Questions tagged [luks]

LUKS (Linux Unified Key Setup) is a disk-encryption specification.

Filter by
Sorted by
Tagged with
18
votes
4answers
20k views

Extend a LUKS encrypted partition to fill disk

I recently upgraded my disk from a 128GB SSD to 512GB SSD. The / partition is encrypted with LUKS. I'm looking for help extending the partition to use all the free space on the new disk. I've ...
5
votes
2answers
674 views

Partition still encrypted with luks after wipefs

I wiped the disk using wipefs -a /dev/sda. I happily formatted the disk, and it seems that when I'm about to mount /dev/sda3 it says "unknown file system type crypto_LUKS". I did no encryption on ...
14
votes
2answers
25k views

How can I shrink a LUKS partition, what does `cryptsetup resize` do?

I am in progress of resizing a LUKS encrypted partition that contains a single ext4 filesystem (no LVM or something). The cryptsetup FAQ recommends to remove the old partition and recreate it, but ...
7
votes
1answer
3k views

How to have Linux wipe/randomize/sanitize RAM at shutdown?

For mysterious reasons I still double boot sometimes into Windows. My problem is that I fear that information may leak because the RAM memory is accessible to Windows. (the Linux partitions are ...
5
votes
1answer
2k views

unable to open luks encrypted device (wrong password)

I'm using CentOS 7 with a luks encrypted root partition. Usually I have to type my password during boot, but sometimes the system doesn't accept it. It reacts as it was wrong, but it isn't. I did not ...
11
votes
2answers
8k views

Linux: LUKS and multiple hard drives

I have a Debian Linux system (amd64) installed on a RAID-1 system encrypted device (LVM on LUKS) and will have a RAID-6 of >=4 disks where I'll put my data (LUKS and maybe LVM). I think the basic ...
11
votes
2answers
8k views

How to change the hash-spec and iter-time of an existing dm-crypt LUKS device?

How can I change the hash-spec and iter-time of an existing dm-crypt LUKS device? Clearly I can pass the options if I create a new device, for example something like this: sudo cryptsetup ...
2
votes
1answer
3k views

Install Backtrack 5 r2 into running LUKS setup installed with ubuntu

One hard disk (sda), two partitions, with a working Ubuntu running. 1) /boot 2) LVM with this virtual volumes/partions/ or whatever they are called inside: Swap Ubuntu Home Prepared for Backtrack ...
7
votes
1answer
3k views

What does `cryptsetup resize` do if LUKS doesn't store partition size?

The LUKS / dm-crypt / cryptsetup FAQ page says: 2.15 Can I resize a dm-crypt or LUKS partition? Yes, you can, as neither dm-crypt nor LUKS stores partition size. I'm befuzzled: What is "...
3
votes
1answer
4k views

Problem keyboard layout in boot with LUKS

I'm French and I have install ArchLinux with LUKS on btrfs file system. In Login: I can't mount my filesystem on /dev/sda2 because the keyboard is in US I try change /etc/vconsole.conf in FR and ...
3
votes
1answer
1k views

Is it possible to unlock multiple LUKS devices to form a LVM at boot?

I have the following setup: A LUKS encrypted SSD on which a LVM is used to form the typical linux partitions (/, /home/, etc.). This setup is unlocked at boot by a password. I'm using Debian Jessie. ...
11
votes
3answers
3k views

How to open a port early in boot process to unlock LUKS via SSH

I have a fully encrypted server running Debian 7 and have set up dropbear and busybox to unlock the LUKS container via SSH (as described in this tutorial and in this U&L answer). Unfortunately, ...
7
votes
1answer
9k views

Umount all attached usb disks with a single command

Is there a (safe) way to umount all partitions on all attached usb devices (usb-hdds, usb-sticks) with a single commandline command, including several encrypted luks partitions? Only the partitions ...
5
votes
1answer
5k views

LUKS storing keyfile in encrypted usb drive

I already asked once about LUKS unlocking of multiple HDDs in Linux: LUKS and multiple hard drives. Now I would like to know how to secure store the keyfile used for the automatic unlock of the ...
10
votes
2answers
26k views

How to remove LUKS encryption?

I tried removing LUKS encryption on my home directory using the following command: cryptsetup luksRemoveKey /dev/mapper/luks-3fd5-235-26-2625-2456f-4353fgdgd But it gives me an error saying: ...
6
votes
1answer
6k views

Guide for Gentoo setup with full disk encryption using LUKS+LVM

I'm looking for a way to make the following setup happen in Gentoo: /dev/sda1 -> /boot (ext2) /dev/sda2 -> Luks encrypted | +-lvm-vg1 | +- /dev/mapper/root-fs -> / (ext4) +- /dev/...
4
votes
1answer
7k views

Debian error message: “Unable to find LVM volume”, but then boots successfully

I was trying to encrypt all the HDD during the installation process of Debian 8 Jessie using full disk encryption + LVM, and I did it, but, there are a little "problem". Before the system asks me the ...
3
votes
1answer
2k views

Decrypt second encrypted LVM during headless server boot?

I've followed this question https://unix.stackexchange.com/questions/5017/ssh-to-decrypt-encrypted-lvm-during-headless-server-boot and successfully remotely decrypted my root drive. However, I have a ...
21
votes
1answer
7k views

Abysmal general dm-crypt (LUKS) write performance

I am investigating a problem where encrypting a block device imposes a huge performance penalty when writing to it. Hours of Internet reading and experiments did not provide me with a proper ...
6
votes
4answers
11k views

Unlock LUKS encrypted Debian root with key file on boot partition

I'm trying to decrypt the Debian root with a key file stored in the boot partition (decrypted partition). This will break the security, but it doesn't matter now. I have to conclude this successfully ...
15
votes
2answers
12k views

Detemine which luks slot a passphrase is in

I have a luks-encrypted partition that was protected by a passphrase and a key file. The key file was for routine access and the passphrase was in a sealed envelope for emergencies. May months went by ...
5
votes
1answer
844 views

dmsetup luksFormat creating an alignment inconsistency

When unlocking a newly-formatted LUKS volume, I received a warning in the kernel log: kernel: device-mapper: table: 253:14: adding target device sdk1 caused an alignment inconsistency: ...
4
votes
1answer
2k views

Recovering a LUKS partition

I have a drive with 2 partitions 1st is plain ext4 2nd is encrypted LUKS. The partition table has been overwritten. I've found the beginning of the second partition, which I need to recover, thusly:...
4
votes
1answer
2k views

Installing Debian with encrypted root: installer does not see EFI /boot partition

I am trying to do what I think is a pretty standard setup of encrypted / partition and unencrypted /boot using the Debian installer (for Stretch-rc1). I created /boot by selecting the option EFI ...
1
vote
1answer
1k views

LUKS change encryption key

To change encryption password I can use command: cryptsetup luksChangeKey /dev/sda2 ... and that works. But how to encrypt /dev/sda2 partition again with new password? If my old password is ...
6
votes
3answers
5k views

luksOpen doesn't decrypt with keyfile unless --key-file argument is provided

I have an encrypted volume for which I had initially set up a passphrase interactively, which works just fine to decrypt the partition. I added more keys using a keyfile in both the following ways: ...
5
votes
1answer
1k views

How to decrypt an encrypted container via ssh without entering a passphrase while requiring some client authentication?

I log in to a server via public key authentication and then mount a container (using e.g. LUKS/dm-crypt or truecrypt). At the moment, I have to enter the container password manually. Is there a way to ...
5
votes
2answers
3k views

Why does LUKS need to generate hash values?

If you create a new LUKS device, you can specify the option -hash and -iter-time. For example like this: sudo cryptsetup luksFormat --cipher aes-cbc-essiv:sha256 --key-size 256 --iter-time 2100 --...
4
votes
1answer
2k views

Unlock LUKS partition using keyfile without root access?

Is there any way to unlock LUKS partition using keyfile while not having root priviliges? (using sudo is not an option) I know that udisksctl can open LUKS partition, however it can do it only with a ...
3
votes
2answers
2k views

How to move the bootloader from a hard drive to a usb stick

I've decided to move my Debian bootloader and /boot from the hard drive to a USB stick. I'm using LUKS to en/decrypt my hard drive and the bootloader is the only unencrypted partition. How can I ...
3
votes
1answer
2k views

How to set laptop screen brightness just after boot with full disk encryption

my girlfriend bought Lenovo Essential G500 i5-3230 and I installed Linux Mint 16 on it with full disk encryption. It is standard installation with encryption using dmcrypt and LUKS. But there is a ...
2
votes
1answer
76 views

Using space before 1st partition of USB-Stick as luks key

I'm using arch linux with an encrypted luks root partition (boot unencrypted), with a passphrase yet. Now I have a keyfile (3072 bytes), that's written to USB-Stick this way: sudo dd if=tempKeyFile....
1
vote
1answer
3k views

Ubuntu 16.04 stops booting, it has LVM and LUKS encryption configured, superblock restore already tried

Suddenly my Ubuntu 16.04 drops me into an initramfs prompt like this: BusyBox v.1.22.1 (Ubuntu 1:1.22.0-15ubuntu1) built-in shell (ash) Enter 'help' for list of built-in commands. (initramfs) ...
1
vote
0answers
659 views

why can't I partition a LUKS mounted partition?

A CentOS 7 server has to have LUKS encryption for everything but /boot and /boot/efi. And the large LUKS encrypted remainder partition (1.8 TB) will then need to be partitioned further. I was able ...
1
vote
2answers
4k views

How can I extract the hash value of a LUKS device?

For LUKS devices I know that hashes are stored somehow in the partition header (I don't really know what this means). But I don't know how to print the hash value in this case. For example in a ...
1
vote
1answer
179 views

Fastest way to count zero bytes on a partition

My root and home partitions are LUKS-encrypted. I wish to have discard/TRIM enabled on them (I'm aware of security implications). If my understanding is correct, this should result in discarded areas ...
1
vote
1answer
652 views

Massive disk corruption on Ubuntu 15.10 with dm-crypt + LUKS full disk encryption?

I suspect there's a bug in Ubuntu's default whole disk encryption setup. Here's what happens, repeatably: I make a fresh install, Ubuntu 15.10 with whole disk encryption, overwriting the whole disk ...
1
vote
1answer
2k views

USB key not mounting at boot to unlock LUKS system

I am running Debian Jessie. I have 2 hard drives with my various partitions spread across both (not RAID). Both of them are separately LUKS encrypted, and LVMs sit upon both of those. My /boot ...
1
vote
1answer
643 views

Storing a keyfile in an encrypted LVM

I'm using RHEL 6.5 and I want to encrypt some of my logical volumes (LVM). In order to not have to enter the passphrase multiple times, I want to store a keyfile in an encrypted LV. Example: /var/...
0
votes
0answers
95 views

Do my LUKS partition damaged?

Some say that my LUKS parition may have been damaged due to some mistakes, but I'm not very sure. hexdump -C /dev/sda7 | grep LUKS 1cca2cc80 7f 66 4c 55 4b 53 bd 14 ff c3 3e 2c 52 f0 7c 3a |....
0
votes
0answers
146 views

Need to install new distro in LUKS disk

I have a disk encrypted with LUKS and running OpenSuse. I want to to install Fedora in the / partition. The /home is a different partition on the LUKS disk. How can I mount the / so the Fedora ...
0
votes
1answer
1k views

Installing GRUB to encrypted partition doesn't work if (root) is F2FS

I'm trying to setup a new Arch Linux installation with encrypted /boot partition, as described here: https://wiki.archlinux.org/index.php/Dm-crypt/Encrypting_an_entire_system#Encrypted_boot_partition_....