Questions tagged [disk-encryption]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
5 votes
1 answer
136 views

Is swapped memory encrypted on encrypted partitions?

If I installed Ubuntu on an encrypted ext4 partition, I normally have a /swapfile. Now I would expect that the swapped memory is also encrypted by default. However, the man-page of swapon says: The ...
user avatar
  • 181
0 votes
1 answer
20 views

Booting updated system with encrypted root partion fails

I've just updated my Debian system to Bullseye and using the 5.10.0-13-amd64 kernel can no longer access my encrypted root disc. I can still boot using previous version 5.4.0-0.bpo.2-amd64 kernel. The ...
user avatar
1 vote
1 answer
47 views

How to change a key stored on a keydisk so it can decrypt a drive on OpenBSD?

Following the guide from https://www.openbsd.org/faq/faq14.html#softraidFDEkeydisk I know how to encrypt a drive and store a key on a usb stick. Suppose I've lost a copy of the key or suspect someone ...
user avatar
  • 111
0 votes
1 answer
348 views

Decrypting a full disk LUKS encryption manually from initramfs

I recently installed a fresh Ubuntu 20.04 image on my laptop while doing so i chose a full disk encrpytion using a password. (I think it is LUKS but I do not know how to verify this). For some reason ...
user avatar
0 votes
0 answers
33 views

Please help me change my LUKS password

I have a terrible LUKS password and if that wasn't enough I also have to type it blindly with the wrong locale keyboard in a headless server. I want to change it to something else but I have a very ...
user avatar
0 votes
1 answer
25 views

Shrink partitionless filesystem

I have data on a disk that I want to encrypt by cloning the full filesystem of that disk (source) to a virtual block device (devicemapper/cryptsetup) based on an additional disk (target) of identical ...
user avatar
  • 1,895
3 votes
1 answer
329 views

Storage encryption on Linux desktop: LVM on LUKS or ZFS

I choose solution for storage encryption on Linux desktop. For years LVM on LUKS was a best option with superior performance and reliability. But ZFS on Linux actively develops new functions and now ...
user avatar
  • 141
0 votes
0 answers
20 views

Tool to manage multiple LUKS devices as a group

I'm looking for a program which can manage a whole "group" of drives that have LUKS containers with the same passphrase; unlocking and locking them (ideally also formatting and/or passphrase ...
user avatar
  • 333
0 votes
1 answer
50 views

Change mount location of an encrypted volume?

I've followed this page to make a partition encrypted. When I format the created luks volume I do this: root@M17A:/home/mike# sudo mkfs.ext4 /dev/mapper/cryptpart mke2fs 1.45.5 (07-Jan-2020) Creating ...
user avatar
  • 1,042
13 votes
2 answers
1k views

Bit Rot within LUKS Encryption

How does bit rot affect a LUKS container and the filesystem inside? Suppose you have a filesystem that is well suited to deal with bit rot. Now put it inside a LUKS container. In case bit rot ...
user avatar
  • 247
1 vote
1 answer
74 views

cant create encrypted usb drive on raspberry pi 4

I have a raspberry pi 4. I have followed the instructions at https://linuxconfig.org/usb-stick-encryption-using-linux I have created and recreated the partitions, tried fat32, apt, and gpt. I started ...
user avatar
1 vote
1 answer
91 views

Data-loss safety of "cryptsetup luksOpen <root device>" between suspend and resume

I'm setting up suspend-to-disk and resume in an 2021.12.x Arch Linux install. My question is about safely (without data-loss) unlocking partitions when resuming. Here is my configuration. The ...
user avatar
0 votes
0 answers
115 views

How can you change number of allowed password attempts for luks encrypted bootup?

I found out that luks encrypted bootup will accept up to 3 password attempts before failing. After 3 attempts, it thinks for a while and then shows text prompt: Warning: /dev/disk/by-uuid/...
user avatar
3 votes
2 answers
236 views

Automatically mount fulldisk encrypted disk without entering passphrase?

Some time ago I installed a linux Pop-OS (based on Ubuntu 20.04). All good so far. It's my secondary play-around box. I installed it with fulldisk encryption which prompts for a passphrase to decrypt ...
user avatar
0 votes
1 answer
193 views

Is it possible to enable dm-integrity on an existing LUKS/cryptsetup device?

I have a large LUKS2 device created with cryptsetup that holds an LVM2 with my root and other filesystems. The device is several TB in size and I don't have any others disks (or combinations of disks) ...
user avatar
  • 219
0 votes
0 answers
37 views

How do I change the cryptsetup background?

When I encrypt my disk/OS, GNU/Linux shows a screen or image on boot where you can type in your password. How do I edit that image/change it? I am currently on Debian, which includes a black ...
user avatar
3 votes
0 answers
21 views

Ignoring the SED encrypted drives until after booting is completed [closed]

I have an Ubuntu system which boots from a small NVME disk using software encryption, TPM, etc. to mitigate against data loss in case of theft. The system is interfaced with customised PCIe hardware ...
user avatar
  • 131
1 vote
0 answers
60 views

Cannot access encrypted root partition after moving it

I had a Windows laptop with an additional Manjaro installed, on /dev/sda6 (somewhere wedged between the Windows 10 main partition and the recovery partiton). The Manjaro partition is using ext4, with ...
user avatar
  • 247
2 votes
1 answer
656 views

Mounting external hard drive using LUKS2 and FIDO2 Key

I have encrypted an external hard drive using LUKS2 on my machine running Fedora 34 using the cryptsetup command. When I now plug in the hard drive and enter the passphrase, the drive is unlocked ...
user avatar
  • 23
3 votes
3 answers
238 views

Is it possible to encrypt sensitive data on a headless embedded device in a secure way?

My company works with Raspberry Pis, where all data (OS, our software, etc) is stored on an SD card. We configure these devices (load our software on them), and send them out into the field (an ...
user avatar
  • 193
0 votes
0 answers
193 views

bioctl: How to use both keydisk and passphrase?

Is it possible to use both a keydisk and a passphrase with encrypted bootable drive? I specified both keydisk and passphrase when creating the encrypted volume: # bioctl -c C -p /tmp/passphrase -k /...
user avatar
  • 330
0 votes
0 answers
46 views

Can I use TPM-based transparent storage encryption, and have a recovery key?

We have 100ish laptops that run Windows 10 Enterprise with full on Bitlocker encryption, but we want to go away from Windows. I looked at multiple distros but none (and no open-source product) can ...
user avatar
2 votes
1 answer
212 views

Encrypted LUKS volume does not accept password on boot after system freeze

My Laptop froze and after a hard shutdown the boot process won’t accept my disk encryption password anymore. I have a ‘standard’ luks-inside-lvm setup, generated while installing fedora, split in a /...
user avatar
  • 31
0 votes
0 answers
38 views

Can a filesystem be encrypted in such a way that only specific processes can access it?

I can certainly mount a filesystem and all the files in it as 700, but I want something even tighter than that. Let's say someone manages to get into my system, somehow. They'd be able to read just ...
user avatar
0 votes
0 answers
52 views

Encrypted rootfs on P2041 board

I'm trying to encrypt the rootfs on a bootable mSD on a P2041 board. My main reference is the Arch-Linux guide for encrypted roots under the "Luks on a partition" section. What I have done ...
user avatar
  • 351
1 vote
1 answer
987 views

LUKS + TPM2 + PIN

I am currently aware of two recent methods to bind a LUKS encrypted root partition to a TPM2: systemd-cryptenroll and clevis. Both of them seem to release the encryption key after successfully ...
user avatar
  • 95
5 votes
2 answers
353 views

What is the epoch of LUKS that is shown when running luksDump?

When you run luksDump on a LUKS device, I get this: $ sudo cryptsetup luksDump /dev/sda1 LUKS header information Version: 2 Epoch: 3 Metadata area: 16384 [bytes] Keyslots area: ...
user avatar
  • 2,106
2 votes
2 answers
93 views

How can hide the encrypted partition in gui?

I can encrypt my /dev/sdb4 with cryptsetup this way sudo apt-get install cryptsetup sudo umount /dev/sdb4 sudo cryptsetup --verbose --verify-passphrase luksFormat /dev/sdb4 sudo cryptsetup luksOpen /...
user avatar
  • 35
0 votes
1 answer
601 views

tang / clevis: automatic unlocking for luks device not triggered unless defined as _netdev

I've setup a server with luks devices (not used for root partition), they are listed in /etc/crypttab this way # <target name> <source device> <key file> <options> ...
user avatar
0 votes
2 answers
159 views

How do I get a self encrypting NVMe SSD partition to show up in /dev after unlocking it?

I've been spending some time working with self encrypting SSDs recently, and I am stuck on how to access drive contents after I've unlocked it. Normally with this drive, you would load a Preboot ...
user avatar
0 votes
1 answer
158 views

Only first slot password is valid during decryption of boot device while all others are valid while testing to open a device

I made a full encryption setup of Ubuntu 20.04 LTS according to this article. Due to it is highly recommended to add further passphrases to avoid loosing all data due to unavailability of the initial ...
user avatar
11 votes
4 answers
5k views

Is disk encryption without requiring a password at boot possible?

Is it possible to encrypt the boot disk but not require users to input a password when the system boots? I have some headless boxes in remote locations for which I cannot guarantee they will be ...
user avatar
  • 434
0 votes
1 answer
133 views

What is deleting my symlink to my USB luks partition upon cryptsetup luksOpen?

I wrote a new udev rule to create a symlink to a luks-encrypted partition on a USB flash drive when the drive is plugged in. The new udev rule I wrote does create the symlink to the USB drive's ...
user avatar
0 votes
1 answer
1k views

cryptsetup luksFormat error "Device /dev/nvme0n1p3 is in use. Can not proceed with format operation."

I've followed this guideline to the point where I encrypt the target partition: cryptsetup -h sha256 -c aes-xts-plain64 -s 512 luksFormat /dev/nvme0n1p3 Then, the error appears, even though I'd ...
user avatar
0 votes
1 answer
968 views

mounting NTFS bitlocker in linux

I use ntfs-3g from tuxera in RHEL/CentOS 7.9 to mount my windows 10 disk. I have linux installed on a separate disk when I use linux. mount -t ntfs-3g /dev/sdb3 /mywin10 However I do this on ...
user avatar
  • 4,101
2 votes
0 answers
117 views

How secure is it to suspend Linux (Fedora) while using whole disk encryption?

I have a full disk encryption on my Fedora 33 workstation. The purpose of encryption was protection from stealing the laptop physically. But how much more unsafe to just suspend the OS, not fully ...
user avatar
  • 21
0 votes
1 answer
56 views

Recovering deleted files on an encrypted drive

My drive is encrypted. I am running Fedora. I also have a Win 10 boot (not encrypted), if that's relevant) I accidentally ran rm -Rf * in the wrong folder - one in which I had a dozen or so small ...
user avatar
  • 135
2 votes
1 answer
187 views

is it possible to upgrade a distro (debian) in an Encrypted LVM partition?

I installed Debian on a VM using Guided Partitioning with Encryption and using LVM and it created something like this: - /boot - encrypted partition -- LVM --- / --- /home --- swap After the ...
user avatar
  • 21
5 votes
1 answer
6k views

How to create a new encrypted LUKS-partition in GParted?

I want to create a new encrypted LUKS-partition in GParted. I've searched the UI and the help, but the only thing I can find is how to open and close an existing LUKS partition and how to to copy and ...
user avatar
  • 2,106
8 votes
1 answer
9k views

"cryptsetup: ERROR: Couldn't resolve device" combined with "cryptsetup: WARNING: target 'sda3_crypt' not found in /etc/crypttab"

After setting up hibernation on ubuntu 20.04 and modifying it that it works for encrypted swap partitions, I'm getting several issues: First, after rebooting from hibernation, I got "Gave up ...
user avatar
0 votes
2 answers
125 views

which partitions encrypt?

Time to encrypt. My setup: /boot [1 gb] LVM swap [4 gb] /root [30 gb] /usr [4 gb] /var [4 gb] /home [150 gb] /tmp & /var/tmp [2 gb] At first gonna encrypt swap & /home, but not sure if its ...
user avatar
0 votes
1 answer
98 views

Recover formated Linux Mint encrypted Drive

When installing Windows 10 I accidentally mixed the drives and deleted another one that had Linux Mint and was encrypted, since then I haven't done anything on drive to not overwrite anything. Is it ...
user avatar
  • 1
1 vote
1 answer
552 views

can't open bitlocker encrypted devices with a clear key with cryptsetup but it works with dislocker

I'm trying to open a bitlocker encryptet partition (/dev/nvme0n1p2) with cryptsetup, but it always returns the following error: # cryptsetup -v open --type bitlk /dev/nvme0n1p2 crypt0 Enter passphrase ...
user avatar
0 votes
0 answers
41 views

Is anything on this list a tool I can use the enable some kind of disk encryption?

I have a device running on some kind of obscure Linux distribution used for embedded devices. This device has a web gui where there is an option to enable encryption of the internal storage. However, ...
user avatar
  • 2,012
0 votes
1 answer
290 views

How do I interpret the output from lvs and the content in /dev/mapper?

I just asked this question and got an answer but it led to new questions. I am trying to follow this guide to create an encrypted volume on an embedded device with a limited version of Linux (e.g., it ...
user avatar
  • 2,012
1 vote
0 answers
25 views

Seagate/LaCie NasOS - enable volume encryption on non-supported device?

According to the guide at https://www.seagate.com/gb/en/support/kb/nas-os-4x-setting-up-volume-encryption-006007en/ there should be an option to encrypt a volume on devices running NAS OS 4.0. That ...
user avatar
  • 2,012
4 votes
1 answer
1k views

Arch Linux Setup with Encryption (LVM on LUKS)

I'd like to setup Arch Linux with encryption. I found the tutorial on the Arch wiki, and think that the second option (LVM on LUKS) is the best option for me. Here's the partitioning I'd like to use (...
user avatar
1 vote
3 answers
889 views

Does *BSD have the ability to encrypt a system partition with full disk encryption?

Does FreeBSD, NetBSD, or OpenBSD have an encryption feature like Linux's dm-crypt? And will it work for a system partition?
user avatar
3 votes
3 answers
3k views

GRUB cannot find encrypted boot partition

Arch Linux Installation (On encrypted LVM) and attempt to encrypt boot partition. It's something that bothers me having a "Full disk encryption" with a non encrypted boot partition. This ...
user avatar
1 vote
1 answer
500 views

Enable Belgian keyboard for LUKS-LVM passphrase in OpenSUSE Leap 15.1

I have a new notebook from a German manufacturer with a Belgian keyboard and OpenSUSE Leap 15.1. The notebook was delivered with a temporary passphrase that you can change after completing the OS ...
user avatar
  • 710

1
2 3 4 5