Questions tagged [cryptsetup]

cryptsetup is a command-line utility for managing disk volumes encrypted using the dm-crypt kernel subsystem (Linux versions 2.6 up and DragonFly BSD).

Filter by
Sorted by
Tagged with
0 votes
0 answers
44 views

run a date command before unlocking encrypted volume at startup

When the PC boots up I have to enter quite a long password to unlock the hard drive. Next, Debian proceeds to boot, and only once it has booted and I have then entered the login credentials can I see ...
cardamom's user avatar
  • 550
0 votes
1 answer
68 views

cryptsetup: "Walting for encrypted source device" when removing disk from RAID1

I'm under Debian 12 bookworm. Partition layout is as follows: sdX1 (EFI files) sdX2 (boot, md-raid1) sdX3 (root, dm-crypt, luks, md-raid1) As soon as i remove one of the disks and try to boot from a ...
benjaminvonderweiden's user avatar
1 vote
2 answers
64 views

How risky is it writing a mounted bitlocker decrypted windows ntfs partition

I setup up a multi os system with Windows11 and Linux. I found out, that it's possible to mount bitlocker encrypted ntfs windows partition (/dev/sda3 as root) from linux: cryptsetup bitlkDump /dev/...
Heinrich Elsigan's user avatar
0 votes
1 answer
49 views

Would there be a difference in running cryptsetup from a Ubuntu USB FD vs internal disk?

Meaning Ubuntu installed on a USB vs an HDD. Would it make a difference security wise, example speed with USB during luksFormat with the specified iter time? Or a difference running it through USB or ...
user avatar
2 votes
1 answer
62 views

how to close encrypted partition with nested partition table?

If I create an encrypted partition using cryptsetup cryptsetup -q luksFormat /dev/vdb3 /tmp/pwfile cryptsetup -d /tmp/pwfile luksOpen /dev/vdb3 pv00 and setup a nested gpt partition table on /dev/...
Harri's user avatar
  • 23
1 vote
1 answer
184 views

Encrypted LVM "is not a valid LUKS device", cannot boot or open

I have an Arch installation on a LUKS-encrypted LVM. After I installed Debian on a different NVME drive I'm no longer able to cryptsetup open the partition from other systems, nor can I boot into Arch....
lkjtigeve's user avatar
0 votes
0 answers
53 views

Command needed to mount a LUKS partition on ubuntu

Ubuntu - I need to mount my LUKS encrypted partitions in read only mode. Have searched online, but no commands have worked. $ lsblk SDA 8:0 0 5.5T 0 disk SDA1 8:1 0 1.4T 0 part Partition name 253:0 1....
fredtheoctopus's user avatar
0 votes
2 answers
237 views

Warning from cryptsetup-initramfs

Since today I get the following warning when running update-initramfs -u: cryptsetup: WARNING: The initramfs image may not contain cryptsetup binaries nor crypto modules. If that's on purpose, ...
Nicolas's user avatar
  • 135
0 votes
1 answer
294 views

Ubuntu 22.04 cryptsetup-reencrypt fails with "Cannot exclusively open /dev/mmcblk0p3, device in use"

I have an Ubuntu 22.04 system and need to change the LUKS encryption key and re-encrypt the data. This is the root filesystem, so I can't unmount it, and I don't have physical access to boot a live ...
Mr. T's user avatar
  • 109
0 votes
0 answers
32 views

cryptsetup create quits after a first password letter

I've got a simple script that's been used for years and years on one particular server to mount an encrypted home partition. It's got this line to create /dev/mapper/cr_sdb1: cryptsetup create cr_sdb1 ...
Fer Dah's user avatar
  • 51
0 votes
0 answers
153 views

grub still tries to mount cryptodisk by its old UUID after changing it

I have a Linux system with the following disk setup (MBR-formatted, BIOS-booted): sda 32G disk └─sda1 ...
Greendrake's user avatar
0 votes
1 answer
56 views

Return the root partition name with lsblk or similar when the partition is encrypted

This is my lsblk output: NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINTS nvme0n1 259:0 0 465.8G 0 disk ├─nvme0n1p1 259:1 0 512M 0 part /efi ├─nvme0n1p2 259:2 0 420G 0 ...
Polizi8's user avatar
  • 275
0 votes
0 answers
123 views

Can't open encrypted disk on new system?

I had a system running Arch Linux on an encrypted SSD using Btrfs and opened a secondary encrypted HDD on this system using a keyfile. The passphrase in the keyfile is also saved in my Keepass ...
dataprolet's user avatar
0 votes
1 answer
527 views

How to open all LUKS volumes with use of a single password?

I'm using EndeavorOS (basically Arch), but with systemd-boot and dracut for initrd. I have a simple setup with an unencrypted boot partition and LUKS-encrypted root and swap partitions. Specifically, ...
Snusifer's user avatar
  • 103
0 votes
1 answer
108 views

why is ssh breaking when I encrypt partition?

I am trying to create an encrypted partition for sensitive user data, on my Ubuntu server. Soft raid is set up on the server and I assume this is what is causing the problem. After the operating ...
Harry's user avatar
  • 1
2 votes
1 answer
512 views

How to increase the size of a LUKS file-container

There are many tips on how to resize (increase) a LUKS2 encrypted device / partition / LVM volume. But how to increase the size of the LUKS container created in the file? I once created: dd if=/dev/...
DarekH's user avatar
  • 77
1 vote
0 answers
153 views

Do cryptsetup encryption from user space, possibly as ordinary user

I have the duty to create a package format which has its contents compressed and encrypted and which can be mounted. I have modelled it to be a squashfs embedded in a cryptsetup raw device. Alas, this ...
glglgl's user avatar
  • 1,210
0 votes
0 answers
220 views

Properly detach the LUKS header from the existing FDE+LVM encryption

There are many other questions about the detached LUKS header here, but none solve my problem. I am attempting to relocate my existing included header from sda2 to a separate raw partition on device ...
DarekH's user avatar
  • 77
0 votes
0 answers
162 views

`cryptsetup open` fails with correct passphrase - "No key available with this passphrase."

I recently ran (essentially) rm -rf / --no-preserve-root on my LUKS encrypted BTRFS root filesystem. I'm trying to mount the drive from an endeavouros (arch) liveusb, without success. I created a ...
alles1232's user avatar
0 votes
1 answer
80 views

Does iteration time enhance the security?

I have created an encrypted partition with cryptsetup -i. Is it right that -i is not necessary as brute-force software can bypass the iteration time? I'm wondering if this is still the case or if it ...
auzyveyauzyvey's user avatar
0 votes
2 answers
581 views

How to mount VeraCrypt or TrueCrypt volumes with the boot password

For Windows, VeraCrypt implements a feature called "system favorite volumes".  It allows mounting additional discs with the password entered at boot to unlock the system partition. Specs: I ...
Honigmelone's user avatar
11 votes
1 answer
589 views

cryptsetup: verification in luksOpen is non-deterministic when reading the password from a file

I'm debugging a weird behavior of cryptsetup: Assume the correct password is stored in the file pw. I expected now that --test-passphrase would always succeed (i.e. printing no output) if it is passed ...
Philipp Claßen's user avatar
1 vote
0 answers
143 views

LUKS passphrase over ssh is not working

I am trying to decrypt a fully encrypted system using LUKS over SSH. I followed stinky parkia's guide to unlocking device over ssh. However, the password is not working. I am able to reach the prompt ...
atb00ker's user avatar
  • 121
1 vote
0 answers
533 views

Booting encrypted root with encrypted USB key

Running Debian 11 with grub, full disk encryption (no LVM) on /dev/sdb2, unencrypted /boot/efi on /dev/sdb1. At boot, I want two options: typing password plugging an encrypted USB key (which stores a ...
secu4tux's user avatar
2 votes
0 answers
467 views

Network Bound Disk Encryption (tang/clevis) Setup

I am trying to have NBDE on Ubunutu LTS 22.04.1 . basically i want my compute-1 node to auto decrypt on boot when it's able to ping controller (tang server) node. the problem is i encrypted every ...
Hoodad Tabibi's user avatar
1 vote
1 answer
169 views

Why does this udev rule cause cryptsetup to freeze?

I have this rule which runs a script to send me an email whenever a drive drops out of the system: SUBSYSTEM=="block", ACTION=="remove", ENV{DEVTYPE}=="disk",\ RUN=&...
Gooberpatrol66's user avatar
1 vote
1 answer
347 views

cryptsetup cannot initialize crypto backend from initramfs

I'm on an embedded Linux device and trying to open an encrypted squashfs for my rootfs. The image is created on the host (build agent) and from there I'm able to open and work with the content, so I ...
dangeroushobo's user avatar
2 votes
0 answers
75 views

Can't open dmcrypt drive after integrity error

I'm using dm-integrity on this drive using cryptsetup directly I formatted it with cryptsetup luksFormat --hash sha384 --cipher aes-xts-plain64 --integrity hmac-sha1. After a while I thing some data ...
testin3r's user avatar
0 votes
1 answer
100 views

How to implement "cryptseup isLuks" function using cryptsetup library APIs

In shell script $crypsetup isLuks /dev/sda1 Above command returns 0 -> for luks partition (encrypted partition) 1 -> non luks partitions (non encrypted partition). I have implemented disk ...
Arulananth Subramaniam's user avatar
1 vote
0 answers
155 views

Fast wideblock AES disk encryption in Linux?

I recently learned that Linux supports Adiantum as a disk encryption cipher (run cryptsetup benchmark -c xchacha20,aes-adiantum-plain64 to try it out on your system). While Adiantum is primarily meant ...
JanKanis's user avatar
  • 1,049
1 vote
1 answer
144 views

Unable to access or safely remove encrypted device

Details: I have a bootable encrypted HDD (running Linux mint). I have cryptsetup (2:2.4.3-1ubuntu1.1) installed on my main machine. I can access the unencrypted partition of the 1TB HDD. The system ...
Spock366373's user avatar
0 votes
1 answer
452 views

Full disk encryption stopped to boot a few days after adding a second disk

Recently I added a new disk to my computer. I had a free SATA slot, so nothing else changed. A few days after the disk was inserted the computer stopped to boot. I use Debian Bookworm. I have an ...
Max Görner's user avatar
3 votes
2 answers
1k views

Disable read/write workqueue for Ubuntu Full-Disk-Encryption

I am currently trying to set up multiple devices with Ubuntu (20.04.5 LTS) and the drive must be encrypted, so I used LUKS during the installation. (I checked "Use LVM with the new Ubuntu ...
Pascal Diu's user avatar
0 votes
0 answers
567 views

Cannot mount partition encrypted in place with `cryptsetup reencrypt`

I just encrypted an ext4 partition of my external hard drive with the following command: sudo cryptsetup reencrypt --encrypt /dev/sda2 --reduce-device-size 16MiB -N This finished successfully, if I ...
Daniel Porteous's user avatar
1 vote
1 answer
286 views

Why should copying luks headers with dd cause errors on the drive I am reading?

Summary of the problem. I want to use a detached luks header for a luks-encrypted block device, /dev/nvme0n1p1, by making it into a USB flash drive partition, and afterwards erasing the keys that are ...
Mikkel Rev's user avatar
-1 votes
1 answer
351 views

Is it safe to run cryptsetup luksOpen twice?

When I already have a LUKS block device opened using cryptsetup luksOpen, does invoking the command on the same machine with the same arguments including the device name for the second time just do ...
jiwopene's user avatar
  • 1,041
1 vote
0 answers
195 views

Delay before cryptsetup password prompt

I have an encrypted partition with the system. During boot, I have a pretty long delay between screen displaying messages and cryptsetup asking me for a password (around 10s) I can confirm that with ...
tkowal's user avatar
  • 123
0 votes
0 answers
670 views

Cryptsetup not accepting the VALID password

I'm at my wit's end here. I recently updated my distro. Something like 300+ packages were updated so trying to downgrade one by one would be a nightmare and so I'm trying to get this to work but my ...
ihatedistupgrades's user avatar
1 vote
1 answer
2k views

cryptsetup with LUKS: key size differences

When using cryptsetup with LUKS, the manual uses the terms "key" and "size" multiple time, for example: --keyfile-size (in bytes) --key-size (in bits) The allowed values for --key-...
Dor's user avatar
  • 2,525
3 votes
1 answer
3k views

Ubuntu 20.04 clevis-luks setup auto unlocking not working

I have an Ubuntu 20.04 machine setup that I am trying to configure for disk encryption. I am trying to setup auto unlock, but my configuration has not worked so far, and I am always prompted for a ...
Niru's user avatar
  • 141
0 votes
0 answers
177 views

How to repair or at least analyse non booting debian?

I have an Acer Swift 3 with a Kingston NVMe SSD that worked under Debian 1x until last week. At that time I ran Tails, rebooted and ... was not able to get into grub anymore. Acer: "No drive ...
Stefan Bollmann's user avatar
1 vote
0 answers
293 views

cryptsetup mistake and fixing a start job is running for no time limit

I was messing with cryptsetup to mount a LUKS encrypted volume automatically without prompting for a passphrase (which I was successful in doing) however I naively deleted everything in /etc/ccryptab ...
ron's user avatar
  • 6,515
1 vote
2 answers
531 views

Can I backup LUKS encrypted partition with fsarchiver?

When installing Elementary OS, I've chosen too small a size for /boot and it constantly bites me when doing updates. The rest of the drive is a single LUKS encrypted root partition: lsblk --fs NAME ...
tkowal's user avatar
  • 123
1 vote
0 answers
139 views

Error "File System Loop Detected" Permission Denied to Decrypt folder with ecryptfs-recover-private

I'm trying to open encrypted files from a full encrypted drive that is unlocked and mounted. I have tried various commands and have been unsuccessful. How can we fix the find "file system loop ...
Defcon's user avatar
  • 33
2 votes
0 answers
656 views

How to make boot drive encryption work with PKCS#11 Smart card in Fedora (35)

On Fedora Workstation 35 here. systemd v249 I am trying to unlock root LUKS volume with smart card on BOOT, but it does not work. I added to /etc/crypttab mydisk UUID=496e1cd5-712f-44ab-ad02-...
Boris Hamanov's user avatar
4 votes
1 answer
2k views

How to modify -iter-time on a existing luks partition

first of all I already read this topic : How to change the hash-spec and iter-time of an existing dm-crypt LUKS device? where the proposal is the following command : cryptsetup-reencrypt --keep-key ...
prog-amateur's user avatar
0 votes
1 answer
332 views

arch - /run/cryptsetup missing while formatting luks partition

I'm relatively new to linux and I have just wiped my drive and I am installing arch linux from the start. When I run: cryptsetup luksFormat /dev/sda3 I get the following warning: WARNING: Locking ...
Obtuse's user avatar
  • 3
1 vote
0 answers
598 views

Why are LUKS partitions so slow?

I created a LUKS partition using cryptsetup's default values (cryptsetup 2.3.6). Read speed on the device: # cat /dev/md/thedev | pv > /dev/null yields ~1GiB/s. Reading from the encrypted ...
IdleMaster's user avatar
0 votes
1 answer
2k views

Remove Cryptsetup LUKS encryption [duplicate]

I wanted to encrypt a flash drive but it didn't went well. Then I tried to remove the encryption but I am unable to do it. Here is some info: LUKS header information Version: 2 Epoch: ...
Ethan0456's user avatar
1 vote
1 answer
313 views

Data-loss safety of "cryptsetup luksOpen <root device>" between suspend and resume

I'm setting up suspend-to-disk and resume in an 2021.12.x Arch Linux install. My question is about safely (without data-loss) unlocking partitions when resuming. Here is my configuration. The ...
nishanthshanmugham's user avatar

1
2 3 4 5