The tag has no usage guidance.

learn more… | top users | synonyms

12
votes
3answers
5k views

Trim with LVM and dm-crypt

I tried to setup TRIM with LVM and dm-crypt on ubuntu 13.04 following this tutorial: http://blog.neutrino.es/2013/howto-properly-activate-trim-for-your-ssd-on-linux-fstrim-lvm-and-dmcrypt/ See the ...
9
votes
2answers
6k views

How to mount a cryptsetup container just with `mount`?

I created an encrypted container via #!/bin/bash dd if=/dev/zero of=$1 bs=1 count=0 seek=$2 MAPPER=$(mktemp -up /dev/mapper) LOOPDEV=$(losetup --find --show $1) cryptsetup luksFormat $LOOPDEV ...
8
votes
1answer
1k views

How to change the name an encrypted full-system partition is mapped to

My system is fully encrypted with dm-crypt and LVM. I recently moved the encrypted partition from /dev/sda5 to /dev/sda2. My question is: how can I change the name the encrypted partition is mapped ...
7
votes
1answer
1k views

Full disk encryption with dm-crypt (without LUKS)

I am currently trying to achieve full disk encryption using dm-crypt in plain mode without LUKS header with a separate /boot on USB stick. My main goal is to achive plausible deniability on a ...
6
votes
1answer
1k views

Security of an encrypted (dm-crypt & LUKS) Ubuntu 12.04 installed by somebody else?

Suppose I want an Ubuntu setup (let it be 12.04) with full disk encryption. Ubuntu offers this as an option during installation. Suppose also that I have somebody (e.g. my vendor) else set this up ...
6
votes
2answers
2k views

How to change the hash-spec and iter-time of an existing dm-crypt LUKS device?

How can I change the hash-spec and iter-time of an existing dm-crypt LUKS device? Clearly I can pass the options if I create a new device, for example something like this: sudo cryptsetup ...
6
votes
1answer
982 views

Trying to understand LUKS encryption

I decided to encrypt my root partition with LUKS+LVM. My ThinkPad setup: Samsung 830 128GB SSD 750GB HDD Core 2 Duo 2,5 GHz P9500 8GB RAM But the more I read, the less I understand about those ...
6
votes
2answers
1k views

Optimize performance for encrypted disk

Recently I tried to copy 200GB to a 1TB external / USB2 / encrypted disk and it took 36 hours. The same copy when the disk was not encrypted took no longer than 1 hour. I am using dm-crypt (LUKS) ...
6
votes
1answer
105 views

How to restore an LVM container to a bigger physical partition?

The setup is an encrypted LVM container/PV that holds a few ext4 partitions. I am moving these to a new machine, but there is more room on the disk. So, I have created a bigger encrypted LVM ...
5
votes
2answers
657 views

How to get a usable full disk encryption with different encryptions for different users

I want to have a full system encryption on my laptop. But I have two users, one for home and one for work and want a separate encryption for both. Sure I could do a full disk encryption with dm-crypt ...
5
votes
1answer
1k views

Abysmal general dm-crypt (LUKS) write performance

I am investigating a problem where encrypting a block device imposes a huge performance penalty when writing to it. Hours of Internet reading and experiments did not provide me with a proper ...
5
votes
1answer
452 views

Why doesn't dm-crypt handle write barriers properly?

One of the well-known properties of dm-crypt is that it does not handle write barriers properly and hence it requires turning off on-drive write cache to prevent corruption of filesystems. As far as I ...
5
votes
1answer
742 views

How to decrypt an encrypted container via ssh without entering a passphrase while requiring some client authentication?

I log in to a server via public key authentication and then mount a container (using e.g. LUKS/dm-crypt or truecrypt). At the moment, I have to enter the container password manually. Is there a way to ...
4
votes
2answers
1k views

Why does LUKS need to generate hash values?

If you create a new LUKS device, you can specify the option -hash and -iter-time. For example like this: sudo cryptsetup luksFormat --cipher aes-cbc-essiv:sha256 --key-size 256 --iter-time 2100 ...
4
votes
2answers
828 views

How to encrypt my system such that suspend to RAM works and is also encrypted

How can I encrypt my system (at best using lvm + dm-crypt/luks) such that suspend to RAM works and that everything is in an encrypted state when suspended to RAM?
4
votes
1answer
2k views

Grub2 unable to boot encrypted root

I'm using ArchLinux, I followed their tutorial on encrypting your root filesystem: https://wiki.archlinux.org/index.php/Using_DM-Crypt But I cannot get grub to boot the encrypted partition. My ...
3
votes
3answers
730 views

Is there any utility or procedure available to dm-crypt my existing live data in place to make a full disk encryption

Once I already have a running Linux system installed with live unencrypted data on my HDD. Is there any reasonable way to dm-crypt that entire HDD right in place? (Without backing up then restoring ...
3
votes
1answer
803 views

Will using a compressed filesystem over an encrypted volume improve performance?

Encryption/decryption is often the main bottleneck when accessing an encrypted volume. Would using a filesystem with a fast transparent compression (such as BTRFS + LZO) help? The idea is that there ...
3
votes
2answers
579 views

How can I set a label on a dm-crypt+LUKS container?

I just received a new USB flash drive, and set up 2 encrypted partitions on it. I used dm-crypt (LUKS mode) through cryptsetup. With an additional non-encrypted partition, the drive has the following ...
3
votes
1answer
593 views

cryptsetup: dm-crypt plain mode using keyfile AND passphrase

I feel a keyfile and a passphrase provide different benefits. They can not be obtained in the same way (one you need to physically acquire, the other one you need to know). Thus, I think there is ...
3
votes
1answer
2k views

How to salvage a lvm/luks install from custom install

I was battling with setting up a Mint install on an encrypted hard-drive, and I think I partially succeeded. But I cannot boot the system because some configuration is not correct, and since I'm a ...
3
votes
3answers
1k views

How much storage overhead comes along with cryptsetup and ext4?

I want to encrypt the content of a directory in a container with an ext4 filesystem using cryptsetup. The size of the container should be as small as possible and as big as necessary, because I only ...
3
votes
1answer
1k views

How to open multiple LUKS volumes with key entered in initramfs?

I have a Debian 7.4 (stable) based server configured to use an encrypted (RAID1 + LVM) root partition (/boot is un-encrypted regular partition) to which I installed dropbear SSH server so I can ...
3
votes
0answers
418 views

remap read-only LUKS partition to read-write

cryptsetup can be invoked with --readonly or -r option, which will set up a read-only mapping: cryptsetup --readonly luksOpen /dev/sdb1 sdb1 Once I have opened a device as read-only, can I later ...
3
votes
1answer
546 views

Followed SSD-optimization advice, now root partition won't mount rw

Tonight I decided I wanted to tweak the configuration of my Debian install on my netbook (Ideapad S10-2) to work better with the SSD I put in it. I have done this before and never had any issues but ...
2
votes
2answers
82 views

Backed up over wrong hard drive

I've just written over the wrong hard drive using the command: sudo sh -c 'pv /dev/sdb >/dev/sdc' How do I go about undoing this? I was creating the first even backup of the drive, and I backed ...
2
votes
2answers
309 views

Detecting the device of a crypto mount

I have an external eSATA-hdd on an OpenSUSE 12.2 system. The external hdd has an LVM on a dm-crypt partition. I mount it by powering it up and then doing rescan-scsi-bus.sh cryptsetup -v luksOpen ...
2
votes
2answers
95 views

Change encrypted partition UUID

I'm trying to change a partition's UUID, the problem is that I'm trying to change an encrypted volume. So I can't use the usual method described here. Since it throws the following error: tune2fs: ...
2
votes
1answer
240 views

Cloning a root partition onto a dm-crypt encrypted one

I have Gentoo Linux installed on a 25.93GB/62.43GB partition /dev/sda4. The other partitions on the disk are 150MB /boot on /dev/sda1 and 56,66GB unused space on other two partitions. I am planning ...
2
votes
1answer
120 views

Are encrypted volumes more vulnerable to power loss?

I have some encrypted volumes that I use with my Xubuntu machine. One volume is a container file that is mapped to /dev/loop0 and encrypted using plain dm-crypt; another volume is a USB hard drive ...
2
votes
1answer
392 views

Dm-Crypt system encryption with different keys per user

I have found the following example configuration for a system encryption: Example 5: paranoid system encryption • whole hard drive encrypted with dm-crypt+LUKS └──> unlocked before boot, ...
2
votes
1answer
248 views

Filesystem types for encrypted partitions

I wish to encrypt two external hard drives using dm-crypt/LUKS for whole-disk encryption. I want one hard drive to have an ext4 filesystem for Linux use only, and the other to have an NTFS filesystem, ...
2
votes
1answer
1k views

Fast encryption for home directory with Scientific Linux (ala' RedHat)

I have a T61 with C2D T7300 CPU/4 GByte RAM. I has SL 6.3 on it, and I ticked the encrypt VG during install. If I start a "normal" windows xp on it, its ~slow.. so.. I need a little performance boost ...
2
votes
1answer
327 views

RHEL Error message mounting luks crypted filesystem at boot

I am configuring a luks crypted file system to be mounted at boot time using RHEL 6.5 I did all the configuration from command line and tt worked but printed an error message after asking for ...
2
votes
0answers
387 views

How can I mount a dm_crypt device during boot, it fails all the time

EDIT: Problem solved, i updated from Debian 6.0.6 to 7.0.0, everything works now! I have a complex problem at booting. Basically, I have a debian apache box, as a music server in my home network. The ...
1
vote
2answers
448 views

Does DM-Crypt partition look like random noise?

If I format partition with dm-crypt does its entry in partition table suggest somehow that this partition is encrypted or for someone from outside it looks like regular partition with random noise ...
1
vote
2answers
1k views

How can I extract the hash value of a LUKS device?

For LUKS devices I know that hashes are stored somehow in the partition header (I don't really know what this means). But I don't know how to print the hash value in this case. For example in a ...
1
vote
1answer
1k views

Debian, Apache, 403 Forbidden Errors and Encrypted Drives

I have set up Apache on my local Debian Jessie installation but can not get my VirtualHost to work. Accessing http://localhost works just fine and shows me the It works! page. But when trying to ...
1
vote
1answer
293 views

Cryptsetup: pre-fill the partition with random data

It says it is an optional step, but it is recommended to do this, it improves encryption to pre-fill the partition with random data. What brings security filled with random data? Is it more difficult ...
1
vote
2answers
413 views

How to debug/audit which devices cache writes?

I store documents on btrfs partition built upon sparse dm-crypt device located on ext4 main partition on physical harddrive. When kernel panics (and this happens on daily basis on my ASUS P53E with ...
1
vote
1answer
2k views

cryptsetup luksOpen only accepts password via ssh

while installing my Gentoo system I encoutered a strange error. One of my disk is encrypted, I have done all the installation via ssh, so did I enter the encryption passphrase via ssh. Now I entered ...
1
vote
1answer
750 views

lvmetad is not active yet, using direct activation during sysinit

I get the following error message at boot, just before being asked for my master password to access to my encrypted hard-drive (using dm-encrypt): lvmetad is not active yet, using direct activation ...
1
vote
1answer
24 views

Linux Volume Encryption: Possible to specify your own Encryption Tool?

I want to use Volume Encryption on my Debian machine. Linux does have such a tool for that. But I want to use my own encryption tool to encrypt a partition. Now, is it somehow possible to specify it ...
1
vote
1answer
740 views

mount luks volume through pam with gdm

I'm on debian testing. I encrypted my /home with dm-crypt (luks). Following various tutorials I setup pam_mount to open it at login time. However when I try to login using gdm, it fails. The login ...
1
vote
1answer
557 views

mounting an encrypted dm-raid partition on login

I have a dm-raid1 with a LUKS encrypted partition md0 on it and I would like it to be mounted automatically when I login, using pam_mount. So far I have configured the pam_mount.conf.xml as follows: ...
1
vote
0answers
14 views

Boot Entry for Loading Encrypted LVM

So, I recently installed Arch Linux (EFI) with the root folder in an encrypted LVM. I am loading the correct modules and hooks on startup, but it's telling me it can not load the encrypted space after ...
1
vote
0answers
26 views

I think my hibernation image in the encrypted swap partition is corrupted?

I have a hard drive with the below partition layout. I can suspend-to-ram and resume as well as pass all the pm_test (without actually writing the image to disk). However, when I do the actual ...
1
vote
0answers
18 views

How should the `crypto` kernel parameter be passed?

I've encrypted a root drive using a cipher with this format: <cipher>-<chainmode>-<ivmode>:<ivopt>. Let's call this [CIPHER] for short. To boot from this device, certain ...
1
vote
1answer
249 views

Massive disk corruption on Ubuntu 15.10 with dm-crypt + LUKS full disk encryption?

I suspect there's a bug in Ubuntu's default whole disk encryption setup. Here's what happens, repeatably: I make a fresh install, Ubuntu 15.10 with whole disk encryption, overwriting the whole disk ...
1
vote
1answer
72 views

Waiting long (few minutes) during boot for cryptsetup for password prompt

I have LVM on the top cryptsetup on my Debian unstable amd64. A week ago after upgrade my initramfs changed and now I have to wait few minutes at the beginning of the boot before cryptsetup asked for ...