Hot answers tagged

47

OK! The definitive answer finally. My steps to expand a LUKS encrypted volume... cryptsetup luksOpen /dev/sda2 crypt-volume to open the encrypted volume. parted /dev/sda to extend the partition. resizepart NUMBER END. vgchange -a n fedora_chocbar. Stop using the VG so you can do the next step. cryptsetup luksClose crypt-volume. Close the encrypted volume ...


42

Yes, you can do this by accessing the master key while the volume is decrypted. The quick and dirty to add a new passphrase: device=/dev/sda5 volume_name=foo cryptsetup luksAddKey $device --master-key-file <(dmsetup table --showkeys $volume_name | awk '{ print $5 }' | xxd -r -p) device and volume_name should be set appropriately. volume_name is the ...


30

In LUKS scheme, you have 8 "slots" for passwords or key files. First, check, which of them are used: cryptsetup luksDump /dev/<device> |grep BLED Then you can add, change or delete chosen keys: cryptsetup luksAddKey /dev/<device> (/path/to/<additionalkeyfile>) cryptsetup luksChangeKey /dev/<device> -S 6 As for deleting keys, you ...


25

dmsetup is useful for anything device mapper related. For Example: [root@localhost]~# dmsetup ls --target crypt luks-90dc732d-e183-4948-951e-c32f3f11b305 (253, 0) [root@localhost]~#


25

As you've discovered, you can use cryptsetup luksDump to see which key slots have keys. You can check the passphrase for a particular slot with cryptsetup luksOpen --test-passphrase --key-slot 0 /dev/sda2 && echo correct This succeeds if you enter the correct passphrase for key slot 0 and fails otherwise (including if the passphrase is correct for ...


23

The answer (as I now know): concurrency. In short: My sequential write, either using dd or when copying a file (like... in daily use), becomes a pseudo-random write (bad) because four threads are working concurrently on writing the encrypted data to the block device after concurrent encryption (good). Mitigation (for "older" kernels) The negative effect ...


16

You can enable this by installing dropbear-initramfs and following the instructions to configure your SSH keys. This will start an SSH server from the initramfs, allowing you to connect remotely and enter your encryption passphrase.


15

Backup Reformat Restore cryptsetup luksRemoveKey would only remove an encryption key if you had more than one. The encryption would still be there. The Fedora Installation_Guide Section C.5.3 explains how luksRemoveKey works. That it's "impossible" to remove the encryption while keeping the contents is just an educated guess. I base that on two things: ...


15

cryptsetup luksDump /dev/fedora/01 shows the LVM logical volume to be a LUKS encrypted volume. The output of pvs or pvdisplay would show the partition /dev/sda3 to be a physical volume. Thus you have LUKS over LVM. At a lower level, you have LVM over PC partition. The output of lsblk confirms this: sda is a disk, sda3 is a partition (which contains an LVM ...


14

I don't know of a single-command way to do this. The GUI programs are doing a fair bit of interrogation of the disk to take the "right" approach and you'll need to do some of that work yourself. You don't need sudo, though, and I think the resulting sequence of events is relatively painless. The Short Answer Use udisksctl from the udisks2 package: ...


14

It's about online resize. For example if you use LVM, create a LV of 1G size, and put LUKS on that, it's like this: # lvcreate -L1G -n test VG # cryptsetup luksFormat /dev/mapper/VG-test # cryptsetup luksOpen /dev/mapper/VG-test lukstest # blockdev --getsize64 /dev/mapper/VG-test 1073741824 # blockdev --getsize64 /dev/mapper/lukstest 1071644672 So the ...


13

A simpler way (now?) is to use the command with the --verbose option but without specifying the --key-slot one: # cryptsetup --verbose open --test-passphrase /dev/sda2 Enter passphrase for /dev/sda2: Key slot 4 unlocked. It will automatically check for you the right slot, without having you looping for finding the good one :)


12

for a permanent solution to change the label of the container, use: sudo cryptsetup config /dev/sdb1 --label YOURLABEL


12

For those that come to the answer to find out how to simply resize a LUKS partition to the size of the resized container, the commands are as follows: with LUKS encrypted volume opened and the opened volume mapped as opened-volume, execute sudo cryptsetup resize /dev/mapper/opened-volume then resize the file system. If it is Ext4, you can resize a mounted ...


11

cryptsetup handles image files just as well as block devices, if that was your question. So if you make a dd image (which will be freaking huge) it will work. And if it didn't, you could just create the loop device yourself. Best practice (if you want to keep the backup encrypted) is to encrypt the backup disk also, then open both containers, then run any ...


11

My solution to LUKS and keyboard layout problems is to add the passphrase twice. So the same sequence of key presses will be accepted in both US/qwerty layout and whatever you usually use (in my case, DE/qwertz). If you use more than one keyboard layout you can add more passphrases for them; LUKS supports up to 8 in total, and most people never use more ...


11

So I did figure it out: I partitioned the disk partialy following the handbook: # parted -a optimal /dev/sda GNU Parted 2.3 Using /dev/sda Welcome to GNU Parted! Type 'help' to view a list of commands. (parted)mklabel gpt (parted)unit mib (parted)mkpart primary 1 3 (parted)name 1 grub (parted)set 1 bios_grub on (parted)mkpart primary 3 131 (parted)name ...


11

One of the best ways to do this is to use a smart card with a crypto key on it to unlock the keys for your encrypted block devices. You will only need to enter the passphrase (called "PIN" by the tools but it's really a passphrase) once, after which it will be cached. This has the added advantage of protecting the encrypted data with something-you-have (the ...


11

In GRUB (or whatever you're using as your bootloader), add this boot option to your kernel command line: break=premount. It should give you a shell prompt while the system is still running on initramfs and the system has not yet made any attempts to mount the real root filesystem. You can use this shell prompt to check your keyboard layout.


10

It doesn't work because the /etc/crypttab line is missing the option keyword luks. Changing the line to this resolved the issue: luks-01a2e5d8-9211-40ce-b160-d3f973d1a155 UUID=01a2e5d8-9211-40ce-b160-d3f973d1a155 /etc/luks-keys/luks-01a2e5d8-9211-40ce-b160-d3f973d1a155 luks,nofail This is due to the fact that cryptdisks_start uses the options to determine ...


10

If all you want to change is the hash, there is no need to re-encrypt. You still have to build a new LUKS header though. Same cipher, same master key, same offset, different hash. You can try this for yourself. First we set up a LUKS device with standard settings and lousy iter counts: # truncate -s 8M /dev/shm/foobar # cryptsetup --iter-time=42 luksFormat ...


10

If the decrypted volume is /dev/mapper/crypto then you can get the information with dmsetup table crypto 0 104853504 crypt aes-cbc-essiv:sha256 000[...]000 0 254:2 4096 If the encrypted volume is /dev/storage2/crypto then you get the information with cryptsetup luksDump /dev/storage2/crypto LUKS header information for /dev/storage2/crypto Version: ...


10

The cryptsetup FAQ mentions whole-disk encryption using LUKS. Basically, cryptsetup doesn’t care what the LUKS device is, partition, disk, or loop device, so you can use whichever is appropriate. sudo cryptsetup -v -y luksFormat /dev/sda will create a LUKS container using all of /dev/sda. Section 2.2 of the FAQ recommends this for external disks: Fully ...


9

luks - create a new block device encrypted over existing block device. Not filesystem - so you can't mount it directly after opening. But - all data are lost. You can't encrypt existing ntfs partition. If you wish - you can encrypt device over sda, then open it with cryptsetup luksOpen /dev/sda1 crypted_sda1 and then mount /dev/mapper/crypted_sda1 /...


9

I just looked for the same thing, a list of my luks partitions, though I wanted a mapping to the physical /dev/sdX devices. I found a solution for that here: https://bbs.archlinux.org/viewtopic.php?id=164798 lsblk --fs


8

Firstly, when removing a passphrase from a LUKS partition, you need to specify the disk partition where it resides, like: cryptsetup luksRemoveKey /dev/sda2 And when you want the status from a LUKS-encrypted device, you need to refer to the LUKS-name, as you did. But luksRemoveKey only removes one of the passphrases (and never the last one). If you want ...


8

Your approach looks good. Some remarks though: If you want to encrypt rootfs, you'll need to use initrd (to have some minimal unencrypted system that will process the encrypted partitions). If the USB device is removable, both initrd and kernel can be stored on the USB to heighten tamper resistance (supposing you make sure the USB won't get into ...


8

It's very odd to have a LUKS inside a plain crypt. Why encrypt twice? Once your filesystems are mounted, lsblk will show you what's what. NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT sda 8:0 0 59.6G 0 disk └─sda1 8:1 0 59.6G 0 part └─md0 9:0 0 ...


8

wipefs -a /dev/sdx only wipes magic signatures on that device, not on its partitions. So at best, it only wipes your partition table, but if you then proceed to re-create the partitions at the same offsets at before, the old data is still there. You'd have to wipe the partitions as well. wipefs -a /dev/sdx[1-9]* # wipe old partitions wipefs -a /dev/sdx ...


8

It appears that dmsetup computes its alignment from the optimal I/O size, without bothering to check that that is actually a multiple of the physical block size. As mentioned in the false warning question, this optimal I/O size makes sense due to USB constraints. So the solution is simple: use --align-payload to override the detected value. A value of 8 ...


Only top voted, non community-wiki answers of a minimum length are eligible