102
votes
Accepted
Extend a LUKS encrypted partition to fill disk
OK! The definitive answer finally. My steps to expand a LUKS encrypted volume...
cryptsetup luksOpen /dev/sda2 crypt-volume to open the encrypted volume.
parted /dev/sda to extend the partition. ...
- 1,871
47
votes
Extend a LUKS encrypted partition to fill disk
For those that come to the answer to find out how to simply resize a LUKS partition to the size of the resized container, the commands are as follows:
with LUKS encrypted volume opened and the opened ...
- 1,181
40
votes
Accepted
Detemine which luks slot a passphrase is in
As you've discovered, you can use cryptsetup luksDump to see which key slots have keys.
You can check the passphrase for a particular slot with
cryptsetup luksOpen --test-passphrase --key-slot 0 /...
38
votes
Accepted
Restore a LUKS partition that was overwritten by pvcreate
cryptsetup repair, Part One — Magic Bytes Recovery
See also: cryptsetup repair, Part Two — Full Header Recovery
This looks like a LUKS 2 header that was directly overwritten with LVM metadata. So ...
- 49.9k
32
votes
List open dm-crypt LUKS volumes
I just looked for the same thing, a list of my luks partitions, though I wanted a mapping to the physical /dev/sdX devices.
I found a solution for that here: https://bbs.archlinux.org/viewtopic.php?...
- 431
29
votes
Accepted
What does `cryptsetup resize` do if LUKS doesn't store partition size?
It's about online resize.
For example if you use LVM, create a LV of 1G size, and put LUKS on that, it's like this:
# lvcreate -L1G -n test VG
# cryptsetup luksFormat /dev/mapper/VG-test
# ...
- 49.9k
26
votes
Detemine which luks slot a passphrase is in
A simpler way (now?) is to use the command with the --verbose option but without specifying the --key-slot one:
# cryptsetup --verbose open --test-passphrase /dev/sda2
Enter passphrase for /dev/sda2: ...
- 497
25
votes
Is there a way to encrypt disk without formatting it?
Yes, there is a way. The LUKS cryptsetup utility contains the reencrypt command that you can also use to encrypt your existing unencrypted root partition, i.e. without destroying the existing ...
- 58.1k
22
votes
How to remove LUKS encryption?
Removing key-slots is like forgetting a password, it has nothing to do with moving the replacing the LUKS device by the filesytem inside of it.
You CAN non-destructively remove the LUKS encryption ...
- 269
22
votes
Accepted
Encrypting whole disk with Luks (instead of one big encrypted partition)
The cryptsetup FAQ mentions whole-disk encryption using LUKS. Basically, cryptsetup doesn’t care what the LUKS device is, partition, disk, or loop device, so you can use whichever is appropriate.
...
- 450k
19
votes
Mounting LUKS from the command line
I don't know of a single-command way to do this. The GUI programs are doing a fair bit of interrogation of the disk to take the "right" approach and you'll need to do some of that work ...
- 536
19
votes
Accepted
How to create a new encrypted LUKS-partition in GParted?
GParted doesn't support creating of encrypted partitions, you'll need to use either GNOME Disks or blivet-gui (shameless plug for my project) or you can just use cryptsetup directly if you are ok with ...
- 18.8k
18
votes
How to determine what encryption is being used a LUKS partition?
List the disks:
lsblk --fs
Then (used encryption):
cryptsetup luksDump /dev/sdb1
Or (used encryption):
cryptsetup status crypt_sdb1
In addition (kernel supported encryption and bench):
cat /...
- 14.7k
18
votes
Accepted
Turning encrypted system on remotely
You can enable this by installing dropbear-initramfs and following the instructions to configure your SSH keys. This will start an SSH server from the initramfs, allowing you to connect remotely and ...
- 450k
18
votes
Accepted
How to mount and de-encrypt a LUKS encrypted partition to recover files
To recover your files you will first need to open your LUKS container. This will make your LVM logical volumes accessible. Then, you can mount the appropriate logical volume to gain access to the ...
- 7,278
18
votes
Accepted
Bit Rot within LUKS Encryption
Bitrot in the LUKS header (key and otherwise critical material): it's *poof* gone.
(There is a bit of redundancy and checksum for the LUKS2 header but it doesn't cover much, so chances are... it's ...
- 49.9k
17
votes
How to remove LUKS encryption?
Firstly, when removing a passphrase from a LUKS partition, you need to specify the disk partition where it resides, like:
cryptsetup luksRemoveKey /dev/sda2
And when you want the status from a LUKS-...
- 271
17
votes
Accepted
How can I add a new physical volume to extend an existing LUKS-encrypted lvm (volume group) and maintain encryption?
You’ll need to set up encryption on the new physical device:
sudo cryptsetup luksFormat /dev/newdevice
(replacing newdevice as appropriate).
Then open it:
sudo cryptsetup luksOpen /dev/newdevice ...
- 450k
16
votes
Accepted
Overwritten LUKS with a partition table
cryptsetup repair, Part Two — Full Header Recovery
See also: cryptsetup repair, Part One — Magic Bytes Recovery
In order to recover a partially overwritten LUKS2 header, you need at minimum two ...
- 49.9k
15
votes
Accepted
Mount encrypted partition of an image file
fdisk is being a bit stupid here: when displaying device names for the partitions, it just takes the name of the whole-disk device given to it, and appends the partition number (prefixed with p if the ...
- 102k
15
votes
Accepted
What is the epoch of LUKS that is shown when running luksDump?
The Epoch increases every time you change anything in your LUKS header (like when adding or removing keys, etc.).
The LUKS2 header specification states:
uint64_t seqid; // sequence ID, increased on ...
- 49.9k
14
votes
Accepted
How to resize a LUKS device, revisited
You still have to resize the filesystem using the resized block device. The precise method and possible limitations depend on each filesystem.
Here are two examples to resize the filesystems to the ...
- 37.5k
12
votes
Unlock LUKS encrypted Debian root with key file on boot partition
Keyfiles matching the shell-style (globbing) pattern KEYFILE_PATTERN defined in /etc/cryptsetup-initramfs/conf-hook will be included in the initramfs, but the other keyfiles will not, according to ...
- 354
12
votes
Accepted
Serious backup options for linux disk (dmcrypt, luks, ext4, ext3, btrfs) normal and encrypted system
Linux system backup
When targeting a true full system backup, disk image backup (as asked) offer substantial advantage (detailed bellow) compared to files based backup.
With files based backup disk/...
- 14.7k
12
votes
Accepted
cryptsetup: verification in luksOpen is non-deterministic when reading the password from a file
@frostschutz was correct. It turns out that the memory on my machine shows errors in a Memtest86+ run.
The most likely explanation is that the computation works or fails depending on what part of the ...
- 4,887
11
votes
Is it possible to encrypt a hard disk with a key file instead of a password?
One of the best ways to do this is to use a smart card with a crypto key on it to unlock the keys for your encrypted block devices. You will only need to enter the passphrase (called "PIN" by the ...
- 44.7k
11
votes
Accepted
How to answer YES automatically with a cryptsetup luksFormat command?
You could make use of the --batch-mode, -q option of cryptsetup to skip the question.
$ cryptsetup -q luksFormat /dev/sdb
This option also disables password verification, so one should use it with ...
- 6,462
11
votes
Accepted
Partition still encrypted with luks after wipefs
wipefs -a /dev/sdx only wipes magic signatures on that device, not on its partitions. So at best, it only wipes your partition table, but if you then proceed to re-create the partitions at the same ...
- 49.9k
Only top scored, non community-wiki answers of a minimum length are eligible