retrofitting LUKS encryption on installed F19 system

Question

I've got a F19 installation that I'd like to turn into a fully encrypted system with LUKS.

There are many howtos on the web for encrypting a partition, but they all show doing it to /home.

the implication is that you need to be logged in as root on the actual system you're modifying, though I don't think that is explicitly stated. That would mean you can't encrypt the root partition itself, since you've got to have an empty partition to work on, then restore its contents from backup.

So, my question(s):
-can you do it while being booted into a recovery environment?
-if not, is there any way to convert the whole thing that I'm not able to figure out on my own (perhaps I'm having a whole series of senior moments) ???
-Or would it simply be best to do a fresh installation?

Comments

I think a fresh install is the only practical way.

Answer 1

No, just re-install. One partition with /boot and another with an encrypted volume-group, holding /, swap and the rest.

But before embarking on that trip, do you really need full disk encryption? I mean, the content of /usr is on any fedora-cd ;-) And when up-and-running, everything is unlocked.

The only valid reason I can think about, is that other people have physically access to your machine and could get root-access by booting from cd/dvd, and might alter your system.

It surely works, but at a performance price. And the certainty that you have to enter the LUKS-key each time you boot.