I currently have an unencrypted external hard drive that I use as a backup for my encrypted (with LUKS) main machine. To update my backup, I simply log in to the main machine and rsync to my external hard drive. Clearly, having an unencrypted backup for material that was worth encrypting in the first place is a bad idea. However, due to time constraints, I am unable to regularly update my backup without the help of something like rsync. It follows that any encryption method that I use on the external drive must be compatible with rsync. However, I have ran in to the following issues:

1. Userspace stackable encryption methods like EncFS or eCryptfs appear to both take up a lot of space and not play nice with rsync. The hidden files reponsible for the encryption seem to change frequently enough that rsync ends up having to copy so many files that it's barely worth even using rsync.


2. luksipc would be an option, but it's latest documentation tells me to instead use the the cryptsetup-reencrypt tool from dm-crypt. Sadly, whenever I look up the relevant documentation on the arch wiki for cryptsetup-reencrypt I can neither tell what to do, nor if it'll work with rsync. The cryptsetup-reencrypt tool also seems to be new enough that it's hard to find doccumentation on it that someone at my level can read.


3. Plain LUKS, or anything similar isn't an option, because the earlier mentioned time constraints prevent me from being able to wipe the drive and make the backup again from scratch.


4. Duplicity could be an option, but it doesn't seem able to encrypt any unencrypted files that are on the external hard drive (i.e. where it's copying to).

Overall, it looks like #2 might be my best option for the goal of encrypting my external drive and keeping that drive up to date with rsync, but I don't really know where to begin and I'm not very open to the possibility that I might have to wipe the drive before encrypting it. Am I missing anything useful?

I think I see the main problem now, it's just:

"How do I encrypt a drive that already has data on it?"

There's only one safe answer, whether you're using LUKS or eCryptFS or EncFS, or basically anything:

1. Backup the data somewhere else


2. Encrypt the drive (erasing / overwriting the now backed up existing data on it)


3. Copy the data to the now encrypted drive


4. Verify that you can decrypt (unlock) the drive, and that the data is unchanged

For your case, if you wanted to use LUKS on the backup drive, and if the backup drive is less than half full, you could:

1. create a free partition in half the drive


2. encrypt the free partition with LUKS


3. copy your data from the unencrypted partition to the LUKS partition


4. delete the unencrypted partition


5. then expand the LUKS partition over the entire drive...

BUT one of those partition shrinking & enlarging operations will most likely require moving data, and to be safe you should have a backup first, so you're stuck with just doing the earlier "Backup the data" step anyway.

The same goes if you're considering a LUKS encrypt-in-place solution (lukspic or cryptsetup-reencrypt) - if it's important data, have a backup first.

• Since this is already a backup drive, you might be able to use the original drive as a pseudo-backup, and just erase the whole drive, use LUKS, and then make a fresh backup from the original drive

Or, if you don't care if the data were to get deleted, then go ahead and try an encrypt-in-place solution, or move partitions back & forth, just don't be shocked if something goes wrong & everything gets deleted.