Questions tagged [dm-crypt]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
1 answer
150 views

How does LUKS PBKDF work?

For instance, if we choose --pbkdf argon2id and --hash blake2b-512, # printf 'YES' | cryptsetup luksFormat \ --type luks2 --key-file /tmp/keyfile \ --header /tmp/luks....
  • 265
0 votes
1 answer
89 views

How to chainload another kernel with kexec inside a LUKS2 + LVM2 partition?

I have a Debian 11 installation with the following partition layout: path format mount point /dev/nvme0n1p7 ext4 (no encryption) /boot (Debian 11) /dev/nvme0n1p8 dm-crypt LUKS2 LVM2 (named vg_main) ...
  • 103
1 vote
0 answers
27 views

Change underlying device of mount or dm-crypt without unmounting

I have an external, encrypted USB-drive that was mounted through dm-crypt: The device was /dev/sdb, decrypted as /dev/mapper/external (which is a symbolic link to /dev/dm-5) and mounted as /mnt. After ...
  • 111
0 votes
0 answers
47 views

Need to create a LUKS2 partition using Systemd.repart but need to specify PBKDF=pbkdf2 for the partition

I need to make a dm-crypt partition using LUKS2. This partition needs to use a keyfile presented to systemd.cryptsetup for decryption. We cannot use Argon2 KDF due to memory limitations so we need to ...
0 votes
1 answer
300 views

Is it possible to enable dm-integrity on an existing LUKS/cryptsetup device?

I have a large LUKS2 device created with cryptsetup that holds an LVM2 with my root and other filesystems. The device is several TB in size and I don't have any others disks (or combinations of disks) ...
  • 231
0 votes
0 answers
120 views

Does it matter if the `encrypt` mkinitcpio hook is included on a system without full disk encryption?

Can I share an /etc/mkinitcpio.conf between two Arch Linux systems, where one requires the encrypt hook for LUKS disk encryption, and the other does not? i.e. will it cause a problem booting the ...
  • 1,638
0 votes
0 answers
27 views

Is it possible to re-attach a drive to an open DM-crypt device?

Imagine a setup where ZFS is on top of LUKS which sits on a physical drive. While the FS is mounted, the drive drops out/is disconnected (user error, intermittent issue etc.). Now we have the ...
  • 490
0 votes
0 answers
153 views

Encrypting entire disk vs partitions

Which is better ? cryptsetup luksFormat /dev/sda and then create partitions or create partitions on /dev/sda first like sda1, sda2, etc and then encrypt each one of them ? Will I get less performance ...
  • 115
2 votes
0 answers
2k views

Grub error 'lvmid/xxx' not found

I have a similar problem to this one: https://bbs.archlinux.org/viewtopic.php?id=249535. However, the fix does not work for me. So I am trying to install arch linux in a dm-encrypted partition. I have ...
0 votes
1 answer
385 views

Have Cryptsetup Benchmark --cipher run through list of all ciphers

I'm trying to run cryptsetup benchmark --cipher on the entire list of ciphers included in /proc/crypto. I obtained the list from /proc/crypto by doing the following: cd ./Documents/; cat /proc/crypto |...
0 votes
1 answer
167 views

How to identify which process is writing on encrypted disk with ZFS

My disks (ZFS on Linux on encrypted LUKS) are not staying in standby and I'm not able to identify which process is waking them up. iotop is showing command txg_sync which is related to ZFS. So I tried ...
0 votes
1 answer
167 views

What is "dmname" in Arch linux grub config

Hello and thanks for clicking into this for a look. I noticed that in the arch wiki, under cryptdevice in dm-crypt you have this: cryptdevice This parameter will make the system prompt for the ...
  • 135
2 votes
0 answers
638 views

Can dm-crypt (LUKS2) be implemented on top of an UBI volume on a raw NAND flash?

If I have an embedded system with a raw NAND flash, with a bad blocks table etc., as I understand it, the best way to have partitions is to have have them as UBI volumes on top of MTD. UBI takes care ...
  • 153
2 votes
1 answer
431 views

dm_crypt / kworker hogging IO and causing system freeze

I'm not sure how to debug this, but I've noticed if I am performing a task that requires a large amount of disk reads/write (such as updating a large postgres table) that periodically actual reads and ...
1 vote
1 answer
273 views

Determine if a given path is on a removable device, even if encrypted, via bash script

/path/to/directory/ is a path that points within an encrypted volume, to an arbitrary depth. In a bash script I need to determine if the block device related to this path is a removable device. I'm ...
  • 16k
1 vote
0 answers
285 views

Error installing Arch on LUKS-encrypted ZFS root: `/sbin/init does not exist`

I have almost successfully installed Arch Linux on a LUKS-encrypted disk with a ZFS root. I can get the password prompt to decrypt the LUKS volume, but the next step with loading the installed system ...
  • 13
4 votes
1 answer
2k views

Arch Linux Setup with Encryption (LVM on LUKS)

I'd like to setup Arch Linux with encryption. I found the tutorial on the Arch wiki, and think that the second option (LVM on LUKS) is the best option for me. Here's the partitioning I'd like to use (...
1 vote
1 answer
123 views

Can someone please help me understand this command?

dmsetup create crypt1 --table "0 `blockdev --getsize /dev/sdb2` crypt aes-cbc-essiv:sha256 <Put the 16-byte hex key here> 0 /dev/sdb2 0" I got it from step 6 of the first answer here. ...
  • 11
0 votes
1 answer
32 views

Dm-crypt: who can see data?

I'm starting to investigate on Dm-crypt concept and usage on several Linux servers. I saw how should I configure it, there are several guides on web. Unfortunately I'm finding any information ...
  • 153
0 votes
1 answer
575 views

cryptsetup failed with code 22 invalid argument

I have read `cryptsetup luksOpen <device> <name>` fails to set up the specified name mapping https://www.saout.de/pipermail/dm-crypt/2014-August/004272.html And tried cryptsetup open --...
  • 111
0 votes
1 answer
169 views

In regards to dm-crypt with LUKS, what is meant by "passphrase strengthening"?

On the Fedora wiki it is mentioned that LUKS offers this protection. LUKS does provide passphrase strengthening but it is still a good idea to choose a good (meaning "difficult to guess") ...
  • 491
0 votes
1 answer
221 views

PV on LVM Partition inside a dm-crypt container

I am trying to set up LVM on LUKS. Here is what I did: head -c 100M /dev/zero > test-file losetup /dev/loop0 test-file cryptsetup luksFormat /dev/loop0 cryptsetup open /dev/loop0 cryptlvm gdisk /...
0 votes
1 answer
2k views

LUKS cryptsetup reencrypt not working

I am unable to run luks reencryption. I have data on /dev/sdc1 and would like to encrypt it without the need to format. I am trying to utilize the luks2 online encryption feature. mathew@plug:/mnt $ ...
2 votes
1 answer
1k views

LVM + LUKS is this error okay?

I have a encrypted partition, inside it there exist LVM / and /home. When I start PC it says. Volume group "vg" not found Cannot process volume group vg Please unlock disk sdc2_crypt After I type ...
1 vote
1 answer
400 views

It is okay to mount 2 encrypted disks with same UUID

I have 2 harddrives. 1 was empty - let's call it hard2 and other had a working Linux OS - lets call it hard1. I use dd to copy hard1 to hard2, but I could not boot with hard2. I had a error: inode ...
4 votes
1 answer
12k views

Serious backup options for linux disk (dmcrypt, luks, ext4, ext3, btrfs) normal and encrypted system

Disk/Partition Backup What are the backup options and good practice to make a solid and easy to use full system backup? With the following requirement: Live backup Image backup Encrypted backup ...
  • 13.1k
1 vote
0 answers
445 views

How can I change the name of an unencrypted LUKS partition mounted as the root filesystem?

When I installed Linux, the block-device-path of my root LUKS device was /dev/md125 and the unencrypted partition was /dev/mapper/md125_crypt. I have since renamed the MD device to /dev/md0, and now I'...
  • 231
0 votes
1 answer
44 views

Where to download cryptsetup-luks-devel package?

How to download and install cryptsetup-luks-devel package for Debian? I can't find it. When I google I get this package only for CentOS.
1 vote
0 answers
145 views

My disk doesn't want to unlock encryption

I use Debian default encryption disk encryption. When I boot I need to type my password, and then I will be logged in. However today I can't login. It always says that I typed the wrong password, but ...
2 votes
0 answers
2k views

Slow write speed on encrypted drive, while benchmark shows much higher encryption / raw disk write rates

I currently setup a NAS with Ubuntu 18.04 on a Netgear ReadyNAS 102device. The machine has a Armada Marvell 370/XP SoC with a hardware encryption accelerator called "CESA". The kernel drivers for CESA ...
  • 149
1 vote
0 answers
203 views

Increase size of randomly created encrypted swap

Ubuntu 18.04 is by default creating a random encrypted swap during each boot using dm-crypt/Swap encryption. For me, this is creating a 1gb swap but I cannot find where to increase the size of the ...
  • 593
0 votes
0 answers
93 views

dm-crypt --type plain on usb device that changes the drive letter

I have a little problem using an encrypted physical volume from an external usb3 disk encloser. This is the situation: I put a sata hard disk into the disk case and plugin the usb3 cable to my ...
  • 2,095
0 votes
0 answers
243 views

Is there a way to do one-time pads(OTP) with Linux cryptsetup(dm-crypt)?

It looks like losetup with cryptoloop did it and there was a dm-xor module for a very old kernel, but can't find anything modern. I'm wading through a ton of obsolete losetup documents. Something ...
  • 39
1 vote
1 answer
341 views

Addressing USB-Stick by UUID as kernel parameter in grub.cfg

I'm using Arch Linux and setting up an USB-Stick as decryption key for my luks-encrypted root partition (boot is unencrypted). I described it already in this question. Now, the key, that's used for ...
5 votes
1 answer
347 views

Using space before 1st partition of USB-Stick as luks key

I'm using arch linux with an encrypted luks root partition (boot unencrypted), with a passphrase yet. Now I have a keyfile (3072 bytes), that's written to USB-Stick this way: sudo dd if=tempKeyFile....
0 votes
1 answer
1k views

A separate partition for a user's /home directory?

I plan to encrypt a user's /home directory, prefering dm-crypt over eCryptfs, which seems to read data x times faster. But encrypting the whole /home would be a problem for others, entering an ...
  • 142
1 vote
1 answer
1k views

Bad magic number in super-block: dm-crypt device

I have a device that is encrypted using dm-crypt. This is a mini SD card that I use on my laptop. I've had some issues with my laptop freezing recently, and in the journal these messages come up: ...
's user avatar
2 votes
2 answers
2k views

Encrypting a currently used external hard drive such that it can be updated with rsync?

I currently have an unencrypted external hard drive that I use as a backup for my encrypted (with LUKS) main machine. To update my backup, I simply log in to the main machine and rsync to my external ...
  • 75
0 votes
1 answer
462 views

Safest way to store TLS private keys without a security module

I am using BeableBone Black devices running Debian which communicate securely with an AWS server over TLS using signed certificates. I need to store my private keys securely on the devices. The best ...
0 votes
0 answers
46 views

How to create an encrypted partition and how does Linux then decrypt it [duplicate]

I'm still very much in the learning phase of Linux especially for the use in embedded systems. My intention is to create a separate encrypted partition on an SD card, possibly by using dm-crypt. ...
2 votes
1 answer
321 views

Creating an encrypted partition to store private keys [closed]

I am using a BeagleBone Black board running Debian. My intention is to create a separate encrypted partition to store private keys in the internal emmc. The keys are used for SSL communication. The ...
0 votes
1 answer
345 views

Find physical block device of root filesystem on an encrypted filesystem?

I'm running Arch Linux (systemd) on several systems. Some have SSD storage, others have nvme storage devices and some use rotational HDD's. Some systems use dm-crypt to encrypt the filesystem. All ...
  • 16k
2 votes
2 answers
6k views

How to specify cryptdevice by label using systemd boot?

I'm running Arch Linux with systemd boot. In /boot/loader/entries/arch.conf I currently specify the luks crypto device with a line like this: options rw cryptdevice=/dev/sda1:ABC root=/dev/...
  • 16k
2 votes
1 answer
171 views

The password of previously encrypted volume got changed by the Debian installer

I already did some research on my question (see below), and it's as good as a 'done deal' but I would still like to put forward my problem to this knowledgeable community. Short version of the issue: ...
0 votes
1 answer
286 views

Cryptmount-setup is not working

When I tried to set up encryption using cryptmount-setup, it just returns without any feedback. It did not even created the crypto.fs file. I ran the commands: cryptmount nextcloud_data and cryptmount ...
  • 115
3 votes
1 answer
401 views

Security of key reuse with dm-crypt in plain mode?

Are there, from a cryptanalysis point of view, security drawbacks when reusing the same key for different volumes in dm-crypt plain mode with cypher aes-xts-plain64? # Example: Encrypt two volumes ...
  • 202
1 vote
2 answers
1k views

Can't boot Arch Linux after installation with dm-crypt whole system encryption (BIOS)

So I'm installing a new Arch with the document here for a whole system encryption. The first part I get confused is here which the document wrote: Warning: GRUB does not support LUKS2. Do not use ...
2 votes
1 answer
2k views

veritysetup verify successful but mount fails after upgrade to new kernel

We are using dm-verity for a squashfs root file system. Using kernel 4.8.4 everything was ok, after upgrading to kernel 4.14.14 mount fails, even though the veritysetup verify command validates the ...
1 vote
1 answer
1k views

change designated name of encrypted lvm root? from sdo to sdn in crypttab?

I installed debian stretch using encrypted lvm from the installer on a usb drive. during installation, with all disks connected, sdo5 is assigned to my boot disk. when running the full system, my ...
2 votes
2 answers
924 views

How to dm-crypt the data only once by filesystem level RAID?

I'd like to use dm-crypt with btrfs, because of the bitrot protection of this filesystem. What I am worrying about that the RADI1 is on the filesystem level above the dm-crypt, so if I write a file, ...
  • 254