How to Configure Encrypted Swap Using dm-crypt in Ubuntu

When physical RAM fills under heavy computing workloads, the Linux kernel evicts anonymous memory pages to physical swap space on disk. On unencrypted systems, swapping introduces severe security vulnerabilities: active encryption keys, database passwords, SSL/TLS private tokens, and plain-text user data stored in memory are written directly to unencrypted drive sectors. An attacker gaining physical possession of the drive or executing offline data recovery tools can easily harvest these plain-text credentials from swap.

On Ubuntu systems where full-disk LUKS encryption was not configured during installation, you can secure virtual memory by implementing encrypted swap using dm-crypt. By configuring an ephemeral random key generated on every boot via /dev/urandom, swap data remains completely protected and becomes cryptographically unrecoverable once the system powers down.

Identifying Active Swap and Deactivating Devices

Before configuring encryption, inspect your current swap configuration and identify the underlying partition:

swapon --show

You can also query system block devices to confirm the exact device node (for example, /dev/nvme0n1p3 or /dev/sda3):

lsblk -f

Deactivate all active swap partitions and swap files before modifying partition mappings:

sudo swapoff -a

Configuring dm-crypt with Ephemeral Random Keys in /etc/crypttab

The Linux crypttab file defines encrypted device mappings initialized at early boot by systemd. Open the file in an administrative text editor:

sudo nano /etc/crypttab

Append a configuration line defining the encrypted swap mapper. Replace /dev/nvme0n1p3 with your physical swap partition device node:

cryptswap /dev/nvme0n1p3 /dev/urandom swap,cipher=aes-xts-plain64,size=512,hash=sha256

Parameter Breakdown:

• cryptswap: The target device mapper name created under /dev/mapper/cryptswap.
• /dev/nvme0n1p3: The backing physical partition to encrypt.
• /dev/urandom: Specifies that a new ephemeral cryptographic key is generated automatically on every system boot.
• swap: Instructs systemd to execute mkswap automatically on the newly opened mapped container after unlocking.
• cipher=aes-xts-plain64,size=512: Enforces hardware-accelerated AES-XTS encryption using a 512-bit key.

Updating /etc/fstab for the Encrypted Mapper Device

Now that the block device will be mounted through the dm-crypt abstraction layer, update the file system table to reference the virtual device rather than the raw physical partition:

sudo nano /etc/fstab

Locate the existing swap line (which may reference a UUID or partition node) and comment it out by prepending a #. Then, add the new mapper entry:

# /dev/nvme0n1p3 (Legacy unencrypted swap)
/dev/mapper/cryptswap none swap sw 0 0

Activating Encrypted Swap and Verifying Operation

You can initialize the encrypted swap device immediately without rebooting the system:

# Initialize the crypttab device mapping
sudo systemctl restart [email protected]

# Activate all swap entries declared in fstab
sudo swapon -a

Verify that the encrypted swap partition is active and properly mapped:

# Check active swap devices
swapon --show

# Inspect dm-crypt cryptographic parameters
sudo cryptsetup status cryptswap

The cryptsetup status output should report cipher: aes-xts-plain64 and confirm that the device is running in active read/write mode.

Considerations for System Hibernation (Suspend-to-Disk)

Configuring encrypted swap with ephemeral /dev/urandom keys has one important operational implication: it disables system hibernation (suspend-to-disk). When a computer hibernates, the kernel dumps system state to swap and powers off. Upon booting, the kernel cannot decrypt the hibernation image because the random key was lost when memory lost power. If your workflow requires system hibernation, you must implement swap backed by a static key stored on an encrypted root partition or sealed within a TPM 2.0 security chip rather than an ephemeral random key.