LUKS (Linux Unified Key Setup) is a disk-encryption specification.

learn more… | top users | synonyms

18
votes
1answer
2k views

Change password on a LUKS filesystem without knowing the password

I have a Debian Wheezy server that's been running for a while with an encrypted drive. The password for the encrypted drive (/dev/sda5) was lost when my encrypted password file was corrupted. I'd ...
10
votes
3answers
1k views

How to open a port early in boot process to unlock LUKS via SSH

I have a fully encrypted server running Debian 7 and have set up dropbear and busybox to unlock the LUKS container via SSH (as described in this tutorial and in this U&L answer). Unfortunately, ...
8
votes
2answers
4k views

How to mount a cryptsetup container just with `mount`?

I created an encrypted container via #!/bin/bash dd if=/dev/zero of=$1 bs=1 count=0 seek=$2 MAPPER=$(mktemp -up /dev/mapper) LOOPDEV=$(losetup --find --show $1) cryptsetup luksFormat $LOOPDEV ...
8
votes
1answer
3k views

Linux: LUKS and multiple hard drives

I have a Debian Linux system (amd64) installed on a RAID-1 system encrypted device (LVM on LUKS) and will have a RAID-6 of >=4 disks where I'll put my data (LUKS and maybe LVM). I think the basic ...
7
votes
1answer
225 views

Can Grub2 multi-boot LUKS/LVM distros with only one boot partition?

There are many tutorials on the internet for multi-booting unencrypted distros using a single boot partition and chainloading. For example, booting 145 OSes. Likewise, there are tutorials for ...
7
votes
1answer
126 views

Defending against the evil maid, how to handle removal of the /boot partition

When using LUKS full disk encryption, how would you go about protecting against evil maids ? The evil maid attack is when someone gets physical access to your computer while you're away and ...
6
votes
2answers
2k views

Which partitions should I encrypt?

My laptop is currently running Windows and Fedora, but I'm planning to install Arch Linux as my sole OS soon. This current setup is using whole disk encryption through TrueCrypt, but I'm unsure if it ...
6
votes
1answer
159 views

Cannot run cryptsetup throught SSH?

I'm trying to open a LUKS drive through SSH directly. ssh root@XX "cryptsetup luksOpen /dev/sdb3 secure But, no password prompt and it stuck. debug1: Sending command: cryptsetup luksOpen /dev/sdb3 ...
6
votes
1answer
638 views

Trying to understand LUKS encryption

I decided to encrypt my root partition with LUKS+LVM. My ThinkPad setup: Samsung 830 128GB SSD 750GB HDD Core 2 Duo 2,5 GHz P9500 8GB RAM But the more I read, the less I understand about those ...
6
votes
1answer
482 views

How to have Linux wipe/randomize/sanitize RAM at shutdown?

For mysterious reasons I still double boot sometimes into Windows. My problem is that I fear that information may leak because the RAM memory is accessible to Windows. (the Linux partitions are ...
6
votes
2answers
758 views

How to choose LUKS encryption when installing RHEL 6?

With the default RHEL 6 installer, how can I choose the LUKS encryption? Afaik if I prepare the disk like cryptsetup luksFormat -c cast5-cbc-plain -s 128 /dev/$DEVICE could be the "fastest" ...
6
votes
1answer
82 views

LUKS key from known password?

I have a hard drive with Ubuntu 14.04 installation - root partition was encrypted with LUKS. I had some configuration problems and wanted to re-install Ubuntu but keep all my data so I moved all my ...
5
votes
2answers
2k views

RHEL6 LUKS with TPM support?

I'm surprised that this question is not asked more frequently, but (in RHEL) does LUKS support TPM's the way that Windows BitLocker does? If so, how is this feature implemented, and does it provide ...
5
votes
4answers
1k views

How to identify LVM-over-LUKS or LUKS-over-LVM

I recently installed Fedora 20. I don't recall what exact options I chose for encrypting the disk/LVM during installation. It installed fine and I can log in etc. Here is the situation I have: I ...
5
votes
3answers
903 views

Poor IO due to LUKS/Software RAID/LVM ordering?

I'm trying to determine if I should re-setup my RAID array due to poor IO performance. First off, the system: i7 920 4 4TB WD 5400 Green drives CentOS 6.3 host Secondly, the disk setup: ...
5
votes
1answer
7k views

How to remove LUKS encryption?

I tried removing LUKS encryption on my home directory using the following command: cryptsetup luksRemoveKey /dev/mapper/luks-3fd5-235-26-2625-2456f-4353fgdgd But it gives me an error saying: ...
5
votes
1answer
119 views

Why are logical volumes used with LUKS partitions?

All of the instructions I've seen on setting up a LUKS encrypted drive require using logical volumes to create root and swap partitions inside a LUKS device. Why not just put standard partitions ...
5
votes
1answer
30 views

Is there an unencrypted but signed filesystems?

I'm curious if there is a filesystem that's unencrypted, making it readable by anyone, but employs a digital signature scheme so as to require that writes be digitally signed. I suspect the answer ...
5
votes
1answer
1k views

Grub-install: embedding is not possible in Bios/GPT

I am struggling with setting up an encrypted NAS for some days now. The basic plan is to have btrfs on lvm on luks on raid1 with lvmcache in writeback mode thrown in for the root partition to reduce ...
5
votes
1answer
1k views

Umount all attached usb disks with a single command

Is there a (safe) way to umount all partitions on all attached usb devices (usb-hdds, usb-sticks) with a single commandline command, including several encrypted luks partitions? Only the partitions ...
4
votes
3answers
282 views

Can I overwrite LUKS partition with it's decrypted content?

I have HDD with my data (partial backup of most important data available on other HDD), currently it's formatted as Ext4 over LVM over LUKS. I want to remove LUKS layer, but reformatting and data ...
4
votes
2answers
715 views

Why does LUKS need to generate hash values?

If you create a new LUKS device, you can specify the option -hash and -iter-time. For example like this: sudo cryptsetup luksFormat --cipher aes-cbc-essiv:sha256 --key-size 256 --iter-time 2100 ...
4
votes
2answers
859 views

Are there more advanced LUKS key schemes, e.g. 2 of 3 keys needed?

It seems like the two main LUKS encryption options are: USB keyfile (see http://superuser.com/questions/149578/how-can-i-use-a-keyfile-on-a-removable-usb-drive-for-my-encrypted-root-in-debian) ...
4
votes
2answers
280 views

LUKS encryption for tape media?

I was wondering, if it was possible to use LUKS encryption with tape drives, QIC for instance. I'm using LUKS for USB drives and internal disks, even DVDs and CDROMs. But I was thinking of maybe ...
4
votes
2answers
673 views

How to change the hash-spec and iter-time of an existing dm-crypt LUKS device?

How can I change the hash-spec and iter-time of an existing dm-crypt LUKS device? Clearly I can pass the options if I create a new device, for example something like this: sudo cryptsetup ...
4
votes
1answer
616 views

How to decrypt an encrypted container via ssh without entering a passphrase while requiring some client authentication?

I log in to a server via public key authentication and then mount a container (using e.g. LUKS/dm-crypt or truecrypt). At the moment, I have to enter the container password manually. Is there a way to ...
4
votes
0answers
167 views

How to use a samba login to mount a luks container?

Our server has an (dm-crypt/LUKS) encrypted project directory which is currently mounted via SSH before its samba share can be accessed - and obviously no one remembers to unmount it afterwards. ...
3
votes
3answers
1k views

Best practice to backup a LUKS encrypted device

What's the fastest method to backup and restore a luks encrypted device (e.g. a full encrypted usb-device to a image-file). The usb-device can be decrypted/accessed. I'm looking for a solution to ...
3
votes
3answers
512 views

How can I get a HASH of the LUKS master key?

From: https://code.google.com/p/cryptsetup/wiki/FrequentlyAskedQuestions 6.15 Can I clone a LUKS container? You can, but it breaks security, because the cloned container has the same ...
3
votes
1answer
274 views

How can the root file system be accessed to launch cryptsetup to allow access to the root file system?

I have got laptop with full disk encryption. There is a /boot partion which is not encrypted and the other partition /dev/sda5 is. In order to decrypt, it asks me for the passphrase which is then ...
3
votes
1answer
9k views

How can I shrink a LUKS partition, what does `cryptsetup resize` do?

I am in progress of resizing a LUKS encrypted partition that contains a single ext4 filesystem (no LVM or something). The cryptsetup FAQ recommends to remove the old partition and recreate it, but ...
3
votes
1answer
303 views

cryptdisks_start: precheck failed: the device contains a filesystem type crypto_LUKS

I'm trying to use cryptdisks_start to open a LUKS device that is defined in my /etc/crypttab. Unfortunately, the command fails with the following error message: martin ~ # cryptdisks_start ...
3
votes
1answer
2k views

LUKS storing keyfile in encrypted usb drive

I already asked once about LUKS unlocking of multiple HDDs in Linux: LUKS and multiple hard drives. Now I would like to know how to secure store the keyfile used for the automatic unlock of the ...
3
votes
1answer
41 views

Recover LUKS partition after overwriting first few bytes of LUKS container? System still up!

I have a 1.5 TB partition of data, of which I accidentally overwrote some bytes at the beginning, due to a typo like: ssh somewhere command | dd of=/dev/sda3 // should have used quotes here, dd ...
3
votes
3answers
144 views

Can I use scrypt to hash for LUKS?

Can scrypt be used as the hashing algorithm for LUKS? Can I tune its parameters? How can I do this?
3
votes
1answer
1k views

How to set laptop screen brightness just after boot with full disk encryption

my girlfriend bought Lenovo Essential G500 i5-3230 and I installed Linux Mint 16 on it with full disk encryption. It is standard installation with encryption using dmcrypt and LUKS. But there is a ...
3
votes
1answer
420 views

Are remote LUKS volumes mounted locally with sshfs made visible to remote users?

I created an encrypted volume with LUKS and uploaded it to a remote directory on an untrusted host. I can mount it locally though. I first mount the remote directory locally with sshfs and then open ...
3
votes
1answer
1k views

How to salvage a lvm/luks install from custom install

I was battling with setting up a Mint install on an encrypted hard-drive, and I think I partially succeeded. But I cannot boot the system because some configuration is not correct, and since I'm a ...
3
votes
1answer
1k views

How to decrypt LUKS with the known master key?

From: https://code.google.com/p/cryptsetup/wiki/FrequentlyAskedQuestions CLONING/IMAGING: If you clone or image a LUKS container, you make a copy of the LUKS header and the master key will stay the ...
3
votes
1answer
355 views

Open luks-encrypted partition from virtual DomU LVM disk containing another LVM

I've gotten myself in a bit of a bind, here. A while ago I set up an encrypted Unbuntu 13.04 under Xen. It's virtual disk is an LVM LV. This LV was presented to the DomU as a (whole) physical disk ...
3
votes
1answer
42 views

Abysmal general dm-crypt (LUKS) write performance

I am investigating a problem where encrypting a block device imposes a huge performance penalty when writing to it. Hours of Internet reading and experiments did not provide me with a proper ...
3
votes
1answer
79 views

Unlock LUKS partition using keyfile without root access?

Is there any way to unlock LUKS partition using keyfile while not having root priviliges? (using sudo is not an option) I know that udisksctl can open LUKS partition, however it can do it only with a ...
3
votes
1answer
182 views

Meaning of fsync() in sshfs+LUKS setup

Background: I'm investigating methods for encrypted storage on untrusted machines. My current setup uses sshfs to access a LUKS-encrypted image on the remote machine, which is decrypted locally and ...
3
votes
1answer
154 views

Luks Partition Mounting After Removing From fstab

I have 3 encrypted partitions, one for /, one for /home, and one for swap. It seemed silly to me to type in my password 3 times, so I replaced the swap partition with a swap file on the encrypted ...
3
votes
1answer
636 views

How to open multiple LUKS volumes with key entered in initramfs?

I have a Debian 7.4 (stable) based server configured to use an encrypted (RAID1 + LVM) root partition (/boot is un-encrypted regular partition) to which I installed dropbear SSH server so I can ...
3
votes
0answers
82 views

adding encrypted /home in LVM/LUKS

I installed a new (debian) system to an SSD device. After standard install I want to mount /home on the internal HDD. To be able to ask the question, some details: On install I (manually) generated ...
3
votes
0answers
111 views

Replicate a complex partition structure with LUKS and LVM volumes

I have two external hard discs on an OpenSUSE 13.1 system. On one I have created a partition structure: An encrypted LVM partition (LUKS) Several volumes (10) on this LVM partition, some formatted ...
3
votes
0answers
355 views

forgot to luksClose usb persistent partition, is this a problem?

Following the Kali Linux documentation for "Adding USB Persistence with LUKS Encryption", I created a persistent partition and encrypted the volume with: cryptsetup --verbose --verify-passphrase ...
3
votes
1answer
743 views

BCache and disk encryption

I recently bought a new laptop with a 16Gb mSATA SSD cache drive. I haven't used that one yet. I have, however, opted for Ubuntu 13.04 with "Full Disk Encryption" for the main partition (is that ...
2
votes
2answers
273 views

after adding one more physical volume and enlarging logical volume, grub fails

Several years ago I installed Debian on my 500 GiB hard disk. During installation I chose to have encrypted filesystem. So installer created one small unencrypted boot partition (I guess that grub ...