Mounting LUKS from the command line

Question

When in nautilus or caja I click on the icon of an encrypted disk and enter my password, the underlying block device gets mapped to /dev/mapper/luks-$UUID and it gets mounted at/media/$USER/$DISK, no root password required. Is there a way to invoke this process from the command line, without GUI, including obviating sudo and having the mountpoint able to get unmounted again from GUI.

Answer 1

I don't know of a single-command way to do this. The GUI programs are doing a fair bit of interrogation of the disk to take the "right" approach and you'll need to do some of that work yourself. You don't need sudo, though, and I think the resulting sequence of events is relatively painless.

The Short Answer

Use udisksctl from the udisks2 package:

udisksctl unlock -b /path/to/disk/partition
udisksctl mount -b /path/to/unlocked/device

Your user account will need to be appropriately authorized in order for the above to work. On Debian and Ubuntu, that means adding your account to the plugdev group.

When you're done with the disk:

udisksctl unmount -b /path/to/unlocked/device
udisksctl lock -b /path/to/disk/partition
udisksctl power-off -b /path/to/disk/or/partition

How to Set Things Up

Here's how you can set things up (via the command line) to make the process of using the disk as painless as possible. I'll assume you want to use the entirety of the USB drive as a single filesystem. Other configurations will require modifications to the instructions. Caveat on variations: I haven't found a way to use LVM in the encrypted container that will allow an unprivileged account to disconnect everything. (I don't see a way to deactivate a volume group via udisksctl.)

For purposes of illustration, we'll say that the disk is /dev/sda. You'll need a name for the filesystem to make it easier to reference later. I'll use "example".

Partition the Disk

Run sudo parted /dev/sda and run the following commands:

mklabel gpt
mkpart example-part 1MiB -1s
quit

The mkpart command will probably prompt you to adjust the parameters slightly. You should be okay accepting its recommended numbers.

The partition will now be available via /dev/disk/by-partlabel/example-part.

Create and Mount the LUKS Partition

sudo cryptsetup luksFormat /dev/disk/by-partlabel/example-part

Go through the prompts.

sudo cryptsetup luksOpen /dev/disk/by-partlabel/example-part example-unlocked

The encrypted device is now available at /dev/mapper/example-unlocked. This is not going to be a permanent thing; it's just for the setup process.

Create Your Filesystem

Let's assume that the filesystem you're using is XFS. Pretty much any other traditional filesystem will work the same way. The important thing is to add a label that you can reference later:

sudo mkfs -t xfs -L example /dev/mapper/example-unlocked

The filesystem's block device can now be accessed via /dev/disk/by-label/example.

Set Filesystem Permissions

By default, the filesystem will be only accessible by root. In most cases, you probably want the files to be accessible by your user account. Assuming your account name is "user":

udisksctl mount -b /dev/disk/by-label/example
sudo chown user:user /media/user/example

Close Everything Down

udisksctl unmount -b /dev/disk/by-label/example
sudo cryptsetup luksClose example-unlocked

Use Your Filesystem

This is what you'll do regularly. After plugging in the USB drive,

udisksctl unlock -b /dev/disk/by-partlabel/example-part
udisksctl mount -b /dev/disk/by-label/example

If your user account is "user", the filesystem will now be mounted at /media/user/example.

To unmount the filesystem:

udisksctl unmount -b /dev/disk/by-label/example
udisksctl lock -b /dev/disk/by-partlabel/example-part
udisksctl power-off -b /dev/disk/by-partlabel/example-part

Now you can disconnect the USB drive.

Answer 2

The answer by asciiphil seems to me to be correct, and should be marked as such.

It starts, "I don't know of a single-command way to do this." I don't, either, and have opened a corresponding feature request. As a workaround, one can create a wrapper script to provide a single-command way to unlock and mount a partition.

Assuming you use Bash, save the script below as, e.g. unlock-and-mount, make it executable, and put it in a directory in your PATH. You will then be able to unlock and mount a device in one step with unlock-and-mount /dev/disk/by-id/my-device-part-X.

Warning: this relies on parsing the messages udisksctl sends to stdout, and upon the stability of the udisksctl command-line interface. This is fragile, according to the udisksctl man page, which says:

[This] program is not intended to be used by scripts or other programs - options/commands may change in incompatible ways in the future even in maintenance releases.

In the meantime, here is the script, which works for now:

#!/usr/bin/env bash
# A convenience wrapper around `udisksctl`.

# Trace execution 
set -x

# Abort on errors. (I find this helpful, despite the cautions given in
# http://mywiki.wooledge.org/BashFAQ/105 and
# http://mywiki.wooledge.org/BashFAQ/112 .)
set -e
set -u

# Define functions
die () {
    echo >&2 "$@"
    exit 1
}

# Validate input argument(s) 
[[ "$#" -eq 1 ]] || die "Exactly 1 argument required: path to partition ID. $# given"
[[ -b "$1" ]]    || die "$1 is not a block device"
[[ "$1" == /dev/disk/by-id/* ]] || die "$1 does not begin '/dev/disk/by-id/'"

# Unlock partition
unlockedpart="$(udisksctl unlock -b "$1" |\
 tail -n1 |\
 sed -e 's/^Unlocked \/dev\/[[:print:]]\+ as \([[:print:]]\+\).$/\1/' \
)"

# Mount unlocked partition
udisksctl mount -b "$unlockedpart"

Answer 3

This will use the key stored by Nautilus/Nemo:
gio mount -d /dev/dm-x

For details, see this answer.

Answer 4

On Debian you can use the definitions in /etc/crypttab and /etc/fstab:

cryptdisks_start <name>
mount <mountpoint>

umount <mountpoint>
cryptdisks_stop <name>