I have several servers each with at least six dm-crypt partitions. I would like to have an automated way to make sure I always have a luks header backup stored in a safe place. I've been making header backups manually until now. My problem with that is that I tend to forget to make a new luks header backup when I have to swap out a hard drive or make other system changes.
I'm looking for an existing script that will check to see if a luks header backup exists, and if not, create one. I have to assume somebody has written such a script already. (The need for it seems obvious.)
If one does not exist, I'll attempt to make a bash script for the purpose.
My manual commands look like this:
cryptsetup luksHeaderBackup /dev/sdXN --header-backup-file /path/to/backup/$mountpoint_luksHeader_$devUUID.img
I would like to have both the mountpoint and the device UUID in the file name of the header image file.
The only clue I have about getting started is that I would need to iterate through all devices and find the partitions of type
crypt, then find the corresponding mount point and UUID. I know most of that info exists in lsblk and blkid. I'm not sure how to extract it for use in a script.
EDIT: my goal is to name the files intelligently, based on mount points.
Each crypto_LUKS device contains one or more BTRFS subvolumes. For example, the crypto_LUKS device
sysluks contains four btrfs subvolumes which are:
lsblk gives output like this, where only the last of those subvolumes to be mounted is shown as the mountpoint:
NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT sda 8:0 0 1.8T 0 disk └─sda2 8:2 0 1.8T 0 part └─sysluks 254:0 0 1.8T 0 crypt /var/log/.snapshots
/var/log/.snapshots as the name of the file that contains the backup for the root device is not ideal.
findmnt -t btrfs will show all mountpoints for a given source (such as /dev/mapper/sysluks). Running a few local tests,
findmnt seems to always return a list ordered by mount order at system startup. Picking the first mount point from that list would work for my purposes of naming files, but picking the last, as
lsblk does, it never ideal.