Questions tagged [disk-encryption]
The disk-encryption tag has no usage guidance.
249
questions
5
votes
1
answer
136
views
Is swapped memory encrypted on encrypted partitions?
If I installed Ubuntu on an encrypted ext4 partition, I normally have a /swapfile. Now I would expect that the swapped memory is also encrypted by default. However, the man-page of swapon says:
The ...
- 181
0
votes
1
answer
20
views
Booting updated system with encrypted root partion fails
I've just updated my Debian system to Bullseye and using the 5.10.0-13-amd64 kernel can no longer access my encrypted root disc.
I can still boot using previous version 5.4.0-0.bpo.2-amd64 kernel.
The ...
1
vote
1
answer
47
views
How to change a key stored on a keydisk so it can decrypt a drive on OpenBSD?
Following the guide from https://www.openbsd.org/faq/faq14.html#softraidFDEkeydisk I know how to encrypt a drive and store a key on a usb stick.
Suppose I've lost a copy of the key or suspect someone ...
- 111
0
votes
1
answer
348
views
Decrypting a full disk LUKS encryption manually from initramfs
I recently installed a fresh Ubuntu 20.04 image on my laptop while doing so i chose a full disk encrpytion using a password. (I think it is LUKS but I do not know how to verify this).
For some reason ...
0
votes
0
answers
33
views
Please help me change my LUKS password
I have a terrible LUKS password and if that wasn't enough I also have to type it blindly with the wrong locale keyboard in a headless server. I want to change it to something else but I have a very ...
0
votes
1
answer
25
views
Shrink partitionless filesystem
I have data on a disk that I want to encrypt by cloning the full filesystem of that disk (source) to a virtual block device (devicemapper/cryptsetup) based on an additional disk (target) of identical ...
- 1,895
3
votes
1
answer
329
views
Storage encryption on Linux desktop: LVM on LUKS or ZFS
I choose solution for storage encryption on Linux desktop. For years LVM on LUKS was a best option with superior performance and reliability. But ZFS on Linux actively develops new functions and now ...
- 141
0
votes
0
answers
20
views
Tool to manage multiple LUKS devices as a group
I'm looking for a program which can manage a whole "group" of drives that have LUKS containers with the same passphrase; unlocking and locking them (ideally also formatting and/or passphrase ...
- 333
0
votes
1
answer
50
views
Change mount location of an encrypted volume?
I've followed this page to make a partition encrypted.
When I format the created luks volume I do this:
root@M17A:/home/mike# sudo mkfs.ext4 /dev/mapper/cryptpart
mke2fs 1.45.5 (07-Jan-2020)
Creating ...
- 1,042
13
votes
2
answers
1k
views
Bit Rot within LUKS Encryption
How does bit rot affect a LUKS container and the filesystem inside?
Suppose you have a filesystem that is well suited to deal with bit rot. Now put it inside a LUKS container. In case bit rot ...
- 247
1
vote
1
answer
74
views
cant create encrypted usb drive on raspberry pi 4
I have a raspberry pi 4. I have followed the instructions at
https://linuxconfig.org/usb-stick-encryption-using-linux
I have created and recreated the partitions, tried fat32, apt, and gpt. I started ...
- 121
1
vote
1
answer
91
views
Data-loss safety of "cryptsetup luksOpen <root device>" between suspend and resume
I'm setting up suspend-to-disk and resume in an 2021.12.x Arch Linux install. My question is about safely (without data-loss) unlocking partitions when resuming.
Here is my configuration. The ...
0
votes
0
answers
115
views
How can you change number of allowed password attempts for luks encrypted bootup?
I found out that luks encrypted bootup will accept up to 3 password attempts before failing. After 3 attempts, it thinks for a while and then shows text prompt:
Warning: /dev/disk/by-uuid/...
- 3
3
votes
2
answers
236
views
Automatically mount fulldisk encrypted disk without entering passphrase?
Some time ago I installed a linux Pop-OS (based on Ubuntu 20.04).
All good so far. It's my secondary play-around box.
I installed it with fulldisk encryption which prompts for a passphrase to decrypt ...
- 241
0
votes
1
answer
193
views
Is it possible to enable dm-integrity on an existing LUKS/cryptsetup device?
I have a large LUKS2 device created with cryptsetup that holds an LVM2 with my root and other filesystems. The device is several TB in size and I don't have any others disks (or combinations of disks) ...
- 219
0
votes
0
answers
37
views
How do I change the cryptsetup background?
When I encrypt my disk/OS, GNU/Linux shows a screen or image on boot where you can type in your password. How do I edit that image/change it?
I am currently on Debian, which includes a black ...
3
votes
0
answers
21
views
Ignoring the SED encrypted drives until after booting is completed [closed]
I have an Ubuntu system which boots from a small NVME disk using software encryption, TPM, etc. to mitigate against data loss in case of theft. The system is interfaced with customised PCIe hardware ...
- 131
1
vote
0
answers
60
views
Cannot access encrypted root partition after moving it
I had a Windows laptop with an additional Manjaro installed, on /dev/sda6 (somewhere wedged between the Windows 10 main partition and the recovery partiton).
The Manjaro partition is using ext4, with ...
- 247
2
votes
1
answer
656
views
Mounting external hard drive using LUKS2 and FIDO2 Key
I have encrypted an external hard drive using LUKS2 on my machine running Fedora 34 using the cryptsetup command.
When I now plug in the hard drive and enter the passphrase, the drive is unlocked ...
- 23
3
votes
3
answers
238
views
Is it possible to encrypt sensitive data on a headless embedded device in a secure way?
My company works with Raspberry Pis, where all data (OS, our software, etc) is stored on an SD card. We configure these devices (load our software on them), and send them out into the field (an ...
- 193
0
votes
0
answers
193
views
bioctl: How to use both keydisk and passphrase?
Is it possible to use both a keydisk and a passphrase with encrypted bootable drive?
I specified both keydisk and passphrase when creating the encrypted volume:
# bioctl -c C -p /tmp/passphrase -k /...
- 330
0
votes
0
answers
46
views
Can I use TPM-based transparent storage encryption, and have a recovery key?
We have 100ish laptops that run Windows 10 Enterprise with full on Bitlocker encryption, but we want to go away from Windows.
I looked at multiple distros but none (and no open-source product) can ...
2
votes
1
answer
212
views
Encrypted LUKS volume does not accept password on boot after system freeze
My Laptop froze and after a hard shutdown the boot process won’t accept my disk encryption password anymore.
I have a ‘standard’ luks-inside-lvm setup, generated while installing fedora, split in a /...
- 31
0
votes
0
answers
38
views
Can a filesystem be encrypted in such a way that only specific processes can access it?
I can certainly mount a filesystem and all the files in it as 700, but I want something even tighter than that. Let's say someone manages to get into my system, somehow. They'd be able to read just ...
0
votes
0
answers
52
views
Encrypted rootfs on P2041 board
I'm trying to encrypt the rootfs on a bootable mSD on a P2041 board.
My main reference is the Arch-Linux guide for encrypted roots under the "Luks on a partition" section.
What I have done ...
- 351
1
vote
1
answer
987
views
LUKS + TPM2 + PIN
I am currently aware of two recent methods to bind a LUKS encrypted root partition to a TPM2: systemd-cryptenroll and clevis. Both of them seem to release the encryption key after successfully ...
- 95
5
votes
2
answers
353
views
What is the epoch of LUKS that is shown when running luksDump?
When you run luksDump on a LUKS device, I get this:
$ sudo cryptsetup luksDump /dev/sda1
LUKS header information
Version: 2
Epoch: 3
Metadata area: 16384 [bytes]
Keyslots area: ...
- 2,106
2
votes
2
answers
93
views
How can hide the encrypted partition in gui?
I can encrypt my /dev/sdb4 with cryptsetup this way
sudo apt-get install cryptsetup
sudo umount /dev/sdb4
sudo cryptsetup --verbose --verify-passphrase luksFormat /dev/sdb4
sudo cryptsetup luksOpen /...
- 35
0
votes
1
answer
601
views
tang / clevis: automatic unlocking for luks device not triggered unless defined as _netdev
I've setup a server with luks devices (not used for root partition), they are listed in /etc/crypttab this way
# <target name> <source device> <key file> <options>
...
0
votes
2
answers
159
views
How do I get a self encrypting NVMe SSD partition to show up in /dev after unlocking it?
I've been spending some time working with self encrypting SSDs recently, and I am stuck on how to access drive contents after I've unlocked it.
Normally with this drive, you would load a Preboot ...
- 105
0
votes
1
answer
158
views
Only first slot password is valid during decryption of boot device while all others are valid while testing to open a device
I made a full encryption setup of Ubuntu 20.04 LTS according to this article. Due to it is highly recommended to add further passphrases to avoid loosing all data due to unavailability of the initial ...
- 141
11
votes
4
answers
5k
views
Is disk encryption without requiring a password at boot possible?
Is it possible to encrypt the boot disk but not require users to input a password when the system boots? I have some headless boxes in remote locations for which I cannot guarantee they will be ...
- 434
0
votes
1
answer
133
views
What is deleting my symlink to my USB luks partition upon cryptsetup luksOpen?
I wrote a new udev rule to create a symlink to a luks-encrypted partition on a USB flash drive when the drive is plugged in. The new udev rule I wrote does create the symlink to the USB drive's ...
0
votes
1
answer
1k
views
cryptsetup luksFormat error "Device /dev/nvme0n1p3 is in use. Can not proceed with format operation."
I've followed this guideline to the point where I encrypt the target partition:
cryptsetup -h sha256 -c aes-xts-plain64 -s 512 luksFormat /dev/nvme0n1p3
Then, the error appears, even though I'd ...
- 215
0
votes
1
answer
968
views
mounting NTFS bitlocker in linux
I use ntfs-3g from tuxera in RHEL/CentOS 7.9 to mount my windows 10 disk. I have linux installed on a separate disk when I use linux.
mount -t ntfs-3g /dev/sdb3 /mywin10
However I do this on ...
- 4,101
2
votes
0
answers
117
views
How secure is it to suspend Linux (Fedora) while using whole disk encryption?
I have a full disk encryption on my Fedora 33 workstation. The purpose of encryption was protection from stealing the laptop physically. But how much more unsafe to just suspend the OS, not fully ...
- 21
0
votes
1
answer
56
views
Recovering deleted files on an encrypted drive
My drive is encrypted. I am running Fedora. I also have a Win 10 boot (not encrypted), if that's relevant)
I accidentally ran rm -Rf * in the wrong folder - one in which I had a dozen or so small ...
- 135
2
votes
1
answer
187
views
is it possible to upgrade a distro (debian) in an Encrypted LVM partition?
I installed Debian on a VM using Guided Partitioning with Encryption and using LVM and it created something like this:
- /boot
- encrypted partition
-- LVM
--- /
--- /home
--- swap
After the ...
- 21
5
votes
1
answer
6k
views
How to create a new encrypted LUKS-partition in GParted?
I want to create a new encrypted LUKS-partition in GParted.
I've searched the UI and the help, but the only thing I can find is how to open and close an existing LUKS partition and how to to copy and ...
- 2,106
8
votes
1
answer
9k
views
"cryptsetup: ERROR: Couldn't resolve device" combined with "cryptsetup: WARNING: target 'sda3_crypt' not found in /etc/crypttab"
After setting up hibernation on ubuntu 20.04 and modifying it that it works for encrypted swap partitions, I'm getting several issues:
First, after rebooting from hibernation, I got "Gave up ...
- 215
0
votes
2
answers
125
views
which partitions encrypt?
Time to encrypt.
My setup:
/boot [1 gb]
LVM
swap [4 gb]
/root [30 gb]
/usr [4 gb]
/var [4 gb]
/home [150 gb]
/tmp & /var/tmp [2 gb]
At first gonna encrypt swap & /home, but not sure if its ...
- 13
0
votes
1
answer
98
views
Recover formated Linux Mint encrypted Drive
When installing Windows 10 I accidentally mixed the drives and deleted another one that had Linux Mint and was encrypted, since then I haven't done anything on drive to not overwrite anything. Is it ...
- 1
1
vote
1
answer
552
views
can't open bitlocker encrypted devices with a clear key with cryptsetup but it works with dislocker
I'm trying to open a bitlocker encryptet partition (/dev/nvme0n1p2) with cryptsetup, but it always returns the following error:
# cryptsetup -v open --type bitlk /dev/nvme0n1p2 crypt0
Enter passphrase ...
- 197
0
votes
0
answers
41
views
Is anything on this list a tool I can use the enable some kind of disk encryption?
I have a device running on some kind of obscure Linux distribution used for embedded devices. This device has a web gui where there is an option to enable encryption of the internal storage. However, ...
- 2,012
0
votes
1
answer
290
views
How do I interpret the output from lvs and the content in /dev/mapper?
I just asked this question and got an answer but it led to new questions. I am trying to follow this guide to create an encrypted volume on an embedded device with a limited version of Linux (e.g., it ...
- 2,012
1
vote
0
answers
25
views
Seagate/LaCie NasOS - enable volume encryption on non-supported device?
According to the guide at https://www.seagate.com/gb/en/support/kb/nas-os-4x-setting-up-volume-encryption-006007en/ there should be an option to encrypt a volume on devices running NAS OS 4.0. That ...
- 2,012
4
votes
1
answer
1k
views
Arch Linux Setup with Encryption (LVM on LUKS)
I'd like to setup Arch Linux with encryption. I found the tutorial on the Arch wiki, and think that the second option (LVM on LUKS) is the best option for me. Here's the partitioning I'd like to use (...
- 525
1
vote
3
answers
889
views
Does *BSD have the ability to encrypt a system partition with full disk encryption?
Does FreeBSD, NetBSD, or OpenBSD have an encryption feature like Linux's dm-crypt?
And will it work for a system partition?
user431493
3
votes
3
answers
3k
views
GRUB cannot find encrypted boot partition
Arch Linux Installation (On encrypted LVM) and attempt to encrypt boot partition.
It's something that bothers me having a "Full disk encryption" with a non encrypted boot partition. This ...
1
vote
1
answer
500
views
Enable Belgian keyboard for LUKS-LVM passphrase in OpenSUSE Leap 15.1
I have a new notebook from a German manufacturer with a Belgian keyboard and OpenSUSE Leap 15.1. The notebook was delivered with a temporary passphrase that you can change after completing the OS ...
- 710