Skip to main content

Questions tagged [dm-crypt]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1 vote
1 answer
32 views

How to create a dm-crypt block device in /dev/mapper without wiping it?

I can create a dm-crypt filesystem with: root@smarcimx8mq4g:~# cat /data/caam/randomkey | keyctl padd logon logkey: @s 731358804 root@smarcimx8mq4g:~# dmsetup -v create encrypted --table "0 $(...
fadedbee's user avatar
  • 971
0 votes
0 answers
48 views

Strategies for deleting or encrypting tmp data

I have a Ubuntu 22.04 system with LUKS on LVM, with swap and a data volume encrypted (/data). This will eventually run on a VPS, with limited RAM (probably 2 or 4 GB), but a reasonable amount of disk ...
QF0's user avatar
  • 305
3 votes
2 answers
234 views

How to refresh decoy data on a plausible deniability dm-crypt scheme?

I just read this discussion between Linus Torvalds and (among others) Milan Broz, one of dm-crypt's maintainers. I am intrigued by the the following part of the discussion : Linus Torvalds: I thought ...
ChennyStar's user avatar
  • 1,795
1 vote
1 answer
437 views

cryptsetup cannot initialize crypto backend from initramfs

I'm on an embedded Linux device and trying to open an encrypted squashfs for my rootfs. The image is created on the host (build agent) and from there I'm able to open and work with the content, so I ...
dangeroushobo's user avatar
4 votes
1 answer
559 views

custom prompt for system encryption password entry on startup

I have full disk encryption on my arch linux laptop. When i power on the machine it prompts me for my disk password. My system is encrypted by following the LVM on luks archwiki page. the prompt says ...
Oxyn's user avatar
  • 81
0 votes
1 answer
137 views

How to implement "cryptseup isLuks" function using cryptsetup library APIs

In shell script $crypsetup isLuks /dev/sda1 Above command returns 0 -> for luks partition (encrypted partition) 1 -> non luks partitions (non encrypted partition). I have implemented disk ...
Arulananth Subramaniam's user avatar
0 votes
1 answer
158 views

pmount cannot mount removable encrypted usb disk

I am creating a mapper file /dev/mapper/luks-672dcc74-d002-47dc-b61b-525baf91dc7c on boot in /etc/crypttab like this: luks-672dcc74-d002-47dc-b61b-525baf91dc7c UUID=672dcc74-d002-47dc-b61b-...
zomega's user avatar
  • 972
1 vote
0 answers
105 views

Luks2 does not accept unlock password after fixing efi boot

I have 2 usb's of different brands and capacities encrypted with Luks2 using Kali's disk tool. After correcting a problem with the boot and correcting the path I was able to access the disks, but ...
Thiago Ferreira's user avatar
1 vote
0 answers
613 views

How to mount / recover my encrypted logical volumes?

I have put some EDIT at the END of the first reply. unfortunately I run into some problem with my old LVM installation where debian10 was running on it. I have installed Debian 11 alongside Debian 10. ...
AlexOnLinux's user avatar
4 votes
2 answers
2k views

Disable read/write workqueue for Ubuntu Full-Disk-Encryption

I am currently trying to set up multiple devices with Ubuntu (20.04.5 LTS) and the drive must be encrypted, so I used LUKS during the installation. (I checked "Use LVM with the new Ubuntu ...
Pascal Diu's user avatar
1 vote
0 answers
520 views

Convert an existing filesystem partition to one encrypted with dmsetup

I am developing an embedded ARM-based Linux device, which is initially programmed with a non-encrypted ext4 filesystem image. On first boot, an initramfs script uses resize2fs followed by cryptsetup-...
Craig McQueen's user avatar
0 votes
1 answer
1k views

How does LUKS PBKDF work?

For instance, if we choose --pbkdf argon2id and --hash blake2b-512, # printf 'YES' | cryptsetup luksFormat \ --type luks2 --key-file /tmp/keyfile \ --header /tmp/luks....
midnite's user avatar
  • 443
0 votes
1 answer
537 views

How to chainload another kernel with kexec inside a LUKS2 + LVM2 partition?

I have a Debian 11 installation with the following partition layout: path format mount point /dev/nvme0n1p7 ext4 (no encryption) /boot (Debian 11) /dev/nvme0n1p8 dm-crypt LUKS2 LVM2 (named vg_main) ...
Eduardo's user avatar
  • 103
1 vote
0 answers
203 views

Change underlying device of mount or dm-crypt without unmounting

I have an external, encrypted USB-drive that was mounted through dm-crypt: The device was /dev/sdb, decrypted as /dev/mapper/external (which is a symbolic link to /dev/dm-5) and mounted as /mnt. After ...
mb706's user avatar
  • 111
0 votes
1 answer
2k views

Is it possible to enable dm-integrity on an existing LUKS/cryptsetup device?

I have a large LUKS2 device created with cryptsetup that holds an LVM2 with my root and other filesystems. The device is several TB in size and I don't have any others disks (or combinations of disks) ...
ATLief's user avatar
  • 318
0 votes
0 answers
497 views

Does it matter if the `encrypt` mkinitcpio hook is included on a system without full disk encryption?

Can I share an /etc/mkinitcpio.conf between two Arch Linux systems, where one requires the encrypt hook for LUKS disk encryption, and the other does not? i.e. will it cause a problem booting the ...
OJFord's user avatar
  • 1,995
0 votes
0 answers
71 views

Is it possible to re-attach a drive to an open DM-crypt device?

Imagine a setup where ZFS is on top of LUKS which sits on a physical drive. While the FS is mounted, the drive drops out/is disconnected (user error, intermittent issue etc.). Now we have the ...
Atemu's user avatar
  • 687
0 votes
0 answers
671 views

Encrypting entire disk vs partitions

Which is better ? cryptsetup luksFormat /dev/sda and then create partitions or create partitions on /dev/sda first like sda1, sda2, etc and then encrypt each one of them ? Will I get less performance ...
voldimot's user avatar
  • 135
2 votes
0 answers
2k views

Grub error 'lvmid/xxx' not found

I have a similar problem to this one: https://bbs.archlinux.org/viewtopic.php?id=249535. However, the fix does not work for me. So I am trying to install arch linux in a dm-encrypted partition. I have ...
mor3dr3ad's user avatar
0 votes
1 answer
761 views

Have Cryptsetup Benchmark --cipher run through list of all ciphers

I'm trying to run cryptsetup benchmark --cipher on the entire list of ciphers included in /proc/crypto. I obtained the list from /proc/crypto by doing the following: cd ./Documents/; cat /proc/crypto |...
Shinaolord's user avatar
0 votes
1 answer
646 views

How to identify which process is writing on encrypted disk with ZFS

My disks (ZFS on Linux on encrypted LUKS) are not staying in standby and I'm not able to identify which process is waking them up. iotop is showing command txg_sync which is related to ZFS. So I tried ...
MelBourbon's user avatar
0 votes
1 answer
299 views

What is "dmname" in Arch linux grub config

Hello and thanks for clicking into this for a look. I noticed that in the arch wiki, under cryptdevice in dm-crypt you have this: cryptdevice This parameter will make the system prompt for the ...
user avatar
4 votes
0 answers
1k views

Can dm-crypt (LUKS2) be implemented on top of an UBI volume on a raw NAND flash?

If I have an embedded system with a raw NAND flash, with a bad blocks table etc., as I understand it, the best way to have partitions is to have have them as UBI volumes on top of MTD. UBI takes care ...
ruben2020's user avatar
  • 185
2 votes
1 answer
808 views

dm_crypt / kworker hogging IO and causing system freeze

I'm not sure how to debug this, but I've noticed if I am performing a task that requires a large amount of disk reads/write (such as updating a large postgres table) that periodically actual reads and ...
user1671538's user avatar
1 vote
1 answer
713 views

Determine if a given path is on a removable device, even if encrypted, via bash script

/path/to/directory/ is a path that points within an encrypted volume, to an arbitrary depth. In a bash script I need to determine if the block device related to this path is a removable device. I'm ...
MountainX's user avatar
  • 18.2k
1 vote
0 answers
435 views

Error installing Arch on LUKS-encrypted ZFS root: `/sbin/init does not exist`

I have almost successfully installed Arch Linux on a LUKS-encrypted disk with a ZFS root. I can get the password prompt to decrypt the LUKS volume, but the next step with loading the installed system ...
SKNB's user avatar
  • 113
4 votes
1 answer
4k views

Arch Linux Setup with Encryption (LVM on LUKS)

I'd like to setup Arch Linux with encryption. I found the tutorial on the Arch wiki, and think that the second option (LVM on LUKS) is the best option for me. Here's the partitioning I'd like to use (...
Patrick Bucher's user avatar
1 vote
1 answer
244 views

Can someone please help me understand this command?

dmsetup create crypt1 --table "0 `blockdev --getsize /dev/sdb2` crypt aes-cbc-essiv:sha256 <Put the 16-byte hex key here> 0 /dev/sdb2 0" I got it from step 6 of the first answer here. ...
Daylark's user avatar
  • 11
0 votes
1 answer
35 views

Dm-crypt: who can see data?

I'm starting to investigate on Dm-crypt concept and usage on several Linux servers. I saw how should I configure it, there are several guides on web. Unfortunately I'm finding any information ...
rschirin's user avatar
  • 153
0 votes
1 answer
1k views

cryptsetup failed with code 22 invalid argument

I have read `cryptsetup luksOpen <device> <name>` fails to set up the specified name mapping https://www.saout.de/pipermail/dm-crypt/2014-August/004272.html And tried cryptsetup open --...
Mzq's user avatar
  • 111
0 votes
1 answer
249 views

In regards to dm-crypt with LUKS, what is meant by "passphrase strengthening"?

On the Fedora wiki it is mentioned that LUKS offers this protection. LUKS does provide passphrase strengthening but it is still a good idea to choose a good (meaning "difficult to guess") ...
qq4's user avatar
  • 519
0 votes
1 answer
405 views

PV on LVM Partition inside a dm-crypt container

I am trying to set up LVM on LUKS. Here is what I did: head -c 100M /dev/zero > test-file losetup /dev/loop0 test-file cryptsetup luksFormat /dev/loop0 cryptsetup open /dev/loop0 cryptlvm gdisk /...
MrMeeSeeks's user avatar
1 vote
1 answer
2k views

Error running LUKS reencryption without formatting

I am unable to run luks reencryption. I have data on /dev/sdc1 and would like to encrypt it without the need to format. I am trying to utilize the luks2 online encryption feature. mathew@plug:/mnt $ ...
Mathew Paret's user avatar
3 votes
1 answer
2k views

LVM + LUKS is this error okay?

I have a encrypted partition, inside it there exist LVM / and /home. When I start PC it says. Volume group "vg" not found Cannot process volume group vg Please unlock disk sdc2_crypt After I type ...
user399197's user avatar
1 vote
1 answer
867 views

It is okay to mount 2 encrypted disks with same UUID

I have 2 harddrives. 1 was empty - let's call it hard2 and other had a working Linux OS - lets call it hard1. I use dd to copy hard1 to hard2, but I could not boot with hard2. I had a error: inode ...
user397905's user avatar
4 votes
2 answers
14k views

Serious backup options for linux disk (dmcrypt, luks, ext4, ext3, btrfs) normal and encrypted system

Disk/Partition Backup What are the backup options and good practice to make a solid and easy to use full system backup? With the following requirement: Live backup Image backup Encrypted backup ...
intika's user avatar
  • 14.6k
2 votes
1 answer
941 views

How can I change the name of an unencrypted LUKS partition mounted as the root filesystem?

When I installed Linux, the block-device-path of my root LUKS device was /dev/md125 and the unencrypted partition was /dev/mapper/md125_crypt. I have since renamed the MD device to /dev/md0, and now I'...
ATLief's user avatar
  • 318
0 votes
1 answer
104 views

Where to download cryptsetup-luks-devel package?

How to download and install cryptsetup-luks-devel package for Debian? I can't find it. When I google I get this package only for CentOS.
user390072's user avatar
1 vote
0 answers
197 views

My disk doesn't want to unlock encryption

I use Debian default encryption disk encryption. When I boot I need to type my password, and then I will be logged in. However today I can't login. It always says that I typed the wrong password, but ...
user390072's user avatar
3 votes
0 answers
3k views

Slow write speed on encrypted drive, while benchmark shows much higher encryption / raw disk write rates

I currently setup a NAS with Ubuntu 18.04 on a Netgear ReadyNAS 102device. The machine has a Armada Marvell 370/XP SoC with a hardware encryption accelerator called "CESA". The kernel drivers for CESA ...
SDwarfs's user avatar
  • 159
1 vote
0 answers
312 views

Increase size of randomly created encrypted swap

Ubuntu 18.04 is by default creating a random encrypted swap during each boot using dm-crypt/Swap encryption. For me, this is creating a 1gb swap but I cannot find where to increase the size of the ...
xendi's user avatar
  • 613
0 votes
0 answers
140 views

dm-crypt --type plain on usb device that changes the drive letter

I have a little problem using an encrypted physical volume from an external usb3 disk encloser. This is the situation: I put a sata hard disk into the disk case and plugin the usb3 cable to my ...
ikrabbe's user avatar
  • 2,173
1 vote
0 answers
349 views

Is there a way to do one-time pads(OTP) with Linux cryptsetup(dm-crypt)?

It looks like losetup with cryptoloop did it and there was a dm-xor module for a very old kernel, but can't find anything modern. I'm wading through a ton of obsolete losetup documents. Something ...
Pedro's user avatar
  • 49
1 vote
1 answer
450 views

Addressing USB-Stick by UUID as kernel parameter in grub.cfg

I'm using Arch Linux and setting up an USB-Stick as decryption key for my luks-encrypted root partition (boot is unencrypted). I described it already in this question. Now, the key, that's used for ...
Andreas H.'s user avatar
5 votes
1 answer
465 views

Using space before 1st partition of USB-Stick as luks key

I'm using arch linux with an encrypted luks root partition (boot unencrypted), with a passphrase yet. Now I have a keyfile (3072 bytes), that's written to USB-Stick this way: sudo dd if=tempKeyFile....
Andreas H.'s user avatar
0 votes
1 answer
2k views

A separate partition for a user's /home directory?

I plan to encrypt a user's /home directory, prefering dm-crypt over eCryptfs, which seems to read data x times faster. But encrypting the whole /home would be a problem for others, entering an ...
user avatar
1 vote
1 answer
1k views

Bad magic number in super-block: dm-crypt device

I have a device that is encrypted using dm-crypt. This is a mini SD card that I use on my laptop. I've had some issues with my laptop freezing recently, and in the journal these messages come up: ...
user avatar
3 votes
2 answers
2k views

Encrypting a currently used external hard drive such that it can be updated with rsync?

I currently have an unencrypted external hard drive that I use as a backup for my encrypted (with LUKS) main machine. To update my backup, I simply log in to the main machine and rsync to my external ...
J. Mini's user avatar
  • 157
0 votes
1 answer
746 views

Safest way to store TLS private keys without a security module

I am using BeableBone Black devices running Debian which communicate securely with an AWS server over TLS using signed certificates. I need to store my private keys securely on the devices. The best ...
Engineer999's user avatar
  • 1,171
0 votes
0 answers
47 views

How to create an encrypted partition and how does Linux then decrypt it [duplicate]

I'm still very much in the learning phase of Linux especially for the use in embedded systems. My intention is to create a separate encrypted partition on an SD card, possibly by using dm-crypt. ...
Engineer999's user avatar
  • 1,171