The tag has no usage guidance.

learn more… | top users | synonyms

4
votes
3answers
2k views

Unlock LUKS encrypted Debian root with key file on boot partition

I'm trying to decrypt the Debian root with a key file stored in the boot partition (decrypted partition). This will break the security, but it doesn't matter now. I have to conclude this successfully ...
1
vote
1answer
20 views

why does systemd cryptsetup try to remount the root partition already mounted?

I have /etc/crypttab as follows: sda7_crypt UUID=<...> /dev/sda8:/keyfile luks,discard,keyscript=/lib/esi/tpm_key_pass sda7_crypt is my root filesystem, so I use update-initramfs to decrypt ...
1
vote
0answers
438 views

crypttab and veracrypt

I dual boot Fedora and Windows Vista and want them to share a partition so that I can work on the same files in both Linux and Windows, and I need everything to be encrypted. I encrypted the shared ...
1
vote
1answer
189 views

howto interpret `cryptsetup benchmark` results?

summary: I can run cryptsetup benchmark and sort the results, but seek guidance in their interpretation. E.g., should I give more weight to encryption speed or decryption speed? Should key-derivation ...
3
votes
2answers
587 views

How can I set a label on a dm-crypt+LUKS container?

I just received a new USB flash drive, and set up 2 encrypted partitions on it. I used dm-crypt (LUKS mode) through cryptsetup. With an additional non-encrypted partition, the drive has the following ...
1
vote
0answers
60 views

Initramfs in debootstrap chroot of fully encrypted system

I'm working on a script to create a fully encrypted washable system from debootstrap. It's doing some good, but the initramfs image that comes out does not pick up the cryptroot properly. After ...
0
votes
2answers
163 views

How to automate cryptsetup-luksAddKey with passphrase?

Context: I replaced my passphrase prompted at launch by a keyfile, stored on a USB dongle. My question concerns the step: # cryptsetup luksAddKey /path/to/mykeyfile . I generated my added key ...
1
vote
2answers
86 views

cryptsetup: Attaching loopback device failed

I am using cryptsetup with detached header. For that I am using the --header parameter, to specify header file. I can open my device using: cryptsetup luksOpen /dev/sdb1 sdb1 --header LUKS-HEADER ...
0
votes
0answers
12 views

Cryptsetup boot many devices “timeout”

On my server, the crypttab file has 13 entries for every hard drive connected to it. 2 are for the system partitions, 2 are for the backup system and 9 are for the mediaserver and nfs stuff. ...
0
votes
1answer
28 views

How do can I tell what encryption is being used with signed in luks?

What command tells you what encryption is being used by a luks partition (all the relevant information initialization vector generation scheme, mode of operation and block cipher primitive).
1
vote
1answer
41 views

Cryptsetup: LVM is missing (on a system without LVM)

So, I have a problem with the partitions setup of my laptop. I will try to include as many details as possible in order to make it easier to help. In the past, I had an ubuntu 15.10 system on my ...
1
vote
1answer
69 views

Unable to remove stale volume

I have an external hard drive connected to my Ubuntu laptop via USB. The whole hard drive is LUKS encrypted. Next to the encryption layer sits an LVM volume which I mount to /mnt/es. Once opened, ...
0
votes
1answer
49 views

Decrypting a previously create losetup device

I've created an encrypted backup in 2004, using losetup -e. I still know the passphrase, so I should be fine, but losetup is gone in the linux distributions I use. I still have a bash script for ...
1
vote
1answer
105 views

Encrypt partition and allow qemu to use it as the guest drive

I am trying to encrypt a 25gb partition on my SSD with cryptsetup in such a way that will allow QEMU-KVM to use it as the guests drive. I have tried luksformatting the drive: cryptsetup luksFormat ...
1
vote
1answer
74 views

Waiting long (few minutes) during boot for cryptsetup for password prompt

I have LVM on the top cryptsetup on my Debian unstable amd64. A week ago after upgrade my initramfs changed and now I have to wait few minutes at the beginning of the boot before cryptsetup asked for ...
2
votes
1answer
27 views

Is there an equivalent of mount -a for cryptsetup?

mount -a will ensure everything in /etc/fstab is mounted (except for noauto entries). Is there an equivalent for cryptsetup, which will unlock everything in /etc/crypttab?
2
votes
0answers
101 views

LVM partition not mounting

There was a drive failure on a disk in a RAID1 configuration. I removed the bad disk and reconfigured the RAID1 to only use the good disk. When I reboot the machine there are missing LVM partitions. ...
5
votes
2answers
111 views

Creating a large file with random content: short-cut by copying?

Assume I want to create a large encrypted drive stored in a file using cryptsetup, the first step is to create a random file, assume this should be of size 3T: dd if=/dev/urandom of=$FILE bs=1G ...
1
vote
1answer
524 views

Enabling FIPS on a luks encrypted CentOS system breaks boot password

For one of my apps I need to enable FIPS for OpenSSL, while simultaneously using software disk encryption. VM #1 I launched a CentOS VM instance which was software encrypted during install. The ...
0
votes
0answers
38 views

Zenity, how to manage cryptsetup prompt?

With Zenity, I display a progressBar and install/config many stuff on a Linux Mint (Debian) computer. I had to avoid any prompt. But one step prompts Enter a passphrase:, this is cryptsetup ...
1
vote
1answer
224 views

luks volume disappears after reboot

I created a separate partition on a CentOS install (VirtualBox), and am attempting to encrypt it using cryptsetup and LUKS. I'm using the following commands to get this set up: cryptsetup luksOpen ...
1
vote
0answers
276 views

Difference between cryptopts and crypttab

I'm setting up an encrypted root fs, which I've done before, but this time I'm using a PGP-encrypted keyfile with a symmetric password to familiarize myself with the process. There are two places ...
3
votes
1answer
599 views

cryptsetup: dm-crypt plain mode using keyfile AND passphrase

I feel a keyfile and a passphrase provide different benefits. They can not be obtained in the same way (one you need to physically acquire, the other one you need to know). Thus, I think there is ...
5
votes
1answer
1k views

Abysmal general dm-crypt (LUKS) write performance

I am investigating a problem where encrypting a block device imposes a huge performance penalty when writing to it. Hours of Internet reading and experiments did not provide me with a proper ...
0
votes
0answers
35 views

Optimizing initramfs : Enter dm-crypt password with targeted initramfs?

All my Linux partitions except /boot lie on an encrypted LVM volume, like a typical modern Debian installation. In theory, I could shrink my initrd file by replacing the line MODULES=most in ...
1
vote
1answer
441 views

cryptsetup luksFormat - cannot open device for read-only access

I created a new partition that I would like to encrypt with LUKS. The device is a 1GB partition with ID 83 (Linux). I've changed the owner to root, and chmod to 777. The command I'm using is : ...
5
votes
1answer
896 views

List open dm-crypt LUKS volumes

If I mount a simple loop device, losetup -a give me the devices opened. Is something similar possible with cryptsetup?
4
votes
2answers
638 views

Can a systemd dependency be applied only to a unit's “ExecStart” action?

I have a scenario where a number of storage volumes are encrypted using keys contained on a removable encrypted USB "keyring" flash drive. I am running Arch Linux and this question is about systemd ...
2
votes
1answer
433 views

LUKS: Enter passphrase and nothing happens

I've installed gentoo on my new laptop. I've got an LUKS-encrypted root partition (/dev/sda3). Cryptsetup (USE="gcrypt") is installed. Essential cryptographic API is compiled in kernel. Kernel and ...
4
votes
2answers
433 views

error mounting truecrypt disk with cryptsetup

Trying to use cryptsetup to mount a drive encrypted with truecrypt. Doing this: sudo cryptsetup open --type tcrypt --readonly /dev/sdc1 encrypted_drive and then typing the passphrase gives me: ...
6
votes
1answer
984 views

Trying to understand LUKS encryption

I decided to encrypt my root partition with LUKS+LVM. My ThinkPad setup: Samsung 830 128GB SSD 750GB HDD Core 2 Duo 2,5 GHz P9500 8GB RAM But the more I read, the less I understand about those ...
1
vote
1answer
446 views

Arch mkinitcpio grub boot fails on edit

I'm experiencing this strange behavior. I am using ArchLinux, generated boot things with mkinitcpio, and using Grub2 (not legacy). When booting, and pressing "e" to edit the entry (to see boot ...
3
votes
1answer
471 views

losetup /dev/loop0 disappears after some time

at the moment I do some tests with loop devices on Linux/Ubuntu. In a small test script I have the following commands: #!/bin/sh rm testfile.x dd if=/dev/zero of=testfile.x bs=1M count=1200 losetup ...
6
votes
1answer
318 views

Cryptsetup not finding libgcrypt.so after upgrade

I am running a Fedora Core 13 with dm-crypt + luks, all standard with fedora distos. After upgrading libgcrypt.so, cryptsetup moans at boot up that it can not find the library where it expects it to ...
3
votes
0answers
142 views

adding encrypted /home in LVM/LUKS

I installed a new (debian) system to an SSD device. After standard install I want to mount /home on the internal HDD. To be able to ask the question, some details: On install I (manually) generated ...
3
votes
0answers
420 views

remap read-only LUKS partition to read-write

cryptsetup can be invoked with --readonly or -r option, which will set up a read-only mapping: cryptsetup --readonly luksOpen /dev/sdb1 sdb1 Once I have opened a device as read-only, can I later ...
0
votes
1answer
59 views

setting default options for cryptsetup

Is there a way to set default options for cryptsetup? For example, lets say I want to make sure that I only open cryptsetup devices with the -r option. I would like to add it to a config file, so that ...
0
votes
1answer
1k views

Encrypted ArchLinux: unable to find root device

I have a problem with my new installation of ArchLinux with an encrypted partition. I guess I have done the same steps as before and it works on my other machine. The error message I get is: ERROR: ...
0
votes
1answer
27 views

Archlinux ARM Rasperry Pi decryption fail

I have created an encrypted Archlinux partition on my SD card, but currently I am unable to decrypt it. I am using the key "Xö&(4n=%YF3Ü!BN" which includes german letters. So for this I have ...
1
vote
1answer
114 views

Archlinux ARM Rasperry Pi login buffer display and decryption fail

I have put the Archlinux Arm on my SD card and the first time I have done this it was all correct and worked well but I had to "reinstall" everything for several reason. So now I am doing the same ...
1
vote
1answer
224 views

Storing a keyfile in an encrypted LVM

I'm using RHEL 6.5 and I want to encrypt some of my logical volumes (LVM). In order to not have to enter the passphrase multiple times, I want to store a keyfile in an encrypted LV. Example: ...
1
vote
1answer
96 views

How to add a progress bar to cryptsetup luksFormat?

Example command. cryptsetup --hash sha512 -c aes-xts-plain64 --key-size 512 luksFormat /dev/loop0 This can take quite a while for big files / on slow disks. How to add a progress bar?
2
votes
0answers
2k views

Accessed a TrueCrypt container without TrueCrypt. What dangers await?

I've got a TrueCrypt volume. In light of the unexpected demise of TrueCrypt, I've been trying to figure out what to do (reading lots of HOWTO websites). I'd like something that is simple and can work ...
1
vote
1answer
188 views

Backup LUKS (cryptsetup Command) partition or volume

Can you create a file container/volume in LUKS in the same way that you could do with Truecrypt? Otherwise, how can you backup a LUKS partition? Do you have to clone it, for example with dd? or backup ...
0
votes
1answer
277 views

How do you encrypt a USB drive partition with the Twofish cipher and SHA-512 hash without using TrueCrypt? [closed]

I've been trying to string together the right flags in cryptsetup: cryptsetup -y -h sha512 -c twofish-xts-plain64 -s 512 luksFormat /dev/sdx But it hasn't been working. When I enter the command ...
3
votes
3answers
1k views

How much storage overhead comes along with cryptsetup and ext4?

I want to encrypt the content of a directory in a container with an ext4 filesystem using cryptsetup. The size of the container should be as small as possible and as big as necessary, because I only ...
1
vote
1answer
294 views

Cryptsetup: pre-fill the partition with random data

It says it is an optional step, but it is recommended to do this, it improves encryption to pre-fill the partition with random data. What brings security filled with random data? Is it more difficult ...
3
votes
1answer
1k views

How to open multiple LUKS volumes with key entered in initramfs?

I have a Debian 7.4 (stable) based server configured to use an encrypted (RAID1 + LVM) root partition (/boot is un-encrypted regular partition) to which I installed dropbear SSH server so I can ...
3
votes
1answer
438 views

How can move a LUKS container from the middle of a partition to the beginning?

For the tl;dr, skip to the bottom. I have a dual-boot setup with Mac OS X at the beginning of my drive and three GNU/Linux partitions at the end of the drive. I don't have the relevant machine on ...
1
vote
0answers
98 views

How to install linux (with crypto /Home + / partition) with enough swap space to hibernate

What are the steps to install Linux (with cryoto /Home + / partition) Mint on a empty hard drive with 1.5x swap space as RAM. I am aware that the CD allows this as a default option but it doesn't ...