Questions tagged [cryptsetup]

cryptsetup is a command-line utility for managing disk volumes encrypted using the dm-crypt kernel subsystem (Linux versions 2.6 up and DragonFly BSD).

Filter by
Sorted by
Tagged with
37 votes
3 answers
33k views

Using a single passphrase to unlock multiple encrypted disks at boot

My machine has an SSD, where I installed the system and an HDD, which I use as a storage for large and/or infrequently used files. Both are encrypted, but I chose to use the same passphrase for them. ...
user avatar
28 votes
2 answers
25k views

List open dm-crypt LUKS volumes

If I mount a simple loop device, losetup -a give me the devices opened. Is something similar possible with cryptsetup?
user avatar
  • 11k
26 votes
3 answers
82k views

Why my encrypted LVM volume (LUKS device) won't mount at boot time?

I'm trying to setup an encrypted volume following this guide Everything is setup but mounting the encrypted volume fails at boot-time with the error: fsck.ext4: No such file or directory while ...
user avatar
24 votes
1 answer
10k views

Abysmal general dm-crypt (LUKS) write performance

I am investigating a problem where encrypting a block device imposes a huge performance penalty when writing to it. Hours of Internet reading and experiments did not provide me with a proper ...
user avatar
  • 1,257
23 votes
5 answers
12k views

How can I set a label on a dm-crypt+LUKS container?

I just received a new USB flash drive, and set up 2 encrypted partitions on it. I used dm-crypt (LUKS mode) through cryptsetup. With an additional non-encrypted partition, the drive has the following ...
user avatar
21 votes
2 answers
37k views

How can I shrink a LUKS partition, what does `cryptsetup resize` do?

I am in progress of resizing a LUKS encrypted partition that contains a single ext4 filesystem (no LVM or something). The cryptsetup FAQ recommends to remove the old partition and recreate it, but ...
user avatar
18 votes
2 answers
28k views

How to determine what encryption is being used a LUKS partition?

What command can be used to determine the used encryption on a LUKS partition (all the relevant information, initialization vector, generation scheme, mode of operation and block cipher primitive)?
user avatar
  • 1,977
15 votes
1 answer
10k views

What does `cryptsetup resize` do if LUKS doesn't store partition size?

The LUKS / dm-crypt / cryptsetup FAQ page says: 2.15 Can I resize a dm-crypt or LUKS partition? Yes, you can, as neither dm-crypt nor LUKS stores partition size. I'm befuzzled: What is "...
user avatar
  • 24.9k
13 votes
4 answers
3k views

independently verify that TRIM indeed works on SSD

I have a LUKS partition /dev/sda1 which I luksOpen with --allow-discards: cryptsetup --allow-discards luksOpen /dev/sda1 root I then mount the ext4 filesystem with discard option: grep /dev/mapper/...
user avatar
13 votes
1 answer
6k views

Unable to close a Luks partition

For backup purposes, I have "snapshotted" a LVM partition. This partition was crypted so I have opened this Luks partition (snapshot) in order to do my backup. The problem is that I have forgotten to ...
user avatar
11 votes
5 answers
21k views

Unlock LUKS encrypted Debian root with key file on boot partition

I'm trying to decrypt the Debian root with a key file stored in the boot partition (decrypted partition). This will break the security, but it doesn't matter now. I have to conclude this successfully ...
user avatar
  • 111
11 votes
1 answer
8k views

crypttab and VeraCrypt

I dual boot Fedora and Windows Vista and want them to share a partition so that I can work on the same files in both Linux and Windows, and I need everything to be encrypted. I encrypted the shared ...
user avatar
  • 111
9 votes
2 answers
10k views

How to mount a cryptsetup container just with `mount`?

I created an encrypted container via #!/bin/bash dd if=/dev/zero of=$1 bs=1 count=0 seek=$2 MAPPER=$(mktemp -up /dev/mapper) LOOPDEV=$(losetup --find --show $1) cryptsetup luksFormat $LOOPDEV ...
user avatar
9 votes
1 answer
10k views

"cryptsetup: ERROR: Couldn't resolve device" combined with "cryptsetup: WARNING: target 'sda3_crypt' not found in /etc/crypttab"

After setting up hibernation on ubuntu 20.04 and modifying it that it works for encrypted swap partitions, I'm getting several issues: First, after rebooting from hibernation, I got "Gave up ...
user avatar
8 votes
1 answer
1k views

cryptdisks_start: precheck failed: the device contains a filesystem type crypto_LUKS

I'm trying to use cryptdisks_start to open a LUKS device that is defined in my /etc/crypttab. Unfortunately, the command fails with the following error message: martin ~ # cryptdisks_start luks-...
user avatar
8 votes
2 answers
14k views

Initramfs in debootstrap chroot of fully encrypted system

I'm working on a script to create a fully encrypted washable system from debootstrap. It's doing some good, but the initramfs image that comes out does not pick up the cryptroot properly. After ...
user avatar
8 votes
1 answer
7k views

LUKS storing keyfile in encrypted usb drive

I already asked once about LUKS unlocking of multiple HDDs in Linux: LUKS and multiple hard drives. Now I would like to know how to secure store the keyfile used for the automatic unlock of the ...
user avatar
  • 423
8 votes
1 answer
2k views

Trying to understand LUKS encryption

I decided to encrypt my root partition with LUKS+LVM. My ThinkPad setup: Samsung 830 128GB SSD 750GB HDD Core 2 Duo 2,5 GHz P9500 8GB RAM But the more I read, the less I understand about those two ...
user avatar
  • 510
8 votes
1 answer
3k views

How to open multiple LUKS volumes with key entered in initramfs?

I have a Debian 7.4 (stable) based server configured to use an encrypted (RAID1 + LVM) root partition (/boot is un-encrypted regular partition) to which I installed dropbear SSH server so I can ...
user avatar
  • 181
7 votes
3 answers
9k views

luksOpen doesn't decrypt with keyfile unless --key-file argument is provided

I have an encrypted volume for which I had initially set up a passphrase interactively, which works just fine to decrypt the partition. I added more keys using a keyfile in both the following ways: ...
user avatar
  • 71
7 votes
2 answers
2k views

How to decrypt LUKS-encrypted device on per user basis upon login?

I've created the following luks@.service service for systemd: [Unit] Description=Cryptography Setup for '%I' After=cryptsetup-pre.target After=dev-mapper-%i.device Before=cryptsetup.target Before=...
user avatar
6 votes
1 answer
10k views

Mount encrypted partition of an image file

I've an image backup file of my harddisk, which consists of three partitions (sudo fdisk -l /mnt/hdd/19_02.img): Device Start End Sectors Size Type /mnt/hdd/19_02.img1 ...
user avatar
  • 191
6 votes
1 answer
4k views

How to answer YES automatically with a cryptsetup luksFormat command?

How to run cryptsetup luksFormat non-interactively When LUKS formatting a partition, I recieve the message # cryptsetup luksFormat /dev/sdb WARNING! ======== This will overwrite data on /dev/sdb ...
user avatar
  • 71
6 votes
2 answers
5k views

remap read-only LUKS partition to read-write

cryptsetup can be invoked with --readonly or -r option, which will set up a read-only mapping: cryptsetup --readonly luksOpen /dev/sdb1 sdb1 Once I have opened a device as read-only, can I later re-...
user avatar
6 votes
2 answers
5k views

LUKS discard/TRIM: conflicting kernel command line options

I'm confused between the various ways that LUKS/dmcrypt/cryptsetup discard /TRIM operations can be enabled via the Linux kernel command line. The dracut manpage: rd.luks.allow-discards Allow ...
user avatar
  • 24.9k
6 votes
1 answer
397 views

Cryptsetup not finding libgcrypt.so after upgrade

I am running a Fedora Core 13 with dm-crypt + luks, all standard with fedora distos. After upgrading libgcrypt.so, cryptsetup moans at boot up that it can not find the library where it expects it to ...
user avatar
5 votes
1 answer
2k views

dmsetup luksFormat creating an alignment inconsistency

When unlocking a newly-formatted LUKS volume, I received a warning in the kernel log: kernel: device-mapper: table: 253:14: adding target device sdk1 caused an alignment inconsistency: ...
user avatar
  • 102k
5 votes
3 answers
2k views

error mounting truecrypt disk with cryptsetup

Trying to use cryptsetup to mount a drive encrypted with truecrypt. Doing this: sudo cryptsetup open --type tcrypt --readonly /dev/sdc1 encrypted_drive and then typing the passphrase gives me: ...
user avatar
5 votes
1 answer
2k views

Why is my LUKS partition mounted without asking for a passphrase?

On my system, I have two encrypted disks: crypt containing the root partition of raspbian stretch usb-crypt is an external usb disk. LVM is used on that disk. Both disks are protected using the same ...
user avatar
  • 53
5 votes
1 answer
17k views

How to interpret `cryptsetup benchmark` results?

Summary: I can run cryptsetup benchmark and sort the results, but seek guidance in their interpretation. E.g., should I give more weight to encryption speed or decryption speed? Should key-derivation ...
user avatar
  • 1,175
5 votes
2 answers
1k views

Creating a large file with random content: short-cut by copying?

Assume I want to create a large encrypted drive stored in a file using cryptsetup, the first step is to create a random file, assume this should be of size 3T: dd if=/dev/urandom of=$FILE bs=1G count=...
user avatar
  • 265
5 votes
1 answer
4k views

cryptsetup: dm-crypt plain mode using keyfile AND passphrase

I feel a keyfile and a passphrase provide different benefits. They can not be obtained in the same way (one you need to physically acquire, the other one you need to know). Thus, I think there is ...
user avatar
  • 1,603
5 votes
1 answer
2k views

Grub2/LUKS How to avoid to type the passphrase twice?

I am on the latest OpenSUSE Tumbleweed and this guide has not worked for me. I did everything like in the guide except I did not generate a new random key and added it to the harddisk but used the ...
user avatar
5 votes
1 answer
335 views

Using space before 1st partition of USB-Stick as luks key

I'm using arch linux with an encrypted luks root partition (boot unencrypted), with a passphrase yet. Now I have a keyfile (3072 bytes), that's written to USB-Stick this way: sudo dd if=tempKeyFile....
user avatar
5 votes
1 answer
7k views

Booting encrypted root partion fails after system update

I have a problem booting my Debian Linux server. After a system update, GRUB loads the initrd and the system should ask for the password, but it doesn't. Instead, I get dropped to BusyBox. After ...
user avatar
  • 105
5 votes
1 answer
4k views

LUKS passphrase doesn't work

One day, when I turned on the computer, my passphrase for home part /dev/sda7 doesn't worked (I am 147% absolutely sure, that I was writing right pass)! After three times of tries, I have rebooted ...
user avatar
4 votes
5 answers
2k views

Open: cryptsetup out of memory ("Not enough available memory to open a keyslot.")

I am working on my yocto distribution including cryptsetup in the 2.3.2 version I am running such distribution on a board with 1 GB RAM and I am incurring in an "out of memory" error trying ...
user avatar
  • 351
4 votes
2 answers
4k views

How can I create multiple partitions in a LUKS container using a gpt/mbr partition table in the container?

Is it possible to have multiple partitions in a single LUKS or cryptsetup container? If so, how?
user avatar
  • 899
4 votes
4 answers
3k views

Cryptsetup: failed to attach a loop-back device

I am using cryptsetup with detached header. For that I am using the --header parameter, to specify header file. I can open my device using: cryptsetup luksOpen /dev/sdb1 sdb1 --header LUKS-HEADER ...
user avatar
4 votes
3 answers
5k views

How much storage overhead comes along with cryptsetup and ext4?

I want to encrypt the content of a directory in a container with an ext4 filesystem using cryptsetup. The size of the container should be as small as possible and as big as necessary, because I only ...
user avatar
  • 178
4 votes
2 answers
2k views

Can a systemd dependency be applied only to a unit's "ExecStart" action?

I have a scenario where a number of storage volumes are encrypted using keys contained on a removable encrypted USB "keyring" flash drive. I am running Arch Linux and this question is about systemd ...
user avatar
  • 6,698
4 votes
1 answer
1k views

Arch Linux Setup with Encryption (LVM on LUKS)

I'd like to setup Arch Linux with encryption. I found the tutorial on the Arch wiki, and think that the second option (LVM on LUKS) is the best option for me. Here's the partitioning I'd like to use (...
user avatar
4 votes
1 answer
13k views

`cryptsetup luksOpen <device> <name>` fails to set up the specified name mapping

HardenedArray has a helpful archlinux-installation guide at Efficient Encrypted UEFI-Booting Arch Installation. However, I encountered difficulty early in the installation process -- specifically, at ...
user avatar
4 votes
0 answers
2k views

Cryptsetup hanging after passphrase entered

I am currently looking to recover some data for a friend from an internal HDD removed from a laptop that they had encrypted using LUKS. They can't really tell me much more else as somebody else ...
user avatar
4 votes
0 answers
4k views

Accessed a TrueCrypt container without TrueCrypt. What dangers await?

I've got a TrueCrypt volume. In light of the unexpected demise of TrueCrypt, I've been trying to figure out what to do (reading lots of HOWTO websites). I'd like something that is simple and can work ...
user avatar
3 votes
1 answer
255 views

How to modify -iter-time on a existing luks partition

first of all I already read this topic : How to change the hash-spec and iter-time of an existing dm-crypt LUKS device? where the proposal is the following command : cryptsetup-reencrypt --keep-key ...
user avatar
3 votes
2 answers
3k views

What are the --use-urandom or --use-random options in LUKS used for?

I'm currently trying to teach myself some non-Windowsland operating systems, and I figured Ubuntu Server 16.04 would be the best place to start. Having "mastered" LVM, I'm trying to familiarize ...
user avatar
  • 33
3 votes
1 answer
4k views

Difference between cryptopts and crypttab

I'm setting up an encrypted root fs, which I've done before, but this time I'm using a PGP-encrypted keyfile with a symmetric password to familiarize myself with the process. There are two places ...
user avatar
  • 35.8k
3 votes
1 answer
741 views

How can move a LUKS container from the middle of a partition to the beginning?

For the tl;dr, skip to the bottom. I have a dual-boot setup with Mac OS X at the beginning of my drive and three GNU/Linux partitions at the end of the drive. I don't have the relevant machine on ...
user avatar
  • 14.1k
3 votes
1 answer
762 views

Mounting external hard drive using LUKS2 and FIDO2 Key

I have encrypted an external hard drive using LUKS2 on my machine running Fedora 34 using the cryptsetup command. When I now plug in the hard drive and enter the passphrase, the drive is unlocked ...
user avatar
  • 33

1
2 3 4 5