Swap file creation
Note: For Btrfs, follow the procedure described in Btrfs#Swap file instead of the steps below.

Use mkswap(8) to create a swap file the size of your choosing (see Partitioning#Swap for advice). For example, creating a 4 GiB swap file:

# mkswap -U clear --size 4G --file /swapfile

Activate the swap file:

# swapon /swapfile

Finally, edit the fstab configuration to add an entry for the swap file:

/etc/fstab

/swapfile none swap defaults 0 0

For additional information, see fstab#Usage.
Note: The swap file must be specified by its location on the file system, not by its UUID or LABEL.

dm-crypt/Swap encryption

    Page
    Discussion

    Read
    View source
    View history

Tools

< Dm-crypt

Depending on requirements, different methods may be used to encrypt the swap partition which are described in the following. A setup where the swap encryption is re-initialised on reboot (with a new encryption) provides higher data protection, because it avoids sensitive file fragments which may have been swapped out a long time ago without being overwritten. However, re-encrypting swap also forbids using a suspend-to-disk feature generally.
Without suspend-to-disk support

In systems where suspend-to-disk (hibernation) is not a desired feature, /etc/crypttab can be set up to decrypt the swap partition with a random password with plain dm-crypt at boot-time. The random password is discarded on shutdown, leaving behind only encrypted, inaccessible data in the swap device.

To enable this feature, simply uncomment the line beginning with swap in /etc/crypttab. Change the device parameter to the name of your swap device. For example, it will look something like this:

/etc/crypttab

# <name>  <device>     <password>     <options>
swap      /dev/sdX#    /dev/urandom   swap,cipher=aes-xts-plain64,size=512,sector-size=4096

This will map /dev/sdX# to /dev/mapper/swap as a swap partition that can be added in /etc/fstab like a normal swap. If you had a non-encrypted swap partition before, do not forget to disable it - or re-use its fstab entry by changing the device to /dev/mapper/swap. The default options should be sufficient for most usage. For other options and an explanation of each column, see crypttab(5) as well as point cryptsetup FAQ 2.3.
Warning: All contents of the named device will be permanently deleted. It is dangerous to use the kernel's simple naming for a swap device, since their naming order (e.g. /dev/sda, /dev/sdb) changes upon each boot. Options are:

    Use by-id and by-path paths. However, these are both are susceptible to hardware changes. See Persistent block device naming#by-id and by-path.
    Use PARTLABEL.
    Use an LVM logical volume's name.
    Use the method described in #UUID and LABEL. Labels and UUIDS cannot be used directly because of the recreation and re-encryption of the swap device on every boot with mkswap, see cryptsetup FAQ.

Note: Swap partition setup can sometimes fail, see systemd issue 10179.

To use a by-id persistent device naming instead of kernel simple naming, first identify the swap device:

# find -L /dev/disk -samefile /dev/sdaX

/dev/disk/by-id/ata-WDC_WD2500BEVT-22ZCT0_WD-WXE908VF0470-partX
/dev/disk/by-id/wwn-0x60015ee0000b237f-partX

Then use as a persistent reference for the /dev/sdX# example partition (if two results are returned as above, choose either one of them):

/etc/crypttab

# <name>  <device>                                                         <password>     <options>
swap      /dev/disk/by-id/ata-WDC_WD2500BEVT-22ZCT0_WD-WXE908VF0470-partX  /dev/urandom   swap,cipher=aes-xts-plain64,size=512,sector-size=4096

After a reboot to activate the encrypted swap, you will note that running swapon -s shows an arbitrary device mapper entry (e.g. /dev/dm-1) for it, while the lsblk command shows crypt in the FSTYPE column. Due to fresh encryption each boot, the UUID for /dev/mapper/swap will change every time.
Note: If the partition chosen for swap was previously a LUKS partition, crypttab will not overwrite the partition to create a swap partition. This is a safety measure to prevent data loss from accidental mis-identification of the swap partition in crypttab. In order to use such a partition the LUKS header must be overwritten once.
UUID and LABEL

It is dangerous to use crypttab swap with simple kernel device names like /dev/sdX# or even /dev/disk/by-id/ata-SERIAL-partX. A small change in your device names or partitioning layout and /etc/crypttab will see your valuable data formatted on the next boot. Same if you use PARTUUID and then decide to use that partition for something else without removing the crypttab entry first.

It is more reliable to identify the correct partition by giving it a genuine UUID or LABEL. By default that does not work because dm-crypt and mkswap would simply overwrite any content on that partition which would remove the UUID and LABEL too; however, it is possible to specify a swap offset. This allows you to create a very small, empty, bogus filesystem with no other purpose than providing a persistent UUID or LABEL for the swap encryption.

Create a filesystem with label of your choice:

# mkfs.ext2 -L cryptswap /dev/sdX# 1M

The unusual parameter after the device name limits the filesystem size to 1 MiB, leaving room for encrypted swap behind it.

# blkid /dev/sdX#

/dev/sdX#: LABEL="cryptswap" UUID="b72c384e-bd3c-49aa-b7a7-a28ea81a2605" TYPE="ext2"

With this, /dev/sdX# now can easily be identified either by UUID or LABEL, regardless of how its device name or even partition number might change in the future. All that is left are the /etc/crypttab and /etc/fstab entries. For example, using different encryption options:

/etc/crypttab

# <name> <device>         <password>    <options>
swap     LABEL=cryptswap  /dev/urandom  swap,offset=2048,cipher=aes-xts-plain64,size=512,sector-size=4096

Note the offset: it is 2048 sectors of 512 bytes (it is not affected by the dm-crypt sector size), thus 1 MiB. This way the encrypted swap will not affect the filesystem LABEL/UUID, and data alignment works out as well.

/etc/fstab

# <filesystem>    <dir>  <type>  <options>  <dump>  <pass>
/dev/mapper/swap  none   swap    defaults   0       0

Using this setup, the cryptswap will only try to use the partition with the corresponding LABEL, regardless of what its device name may be. Should you decide to use the partition for something else, by formatting it the cryptswap LABEL would also be gone, so /etc/crypttab will not overwrite it on your next boot.
Disabling hibernation in desktop environments

Desktop environments may not automatically detect that a swap partition is randomly encrypted and cannot be used for suspend-to-disk.

Xfce can be configured to hide its Hibernate button by running this command:

$ xfconf-query -c xfce4-session -np /shutdown/ShowHibernate -t bool -s false

With suspend-to-disk support

The following three methods are alternatives for setting up an encrypted swap for suspend-to-disk. If you apply any of them, be aware that critical data swapped out by the system may potentially stay in the swap over a long period (i.e. until it is overwritten). To reduce this risk consider setting up a system job which re-encrypts swap, e.g. each time the system is going into a regular shut-down, along with the method of your choice.
LVM on LUKS

If the swap volume is in a volume group that gets activated in initramfs, simply follow the instructions in Power management/Suspend and hibernate#Hibernation.
Using a swap partition
Note: To use a partition which is currently used by the system, you have to disable it first with # swapoff /dev/device, and make sure to remove any line in /etc/crypttab pointing to this device.
Basic swap partition setup

Use LuksFormat to create the encrypted container for the swap partition:

# cryptsetup luksFormat --label swap /dev/device

Open the container to /dev/mapper/swap:

# cryptsetup open /dev/disk/by-label/swap swap

Create a swap filesystem inside the mapped partition:

# mkswap /dev/mapper/swap

If not using Systemd#GPT partition automounting, add the mapped partition to /etc/fstab by adding the following line:

/dev/mapper/swap none swap defaults 0 0

Set up your system to resume from /dev/mapper/swap. For example, if you use GRUB with kernel hibernation support, add the kernel parameter resume=/dev/mapper/swap to GRUB by appending it to the GRUB_CMDLINE_LINUX_DEFAULT variable in /etc/default/grub. A kernel line with encrypted root and swap partitions can look like this:

kernel /vmlinuz-linux cryptdevice=/dev/sda2:root root=/dev/mapper/root resume=/dev/mapper/swap ro

I created swap file /swp on encrypted root drive. How to setup resume on it? Which kernel params I should pass in bootloader? for opening the swap file by typing password when resuming linux from hibernation