encryption:luks-partition
This is an old revision of the document!
Table of Contents
LUKS
LUKS Encrypted Partition/Drive
Change LUKS Partition Password
- Find the drive with the luks headers:
cat /etc/crypttab
- Find the partition using the disk label from the previous command:
sudo fdisk -l /dev/sda
- If it is listed by uuid, use:
ls -l /dev/disk/by-uuid/{insert your uuid here}
- Verify the Keyslots used:
sudo cryptsetup luksDump /dev/sda5
- Test passphrase:
sudo cryptsetup --verbose open --test-passphrase /dev/sda5
- Change Keyslot 0's key:
sudo cryptsetup luksChangeKey /dev/sda5 -S 0
- Verify new passphrase:
sudo cryptsetup --verbose open --test-passphrase /dev/sda5
Unlock LUKS Partition from GRUB
- Insert luks module:
grub rescue> insmod luks - List all divices:
grub rescue> ls
- Mount encrypted
/boot/partition:grub rescue> cryptomount (hd0,gpt2)
- To use uuid instead, use the
-uoption
- Enter passphrase:
Attempting to decrypt master key... Enter passphrase for hd0,gpt2 (<disk uuid>):
- Output on success:
Slot 3 opened - Insert LVM Module:
grub rescue> insmod lvm - Load module for normal boot:
grub rescue> insmod normal - Boot:
grub rescue> normal
LUKS Encrypted Storage
With cryptsetup 2.1.0, the LUKS header takes up just under 16MiB, so the partition size must be 16MiB + the size of the data you want to store in it.
Create a LUKS Storage Container
- Create a 20Mb file filled with random data: 1)
sudo dd if=/dev/urandom of=encrypted.luks.img iflag=fullblock bs=1M count=20
- Switch to root:
sudo -s
- Set permissions:
chmod go= encrypted.luks.img
- Configure encryption:
cryptsetup --verbose luksFormat encrypted.luks.img cryptsetup --verbose --use-random luksFormat encrypted.luks.img
- Open the encrypted container:
cryptsetup --verbose luksOpen encrypted.luks.img encrypted
- Create filesystem:
mkfs.ext4 /dev/mapper/encrypted
- Create directory to mount the container:
mkdir /mnt/encrypted
- Mount the container:
mount -t ext4 -o journal_checksum /dev/mapper/encrypted /mnt/encrypted
- Chown it:
chown chuck: /mnt/encrypted
- Set permissions:
chmod go= /mnt/encrypted
- Switch back to $USER:
exit
Copy Files to the LUKS Storage Container
- Copy or create your files:
cp /files/to/copy /mnt/encrypted
Close the LUKS Storage Container and Lock it
- Switch to root:
sudo -s
- Unmount the container:
umount /mnt/encrypted
- Close the encrypted container:
cryptsetup luksClose encrypted
- Switch back to $USER:
exit
Change Password on a LUKS Encrypted Storage Container
- If you want/need to change the password:
sudo cryptsetup luksChangeKey encrypted.luks.img
encryption/luks-partition.1636503114.txt.gz · Last modified: by chuck