitting Ctrl+O and exit nano with Ctrl+X.
6. Once done all that, you can already start using the new unencrypted swap with: $ sudo swapon -a
7. This solution survives both hot reboots and shutdown with cold restart.