Skip to main content

Questions tagged [cryptsetup]

cryptsetup is a command-line utility for managing disk volumes encrypted using the dm-crypt kernel subsystem (Linux versions 2.6 up and DragonFly BSD).

Filter by
Sorted by
Tagged with
0 votes
1 answer
17 views

EXT4 filesystem in LUKS container - container size calculation

On my Linux system I have a file "1gb.file" that is 1073741824 bytes in size. This file I'll put into a LUKS container ("1gb.file.crypt") with ext4 filesystem inside. What size ...
user447274's user avatar
3 votes
2 answers
264 views

Does crypttab's "key-slot" option mean LUKS will try that keyslot "only", or "first"?

I am following the Debian dev's guide to full disk encryption. I am currently on Section 4, step 3- editing /etc/crypttab. In the guide, in section 3 they set up keyslot 0 for something else and now ...
SuperDialga's user avatar
1 vote
1 answer
37 views

Using cryptsetup and mount without sudo

I'm trying to build a CLI to easily manage the backups I have on my hard drives. Currently I use LUKS to encrypt the drives and duplicity to manage the backup process, and I have a simple bash script ...
Nabiu's user avatar
  • 11
0 votes
0 answers
27 views

What is correct cipher name for the cryptsetup to use HCTR2 wideblock encryption?

By googling, trial and error I came up with the following string: cryptsetup benchmark -c aes-xctr-plain64 but I'm not sure whether it is correct. The cipher spec aes-xctr-plain64,polyval-generic ...
lvd's user avatar
  • 143
0 votes
0 answers
52 views

Why is the --integrity switch in cryptsetup luksFormat still considered experimental?

As of 2024, the --integrity switch in cryptsetup luksFormat is still marked as experimental in the cryptsetup manpage: WARNING: This extension is EXPERIMENTAL and requires dm-integrity kernel ...
dv_'s user avatar
  • 141
0 votes
0 answers
52 views

run a date command before unlocking encrypted volume at startup

When the PC boots up I have to enter quite a long password to unlock the hard drive. Next, Debian proceeds to boot, and only once it has booted and I have then entered the login credentials can I see ...
cardamom's user avatar
  • 592
0 votes
1 answer
258 views

cryptsetup: "Walting for encrypted source device" when removing disk from RAID1

I'm under Debian 12 bookworm. Partition layout is as follows: sdX1 (EFI files) sdX2 (boot, md-raid1) sdX3 (root, dm-crypt, luks, md-raid1) As soon as i remove one of the disks and try to boot from a ...
benjaminvonderweiden's user avatar
1 vote
2 answers
138 views

How risky is it writing a mounted bitlocker decrypted windows ntfs partition

I setup up a multi os system with Windows11 and Linux. I found out, that it's possible to mount bitlocker encrypted ntfs windows partition (/dev/sda3 as root) from linux: cryptsetup bitlkDump /dev/...
Heinrich Elsigan's user avatar
0 votes
1 answer
50 views

Would there be a difference in running cryptsetup from a Ubuntu USB FD vs internal disk?

Meaning Ubuntu installed on a USB vs an HDD. Would it make a difference security wise, example speed with USB during luksFormat with the specified iter time? Or a difference running it through USB or ...
user avatar
2 votes
1 answer
117 views

how to close encrypted partition with nested partition table?

If I create an encrypted partition using cryptsetup cryptsetup -q luksFormat /dev/vdb3 /tmp/pwfile cryptsetup -d /tmp/pwfile luksOpen /dev/vdb3 pv00 and setup a nested gpt partition table on /dev/...
Harri's user avatar
  • 23
1 vote
1 answer
438 views

Encrypted LVM "is not a valid LUKS device", cannot boot or open

I have an Arch installation on a LUKS-encrypted LVM. After I installed Debian on a different NVME drive I'm no longer able to cryptsetup open the partition from other systems, nor can I boot into Arch....
lkjtigeve's user avatar
0 votes
0 answers
77 views

Command needed to mount a LUKS partition on ubuntu

Ubuntu - I need to mount my LUKS encrypted partitions in read only mode. Have searched online, but no commands have worked. $ lsblk SDA 8:0 0 5.5T 0 disk SDA1 8:1 0 1.4T 0 part Partition name 253:0 1....
fredtheoctopus's user avatar
0 votes
2 answers
498 views

Warning from cryptsetup-initramfs

Since today I get the following warning when running update-initramfs -u: cryptsetup: WARNING: The initramfs image may not contain cryptsetup binaries nor crypto modules. If that's on purpose, ...
Nicolas's user avatar
  • 135
0 votes
1 answer
626 views

Ubuntu 22.04 cryptsetup-reencrypt fails with "Cannot exclusively open /dev/mmcblk0p3, device in use"

I have an Ubuntu 22.04 system and need to change the LUKS encryption key and re-encrypt the data. This is the root filesystem, so I can't unmount it, and I don't have physical access to boot a live ...
Mr. T's user avatar
  • 109
0 votes
0 answers
33 views

cryptsetup create quits after a first password letter

I've got a simple script that's been used for years and years on one particular server to mount an encrypted home partition. It's got this line to create /dev/mapper/cr_sdb1: cryptsetup create cr_sdb1 ...
Fer Dah's user avatar
  • 51
0 votes
0 answers
245 views

grub still tries to mount cryptodisk by its old UUID after changing it

I have a Linux system with the following disk setup (MBR-formatted, BIOS-booted): sda 32G disk └─sda1 ...
Greendrake's user avatar
0 votes
1 answer
71 views

Return the root partition name with lsblk or similar when the partition is encrypted

This is my lsblk output: NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINTS nvme0n1 259:0 0 465.8G 0 disk ├─nvme0n1p1 259:1 0 512M 0 part /efi ├─nvme0n1p2 259:2 0 420G 0 ...
Polizi8's user avatar
  • 285
0 votes
0 answers
169 views

Can't open encrypted disk on new system?

I had a system running Arch Linux on an encrypted SSD using Btrfs and opened a secondary encrypted HDD on this system using a keyfile. The passphrase in the keyfile is also saved in my Keepass ...
dataprolet's user avatar
0 votes
1 answer
1k views

How to open all LUKS volumes with use of a single password?

I'm using EndeavorOS (basically Arch), but with systemd-boot and dracut for initrd. I have a simple setup with an unencrypted boot partition and LUKS-encrypted root and swap partitions. Specifically, ...
Snusifer's user avatar
  • 103
0 votes
1 answer
130 views

why is ssh breaking when I encrypt partition?

I am trying to create an encrypted partition for sensitive user data, on my Ubuntu server. Soft raid is set up on the server and I assume this is what is causing the problem. After the operating ...
Harry's user avatar
  • 1
2 votes
1 answer
905 views

How to increase the size of a LUKS file-container

There are many tips on how to resize (increase) a LUKS2 encrypted device / partition / LVM volume. But how to increase the size of the LUKS container created in the file? I once created: dd if=/dev/...
DarekH's user avatar
  • 97
1 vote
0 answers
190 views

Do cryptsetup encryption from user space, possibly as ordinary user

I have the duty to create a package format which has its contents compressed and encrypted and which can be mounted. I have modelled it to be a squashfs embedded in a cryptsetup raw device. Alas, this ...
glglgl's user avatar
  • 1,210
0 votes
0 answers
320 views

Properly detach the LUKS header from the existing FDE+LVM encryption

There are many other questions about the detached LUKS header here, but none solve my problem. I am attempting to relocate my existing included header from sda2 to a separate raw partition on device ...
DarekH's user avatar
  • 97
0 votes
1 answer
100 views

Does iteration time enhance the security?

I have created an encrypted partition with cryptsetup -i. Is it right that -i is not necessary as brute-force software can bypass the iteration time? I'm wondering if this is still the case or if it ...
auzyveyauzyvey's user avatar
0 votes
2 answers
1k views

How to mount VeraCrypt or TrueCrypt volumes with the boot password

For Windows, VeraCrypt implements a feature called "system favorite volumes".  It allows mounting additional discs with the password entered at boot to unlock the system partition. Specs: I ...
Honigmelone's user avatar
11 votes
1 answer
615 views

cryptsetup: verification in luksOpen is non-deterministic when reading the password from a file

I'm debugging a weird behavior of cryptsetup: Assume the correct password is stored in the file pw. I expected now that --test-passphrase would always succeed (i.e. printing no output) if it is passed ...
Philipp Claßen's user avatar
1 vote
0 answers
170 views

LUKS passphrase over ssh is not working

I am trying to decrypt a fully encrypted system using LUKS over SSH. I followed stinky parkia's guide to unlocking device over ssh. However, the password is not working. I am able to reach the prompt ...
atb00ker's user avatar
  • 121
1 vote
1 answer
742 views

Booting encrypted root with encrypted USB key

Running Debian 11 with grub, full disk encryption (no LVM) on /dev/sdb2, unencrypted /boot/efi on /dev/sdb1. At boot, I want two options: typing password plugging an encrypted USB key (which stores a ...
secu4tux's user avatar
2 votes
0 answers
626 views

Network Bound Disk Encryption (tang/clevis) Setup

I am trying to have NBDE on Ubunutu LTS 22.04.1 . basically i want my compute-1 node to auto decrypt on boot when it's able to ping controller (tang server) node. the problem is i encrypted every ...
Hoodad Tabibi's user avatar
1 vote
1 answer
200 views

Why does this udev rule cause cryptsetup to freeze?

I have this rule which runs a script to send me an email whenever a drive drops out of the system: SUBSYSTEM=="block", ACTION=="remove", ENV{DEVTYPE}=="disk",\ RUN=&...
Gooberpatrol66's user avatar
1 vote
1 answer
437 views

cryptsetup cannot initialize crypto backend from initramfs

I'm on an embedded Linux device and trying to open an encrypted squashfs for my rootfs. The image is created on the host (build agent) and from there I'm able to open and work with the content, so I ...
dangeroushobo's user avatar
2 votes
0 answers
92 views

Can't open dmcrypt drive after integrity error

I'm using dm-integrity on this drive using cryptsetup directly I formatted it with cryptsetup luksFormat --hash sha384 --cipher aes-xts-plain64 --integrity hmac-sha1. After a while I thing some data ...
testin3r's user avatar
0 votes
1 answer
136 views

How to implement "cryptseup isLuks" function using cryptsetup library APIs

In shell script $crypsetup isLuks /dev/sda1 Above command returns 0 -> for luks partition (encrypted partition) 1 -> non luks partitions (non encrypted partition). I have implemented disk ...
Arulananth Subramaniam's user avatar
1 vote
1 answer
216 views

Fast wideblock AES disk encryption in Linux?

I recently learned that Linux supports Adiantum as a disk encryption cipher (run cryptsetup benchmark -c xchacha20,aes-adiantum-plain64 to try it out on your system). While Adiantum is primarily meant ...
JanKanis's user avatar
  • 1,131
1 vote
1 answer
178 views

Unable to access or safely remove encrypted device

Details: I have a bootable encrypted HDD (running Linux mint). I have cryptsetup (2:2.4.3-1ubuntu1.1) installed on my main machine. I can access the unencrypted partition of the 1TB HDD. The system ...
Spock366373's user avatar
0 votes
1 answer
571 views

Full disk encryption stopped to boot a few days after adding a second disk

Recently I added a new disk to my computer. I had a free SATA slot, so nothing else changed. A few days after the disk was inserted the computer stopped to boot. I use Debian Bookworm. I have an ...
Max Görner's user avatar
4 votes
2 answers
2k views

Disable read/write workqueue for Ubuntu Full-Disk-Encryption

I am currently trying to set up multiple devices with Ubuntu (20.04.5 LTS) and the drive must be encrypted, so I used LUKS during the installation. (I checked "Use LVM with the new Ubuntu ...
Pascal Diu's user avatar
0 votes
0 answers
646 views

Cannot mount partition encrypted in place with `cryptsetup reencrypt`

I just encrypted an ext4 partition of my external hard drive with the following command: sudo cryptsetup reencrypt --encrypt /dev/sda2 --reduce-device-size 16MiB -N This finished successfully, if I ...
Daniel Porteous's user avatar
1 vote
1 answer
353 views

Why should copying luks headers with dd cause errors on the drive I am reading?

Summary of the problem. I want to use a detached luks header for a luks-encrypted block device, /dev/nvme0n1p1, by making it into a USB flash drive partition, and afterwards erasing the keys that are ...
Mikkel Rev's user avatar
-1 votes
1 answer
412 views

Is it safe to run cryptsetup luksOpen twice?

When I already have a LUKS block device opened using cryptsetup luksOpen, does invoking the command on the same machine with the same arguments including the device name for the second time just do ...
jiwopene's user avatar
  • 1,071
1 vote
0 answers
210 views

Delay before cryptsetup password prompt

I have an encrypted partition with the system. During boot, I have a pretty long delay between screen displaying messages and cryptsetup asking me for a password (around 10s) I can confirm that with ...
tkowal's user avatar
  • 123
0 votes
0 answers
828 views

Cryptsetup not accepting the VALID password

I'm at my wit's end here. I recently updated my distro. Something like 300+ packages were updated so trying to downgrade one by one would be a nightmare and so I'm trying to get this to work but my ...
ihatedistupgrades's user avatar
1 vote
1 answer
2k views

cryptsetup with LUKS: key size differences

When using cryptsetup with LUKS, the manual uses the terms "key" and "size" multiple time, for example: --keyfile-size (in bytes) --key-size (in bits) The allowed values for --key-...
Dor's user avatar
  • 2,555
4 votes
1 answer
4k views

Ubuntu 20.04 clevis-luks setup auto unlocking not working

I have an Ubuntu 20.04 machine setup that I am trying to configure for disk encryption. I am trying to setup auto unlock, but my configuration has not worked so far, and I am always prompted for a ...
Niru's user avatar
  • 151
0 votes
0 answers
186 views

How to repair or at least analyse non booting debian?

I have an Acer Swift 3 with a Kingston NVMe SSD that worked under Debian 1x until last week. At that time I ran Tails, rebooted and ... was not able to get into grub anymore. Acer: "No drive ...
Stefan Bollmann's user avatar
1 vote
0 answers
340 views

cryptsetup mistake and fixing a start job is running for no time limit

I was messing with cryptsetup to mount a LUKS encrypted volume automatically without prompting for a passphrase (which I was successful in doing) however I naively deleted everything in /etc/ccryptab ...
ron's user avatar
  • 7,162
1 vote
2 answers
600 views

Can I backup LUKS encrypted partition with fsarchiver?

When installing Elementary OS, I've chosen too small a size for /boot and it constantly bites me when doing updates. The rest of the drive is a single LUKS encrypted root partition: lsblk --fs NAME ...
tkowal's user avatar
  • 123
1 vote
0 answers
168 views

Error "File System Loop Detected" Permission Denied to Decrypt folder with ecryptfs-recover-private

I'm trying to open encrypted files from a full encrypted drive that is unlocked and mounted. I have tried various commands and have been unsuccessful. How can we fix the find "file system loop ...
Defcon's user avatar
  • 33
2 votes
0 answers
695 views

How to make boot drive encryption work with PKCS#11 Smart card in Fedora (35)

On Fedora Workstation 35 here. systemd v249 I am trying to unlock root LUKS volume with smart card on BOOT, but it does not work. I added to /etc/crypttab mydisk UUID=496e1cd5-712f-44ab-ad02-...
Boris Hamanov's user avatar
4 votes
1 answer
3k views

How to modify -iter-time on a existing luks partition

first of all I already read this topic : How to change the hash-spec and iter-time of an existing dm-crypt LUKS device? where the proposal is the following command : cryptsetup-reencrypt --keep-key ...
prog-amateur's user avatar

1
2 3 4 5