Questions tagged [luks]

LUKS (Linux Unified Key Setup) is a disk-encryption specification.

Filter by
Sorted by
Tagged with
30
votes
1answer
14k views

Change password on a LUKS filesystem without knowing the password

I have a Debian Wheezy server that's been running for a while with an encrypted drive. The password for the encrypted drive (/dev/sda5) was lost when my encrypted password file was corrupted. I'd ...
22
votes
1answer
7k views

Abysmal general dm-crypt (LUKS) write performance

I am investigating a problem where encrypting a block device imposes a huge performance penalty when writing to it. Hours of Internet reading and experiments did not provide me with a proper ...
21
votes
4answers
22k views

Extend a LUKS encrypted partition to fill disk

I recently upgraded my disk from a 128GB SSD to 512GB SSD. The / partition is encrypted with LUKS. I'm looking for help extending the partition to use all the free space on the new disk. I've ...
18
votes
2answers
12k views

List open dm-crypt LUKS volumes

If I mount a simple loop device, losetup -a give me the devices opened. Is something similar possible with cryptsetup?
18
votes
1answer
18k views

How do I change a LUKS password?

I would like to change a LUKS password. I want to remove my old password, but I would like to try out my new password before removing the original. I obviously know the old password. I would like to ...
17
votes
3answers
13k views

Best practice to backup a LUKS encrypted device

What's the fastest method to backup and restore a luks encrypted device (e.g. a full encrypted usb-device to a image-file). The usb-device can be decrypted/accessed. I'm looking for a solution to ...
15
votes
2answers
14k views

Detemine which luks slot a passphrase is in

I have a luks-encrypted partition that was protected by a passphrase and a key file. The key file was for routine access and the passphrase was in a sealed envelope for emergencies. May months went by ...
14
votes
4answers
15k views

How to identify LVM-over-LUKS or LUKS-over-LVM

I recently installed Fedora 20. I don't recall what exact options I chose for encrypting the disk/LVM during installation. It installed fine and I can log in etc. Here is the situation I have: I ...
14
votes
2answers
26k views

How can I shrink a LUKS partition, what does `cryptsetup resize` do?

I am in progress of resizing a LUKS encrypted partition that contains a single ext4 filesystem (no LVM or something). The cryptsetup FAQ recommends to remove the old partition and recreate it, but ...
14
votes
2answers
3k views

Is it possible to encrypt a hard disk with a key file instead of a password?

Looking into hard disk encryption. the go to solution seems to be dm-crypt with LUKS using a password. I work with multiple independent hard disks mounted into a disk pool for reading. In this case, I ...
12
votes
2answers
29k views

How to remove LUKS encryption?

I tried removing LUKS encryption on my home directory using the following command: cryptsetup luksRemoveKey /dev/mapper/luks-3fd5-235-26-2625-2456f-4353fgdgd But it gives me an error saying: ...
12
votes
2answers
1k views

Reboot without having to decrypt LUKS partitions?

Is there a way to kexec reboot a running kernel without having to decrypt an encrypted LUKS root filesystem? I'd imagine not, but I'm not sure if there's a workaround for this.
11
votes
2answers
758 views

Turning encrypted system on remotely

My system is full of very sensitive data, so I need to encrypt as much of it as possible. I have an encrypted Debian installation which asks for a long password every time during boot. Is there a ...
11
votes
2answers
8k views

How to change the hash-spec and iter-time of an existing dm-crypt LUKS device?

How can I change the hash-spec and iter-time of an existing dm-crypt LUKS device? Clearly I can pass the options if I create a new device, for example something like this: sudo cryptsetup ...
11
votes
3answers
3k views

How to open a port early in boot process to unlock LUKS via SSH

I have a fully encrypted server running Debian 7 and have set up dropbear and busybox to unlock the LUKS container via SSH (as described in this tutorial and in this U&L answer). Unfortunately, ...
11
votes
4answers
7k views

How can I set a label on a dm-crypt+LUKS container?

I just received a new USB flash drive, and set up 2 encrypted partitions on it. I used dm-crypt (LUKS mode) through cryptsetup. With an additional non-encrypted partition, the drive has the following ...
11
votes
2answers
8k views

Linux: LUKS and multiple hard drives

I have a Debian Linux system (amd64) installed on a RAID-1 system encrypted device (LVM on LUKS) and will have a RAID-6 of >=4 disks where I'll put my data (LUKS and maybe LVM). I think the basic ...
11
votes
2answers
2k views

Defending against the evil maid, how to handle removal of the /boot partition

When using LUKS full disk encryption, how would you go about protecting against evil maids ? The evil maid attack is when someone gets physical access to your computer while you're away and ...
10
votes
3answers
8k views

Mounting LUKS from the command line

When in nautilus or caja I click on the icon of an encrypted disk and enter my password, the underlying block device gets mapped to /dev/mapper/luks-$UUID and it gets mounted at/media/$USER/$DISK, no ...
10
votes
1answer
2k views

forgot to luksClose usb persistent partition, is this a problem?

Following the Kali Linux documentation for "Adding USB Persistence with LUKS Encryption", I created a persistent partition and encrypted the volume with: cryptsetup --verbose --verify-passphrase ...
9
votes
2answers
10k views

How to mount a cryptsetup container just with `mount`?

I created an encrypted container via #!/bin/bash dd if=/dev/zero of=$1 bs=1 count=0 seek=$2 MAPPER=$(mktemp -up /dev/mapper) LOOPDEV=$(losetup --find --show $1) cryptsetup luksFormat $LOOPDEV ...
8
votes
1answer
2k views

Trying to understand LUKS encryption

I decided to encrypt my root partition with LUKS+LVM. My ThinkPad setup: Samsung 830 128GB SSD 750GB HDD Core 2 Duo 2,5 GHz P9500 8GB RAM But the more I read, the less I understand about those two ...
8
votes
1answer
1k views

Odd wrong password behaviour with GRUB cryptodisk

I have used GRUB_ENABLE_CRYPTODISK=y in /etc/default/grub to allow LUKS encryption of everything except my EFI partition, which I mount to /boot/efi. This works fine. The only admittedly small ...
7
votes
1answer
3k views

What does `cryptsetup resize` do if LUKS doesn't store partition size?

The LUKS / dm-crypt / cryptsetup FAQ page says: 2.15 Can I resize a dm-crypt or LUKS partition? Yes, you can, as neither dm-crypt nor LUKS stores partition size. I'm befuzzled: What is "...
7
votes
1answer
1k views

cryptdisks_start: precheck failed: the device contains a filesystem type crypto_LUKS

I'm trying to use cryptdisks_start to open a LUKS device that is defined in my /etc/crypttab. Unfortunately, the command fails with the following error message: martin ~ # cryptdisks_start luks-...
7
votes
2answers
8k views

How do can I tell what encryption is being used with signed in luks?

What command tells you what encryption is being used by a luks partition (all the relevant information initialization vector generation scheme, mode of operation and block cipher primitive).
7
votes
2answers
5k views

RHEL6 LUKS with TPM support?

I'm surprised that this question is not asked more frequently, but (in RHEL) does LUKS support TPM's the way that Windows BitLocker does? If so, how is this feature implemented, and does it provide ...
7
votes
1answer
463 views

Cannot run cryptsetup throught SSH?

I'm trying to open a LUKS drive through SSH directly. ssh root@XX "cryptsetup luksOpen /dev/sdb3 secure But, no password prompt and it stuck. debug1: Sending command: cryptsetup luksOpen /dev/sdb3 ...
7
votes
2answers
11k views

Grub-install: embedding is not possible in Bios/GPT

I am struggling with setting up an encrypted NAS for some days now. The basic plan is to have btrfs on lvm on luks on raid1 with lvmcache in writeback mode thrown in for the root partition to reduce ...
7
votes
1answer
3k views

How to have Linux wipe/randomize/sanitize RAM at shutdown?

For mysterious reasons I still double boot sometimes into Windows. My problem is that I fear that information may leak because the RAM memory is accessible to Windows. (the Linux partitions are ...
7
votes
3answers
6k views

luksOpen doesn't decrypt with keyfile unless --key-file argument is provided

I have an encrypted volume for which I had initially set up a passphrase interactively, which works just fine to decrypt the partition. I added more keys using a keyfile in both the following ways: ...
7
votes
1answer
3k views

Can Grub2 multi-boot LUKS/LVM distros with only one boot partition?

There are many tutorials on the internet for multi-booting unencrypted distros using a single boot partition and chainloading. For example, booting 145 OSes. Likewise, there are tutorials for multi-...
7
votes
1answer
9k views

Umount all attached usb disks with a single command

Is there a (safe) way to umount all partitions on all attached usb devices (usb-hdds, usb-sticks) with a single commandline command, including several encrypted luks partitions? Only the partitions ...
7
votes
1answer
2k views

How to open multiple LUKS volumes with key entered in initramfs?

I have a Debian 7.4 (stable) based server configured to use an encrypted (RAID1 + LVM) root partition (/boot is un-encrypted regular partition) to which I installed dropbear SSH server so I can ...
7
votes
1answer
731 views

How do I cancel a stale “pending” drive mount with error “An operation is already pending”

The An operation is already pending error is very generic and many things can cause this. (other answers don't relate to my problem). I have a Luks encrypted volume that I clicked to open, a password ...
6
votes
1answer
6k views

Guide for Gentoo setup with full disk encryption using LUKS+LVM

I'm looking for a way to make the following setup happen in Gentoo: /dev/sda1 -> /boot (ext2) /dev/sda2 -> Luks encrypted | +-lvm-vg1 | +- /dev/mapper/root-fs -> / (ext4) +- /dev/...
6
votes
2answers
5k views

Which partitions should I encrypt?

My laptop is currently running Windows and Fedora, but I'm planning to install Arch Linux as my sole OS soon. This current setup is using whole disk encryption through TrueCrypt, but I'm unsure if it ...
6
votes
4answers
11k views

Unlock LUKS encrypted Debian root with key file on boot partition

I'm trying to decrypt the Debian root with a key file stored in the boot partition (decrypted partition). This will break the security, but it doesn't matter now. I have to conclude this successfully ...
6
votes
1answer
5k views

LUKS storing keyfile in encrypted usb drive

I already asked once about LUKS unlocking of multiple HDDs in Linux: LUKS and multiple hard drives. Now I would like to know how to secure store the keyfile used for the automatic unlock of the ...
6
votes
1answer
1k views

Why is my LUKS partition mounted without asking for a passphrase?

On my system, I have two encrypted disks: crypt containing the root partition of raspbian stretch usb-crypt is an external usb disk. LVM is used on that disk. Both disks are protected using the same ...
6
votes
2answers
9k views

Initramfs in debootstrap chroot of fully encrypted system

I'm working on a script to create a fully encrypted washable system from debootstrap. It's doing some good, but the initramfs image that comes out does not pick up the cryptroot properly. After ...
6
votes
1answer
179 views

Why are logical volumes used with LUKS partitions?

All of the instructions I've seen on setting up a LUKS encrypted drive require using logical volumes to create root and swap partitions inside a LUKS device. Why not just put standard partitions ...
6
votes
2answers
1k views

How to decrypt LUKS-encrypted device on per user basis upon login?

I've created the following luks@.service service for systemd: [Unit] Description=Cryptography Setup for '%I' After=cryptsetup-pre.target After=dev-mapper-%i.device Before=cryptsetup.target Before=...
6
votes
1answer
265 views

LUKS key from known password?

I have a hard drive with Ubuntu 14.04 installation - root partition was encrypted with LUKS. I had some configuration problems and wanted to re-install Ubuntu but keep all my data so I moved all my ...
6
votes
2answers
1k views

How to choose LUKS encryption when installing RHEL 6?

With the default RHEL 6 installer, how can I choose the LUKS encryption? Afaik if I prepare the disk like cryptsetup luksFormat -c cast5-cbc-plain -s 128 /dev/$DEVICE could be the "fastest" ...
6
votes
1answer
3k views

Linux Tablet: Is there a way to enter a password with onscreen keyboard to unlock a LUKS crypto device during bootup?

I just installed Linux (Ubuntu, but it does not really matter) on an x86-based tablet. I also encrypted a partition which is mounted during bootup. Of course, one usually needs to enter the password ...
5
votes
1answer
1k views

cryptsetup disc encryption “no key available with this passphrase” - but password known 100% [closed]

I try to decrypt my harddrive using the password that I 100% know. The password knowledge is not the problem. Last thing I remember doing is: installing texlive. Not having enough disk space. ...
5
votes
1answer
2k views

unable to open luks encrypted device (wrong password)

I'm using CentOS 7 with a luks encrypted root partition. Usually I have to type my password during boot, but sometimes the system doesn't accept it. It reacts as it was wrong, but it isn't. I did not ...
5
votes
4answers
41k views

How to mount a disk encrypted with cryptsetup(crypto_LUKS) in Ubuntu 14.04?

I have a 4TB Disk formatted as NTFS and some data has been written into it. I then tried to encrypt it and mapped it to /dev/mapper/volume_sde1 like this: $ lsblk -io NAME,TYPE,SIZE,FSTYPE,UUID,...
5
votes
1answer
939 views

dmsetup luksFormat creating an alignment inconsistency

When unlocking a newly-formatted LUKS volume, I received a warning in the kernel log: kernel: device-mapper: table: 253:14: adding target device sdk1 caused an alignment inconsistency: ...

1 2 3 4 5 10