LUKS (Linux Unified Key Setup) is a disk-encryption specification.

learn more… | top users | synonyms

5
votes
1answer
410 views

Trying to understand LUKS encryption

I decided to encrypt my root partition with LUKS+LVM. My ThinkPad setup: Samsung 830 128GB SSD 750GB HDD Core 2 Duo 2,5 GHz P9500 8GB RAM But the more I read, the less I understand about those ...
0
votes
0answers
358 views

Problem installing ArchLinux on LVM on a LUKS setup via archboot

I've used archlinux before, and I've decided to have it enccrypted. I use BIOS. I used the latest vesion of archboot. I made an LUKS setup, then made lvm volume group and two ext4 partition in it for ...
2
votes
1answer
877 views

parted: create new partition

I have a 3TB disk, and I understand I have to use parted if I want to create a partition bigger than 2TB. All right then. parted /dev/sdb (parted) mklabel gpt (parted) mkpart primary ...
3
votes
3answers
721 views

Best practice to backup a LUKS encrypted device

What's the fastest method to backup and restore a luks encrypted device (e.g. a full encrypted usb-device to a image-file). The usb-device can be decrypted/accessed. I'm looking for a solution to ...
3
votes
2answers
484 views

Why does LUKS need to generate hash values?

If you create a new LUKS device, you can specify the option -hash and -iter-time. For example like this: sudo cryptsetup luksFormat --cipher aes-cbc-essiv:sha256 --key-size 256 --iter-time 2100 ...
0
votes
2answers
460 views

How can I extract the hash value of a LUKS device?

For LUKS devices I know that hashes are stored somehow in the partition header (I don't really know what this means). But I don't know how to print the hash value in this case. For example in a ...
1
vote
1answer
313 views

How to change the hash-spec and iter-time of an existing dm-crypt LUKS device?

How can I change the hash-spec and iter-time of an existing dm-crypt LUKS device? Clearly I can pass the options if I create a new device, for example something like this: sudo cryptsetup ...
3
votes
0answers
112 views

How to use a samba login to mount a luks container?

Our server has an (dm-crypt/LUKS) encrypted project directory which is currently mounted via SSH before its samba share can be accessed - and obviously no one remembers to unmount it afterwards. ...
2
votes
0answers
71 views

luks single signon

I've got LUKS (Linux Unified Key Setup) running on a couple of my Linux boxes. I've looked online but haven't seen anyone document how to make it work in a single signon option, but was hoping ...
1
vote
1answer
258 views

Cannot mount filesystem under luks. Device does not exist

I made one big luks device and re-used it on my debian install, then i ran into some boot problems and i need to acess the filesystem. The problem is, i decrypt the luks device and when i try to ...
3
votes
1answer
240 views

How can the root file system be accessed to launch cryptsetup to allow access to the root file system?

I have got laptop with full disk encryption. There is a /boot partion which is not encrypted and the other partition /dev/sda5 is. In order to decrypt, it asks me for the passphrase which is then ...
1
vote
1answer
107 views

Can I migrate a LUKS partition from a passphrase to a keyfile?

The title says it all. Let's say I have a LUKS-formatted partition, and it's secured using the passphrase "test123". Can I migrate this partition to a key-based mechanism, without loss of data?
3
votes
1answer
205 views

cryptdisks_start: precheck failed: the device contains a filesystem type crypto_LUKS

I'm trying to use cryptdisks_start to open a LUKS device that is defined in my /etc/crypttab. Unfortunately, the command fails with the following error message: martin ~ # cryptdisks_start ...
2
votes
2answers
142 views

Any reason not to use LUKS on a backup drive?

I have my hard disk encrypted with LUKS, but I make regular backups to an unencrypted external harddrive. Is there any reason I shouldn't setup LUKS on my backup drive as well? Obviously, the big ...
3
votes
1answer
334 views

Are remote LUKS volumes mounted locally with sshfs made visible to remote users?

I created an encrypted volume with LUKS and uploaded it to a remote directory on an untrusted host. I can mount it locally though. I first mount the remote directory locally with sshfs and then open ...
1
vote
1answer
80 views

mount other encrypted volume on wrong password entry

I have fully encrypted my laptop using dm-crypt and luks. So If I start my laptop I was prompted for a password before init will start. This works just fine. The problem A possible attacker will ...
3
votes
1answer
258 views

Open luks-encrypted partition from virtual DomU LVM disk containing another LVM

I've gotten myself in a bit of a bind, here. A while ago I set up an encrypted Unbuntu 13.04 under Xen. It's virtual disk is an LVM LV. This LV was presented to the DomU as a (whole) physical disk ...
2
votes
2answers
205 views

Detecting the device of a crypto mount

I have an external eSATA-hdd on an OpenSUSE 12.2 system. The external hdd has an LVM on a dm-crypt partition. I mount it by powering it up and then doing rescan-scsi-bus.sh cryptsetup -v luksOpen ...
3
votes
1answer
564 views

BCache and disk encryption

I recently bought a new laptop with a 16Gb mSATA SSD cache drive. I haven't used that one yet. I have, however, opted for Ubuntu 13.04 with "Full Disk Encryption" for the main partition (is that ...
1
vote
1answer
178 views

Reading encrypted partition with broken LVM2 inside?

I overwrote some LVM2 metadata in much the same way as Recovering overwritten LVM metadata . That is, I attempted to install Debian 6.0.7 on a system with existing encrypted volumes and LVM2 volumes. ...
0
votes
1answer
205 views

How to remove LUKS auto-unlock?

Unfortunately my drive unlocks automatically. This makes the whole encryption useless. How do I turn off this annoying feature on a specified drive (e.g. /dev/x) ? The cryptsetup command I've found ...
1
vote
1answer
272 views

Dm-Crypt system encryption with different keys per user

I have found the following example configuration for a system encryption: Example 5: paranoid system encryption • whole hard drive encrypted with dm-crypt+LUKS └──> unlocked before boot, ...
1
vote
1answer
1k views

luksOpen: No key available with this passphrase

I've created a encrypted volume with LUKS at home and was looking to use it at work too. Unfortunately, that's not possible. Whyever, I'm unable to access the encrypted data on any other computer than ...
1
vote
0answers
31 views

How do I encrypt the main partition of a SIFT (Ubuntu 9.10 variant) install?

I've got SIFT (based on Ubuntu 9.10) installed on a work laptop. We're trying to encrypt the entire installation (root partition and swap), which is apparently doable using LUKS, but I'm having some ...
1
vote
2answers
366 views

Provide passphrase to plymouth ask-for-password from command line

I'm working on booting a headless server (Fedora 16), entering the passphrase to decrypt the root disk (LUKS) over SSH using dropbear. I've got dropbear all working: I can SSH to the server while it's ...
3
votes
1answer
2k views

LUKS storing keyfile in encrypted usb drive

I already asked once about LUKS unlocking of multiple HDDs in Linux: LUKS and multiple hard drives. Now I would like to know how to secure store the keyfile used for the automatic unlock of the ...
1
vote
1answer
170 views

Overwriting disk before encryption

I'm going to create encrypted lvm on my disk. As a encryption mechanism I choose dmcrypt with LUKS. Here's my question - should I overwrite (for security reasons) whole disk before creating encrypted ...
5
votes
1answer
118 views

Why are logical volumes used with LUKS partitions?

All of the instructions I've seen on setting up a LUKS encrypted drive require using logical volumes to create root and swap partitions inside a LUKS device. Why not just put standard partitions ...
2
votes
2answers
233 views

Automatically suspend luks volume after delay

Anyone have any ideas for how I can automatically do a luksSuspend on a luks volume after it's been unused for a certain amount of time. I was thinking of just scheduling a command with crontab or ...
1
vote
1answer
94 views

Prevent file access from hanging when luks volume is suspended

I've got a luks volume setup and mounted, and when not in use I suspend it with cryptsetup luksSuspend so it cannot be accessed. But if I forget it's suspended and try to do any kind of file access in ...
5
votes
1answer
5k views

How to remove LUKS encryption?

I tried removing LUKS encryption on my home directory using the following command: cryptsetup luksRemoveKey /dev/mapper/luks-3fd5-235-26-2625-2456f-4353fgdgd But it gives me an error saying: ...
2
votes
2answers
246 views

after adding one more physical volume and enlarging logical volume, grub fails

Several years ago I installed Debian on my 500 GiB hard disk. During installation I chose to have encrypted filesystem. So installer created one small unencrypted boot partition (I guess that grub ...
6
votes
2answers
605 views

How to choose LUKS encryption when installing RHEL 6?

With the default RHEL 6 installer, how can I choose the LUKS encryption? Afaik if I prepare the disk like cryptsetup luksFormat -c cast5-cbc-plain -s 128 /dev/$DEVICE could be the "fastest" ...
8
votes
2answers
4k views

How to mount a cryptsetup container just with `mount`?

I created an encrypted container via #!/bin/bash dd if=/dev/zero of=$1 bs=1 count=0 seek=$2 MAPPER=$(mktemp -up /dev/mapper) LOOPDEV=$(losetup --find --show $1) cryptsetup luksFormat $LOOPDEV ...
4
votes
1answer
552 views

How to decrypt an encrypted container via ssh without entering a passphrase while requiring some client authentication?

I log in to a server via public key authentication and then mount a container (using e.g. LUKS/dm-crypt or truecrypt). At the moment, I have to enter the container password manually. Is there a way to ...
0
votes
1answer
867 views

grub2 and cryptsetup

My root node is LUKS encrypted, and it uses a key file, instead of user input password to unlock it. I know in Grub2, I can use insmod cryptodisk insmod luks cryptomount -u <uuid> But I have ...
5
votes
1answer
1k views

Umount all attached usb disks with a single command

Is there a (safe) way to umount all partitions on all attached usb devices (usb-hdds, usb-sticks) with a single commandline command, including several encrypted luks partitions? Only the partitions ...
3
votes
1answer
1k views

How to salvage a lvm/luks install from custom install

I was battling with setting up a Mint install on an encrypted hard-drive, and I think I partially succeeded. But I cannot boot the system because some configuration is not correct, and since I'm a ...
6
votes
2answers
2k views

Which partitions should I encrypt?

My laptop is currently running Windows and Fedora, but I'm planning to install Arch Linux as my sole OS soon. This current setup is using whole disk encryption through TrueCrypt, but I'm unsure if it ...
3
votes
1answer
7k views

How can I shrink a LUKS partition, what does `cryptsetup resize` do?

I am in progress of resizing a LUKS encrypted partition that contains a single ext4 filesystem (no LVM or something). The cryptsetup FAQ recommends to remove the old partition and recreate it, but ...
4
votes
2answers
711 views

Are there more advanced LUKS key schemes, e.g. 2 of 3 keys needed?

It seems like the two main LUKS encryption options are: USB keyfile (see http://superuser.com/questions/149578/how-can-i-use-a-keyfile-on-a-removable-usb-drive-for-my-encrypted-root-in-debian) ...
11
votes
3answers
1k views

How to open a port early in boot process to unlock LUKS via SSH

I have a fully encrypted server running Debian 7 and have set up dropbear and busybox to unlock the LUKS container via SSH (as described in this tutorial and in this U&L answer). Unfortunately, ...
1
vote
1answer
3k views

Install Backtrack 5 r2 into running LUKS setup installed with ubuntu

One Harddisk (sda) Two Partions. With a working ubuntu running. 1) /boot 2) LVM with this virtual volumes/partions/ or whatever they are called inside: Swap Ubuntu Home Prepared for Backtrack Of ...
5
votes
1answer
3k views

Linux: LUKS and multiple hard drives

I have a Debian Linux system (amd64) installed on a RAID-1 system encrypted device (LVM on LUKS) and will have a RAID-6 of >=4 disks where I'll put my data (LUKS and maybe LVM). I think the basic ...
4
votes
2answers
2k views

RHEL6 LUKS with TPM support?

I'm surprised that this question is not asked more frequently, but (in RHEL) does LUKS support TPM's the way that Windows BitLocker does? If so, how is this feature implemented, and does it provide ...
4
votes
2answers
255 views

LUKS encryption for tape media?

I was wondering, if it was possible to use LUKS encryption with tape drives, QIC for instance. I'm using LUKS for USB drives and internal disks, even DVDs and CDROMs. But I was thinking of maybe ...