Hot answers tagged

40

Yes, you can do this by accessing the master key while the volume is decrypted. The quick and dirty to add a new passphrase: device=/dev/sda5 volume_name=foo cryptsetup luksAddKey $device --master-key-file <(dmsetup table --showkeys $volume_name | awk '{ print $5 }' | xxd -r -p) device and volume_name should be set appropriately. volume_name is the ...


34

OK! The definitive answer finally. My steps to expand a LUKS encrypted volume... cryptsetup luksOpen /dev/sda2 crypt-volume to open the encrypted volume. parted /dev/sda to extend the partition. resizepart NUMBER END. vgchange -a n fedora_chocbar. Stop using the VG so you can do the next step. cryptsetup luksClose crypt-volume. Close the encrypted volume ...


24

dmsetup is useful for anything device mapper related. For Example: [root@localhost]~# dmsetup ls --target crypt luks-90dc732d-e183-4948-951e-c32f3f11b305 (253, 0) [root@localhost]~#


22

In LUKS scheme, you have 8 "slots" for passwords or key files. First, check, which of them are used: cryptsetup luksDump /dev/<device> |grep BLED Then you can add, change or delete chosen keys: cryptsetup luksAddKey /dev/<device> (/path/to/<additionalkeyfile>) cryptsetup luksChangeKey /dev/<device> -S 6 As for deleting keys, you ...


18

The answer (as I now know): concurrency. In short: My sequential write, either using dd or when copying a file (like... in daily use), becomes a pseudo-random write (bad) because four threads are working concurrently on writing the encrypted data to the block device after concurrent encryption (good). Mitigation (for "older" kernels) The negative effect ...


16

You can enable this by installing dropbear-initramfs and following the instructions to configure your SSH keys. This will start an SSH server from the initramfs, allowing you to connect remotely and enter your encryption passphrase.


15

After backing up (step 1) and unmounting (between 2 and 3), run fsck to ensure that the filesystem is healthy: e2fsck -f /dev/mapper/ExistingExt4 Other than that, the steps are OK. what should I choose for $SECTORS? Is this step even necessary? This step is necessary, otherwise the partition would still show up at the old side. This is confirmed with ...


14

As you've discovered, you can use cryptsetup luksDump to see which key slots have keys. You can check the passphrase for a particular slot with cryptsetup luksOpen --test-passphrase --key-slot 0 /dev/sda2 && echo correct This succeeds if you enter the correct passphrase for key slot 0 and fails otherwise (including if the passphrase is correct for ...


13

Backup Reformat Restore cryptsetup luksRemoveKey would only remove an encryption key if you had more than one. The encryption would still be there. The Fedora Installation_Guide Section C.5.3 explains how luksRemoveKey works. That it's "impossible" to remove the encryption while keeping the contents is just an educated guess. I base that on two things: ...


12

cryptsetup luksDump /dev/fedora/01 shows the LVM logical volume to be a LUKS encrypted volume. The output of pvs or pvdisplay would show the partition /dev/sda3 to be a physical volume. Thus you have LUKS over LVM. At a lower level, you have LVM over PC partition. The output of lsblk confirms this: sda is a disk, sda3 is a partition (which contains an LVM ...


12

It's about online resize. For example if you use LVM, create a LV of 1G size, and put LUKS on that, it's like this: # lvcreate -L1G -n test VG # cryptsetup luksFormat /dev/mapper/VG-test # cryptsetup luksOpen /dev/mapper/VG-test lukstest # blockdev --getsize64 /dev/mapper/VG-test 1073741824 # blockdev --getsize64 /dev/mapper/lukstest 1071644672 So the ...


11

My solution to LUKS and keyboard layout problems is to add the passphrase twice. So the same sequence of key presses will be accepted in both US/qwerty layout and whatever you usually use (in my case, DE/qwertz). If you use more than one keyboard layout you can add more passphrases for them; LUKS supports up to 8 in total, and most people never use more ...


11

I don't know of a single-command way to do this. The GUI programs are doing a fair bit of interrogation of the disk to take the "right" approach and you'll need to do some of that work yourself. You don't need sudo, though, and I think the resulting sequence of events is relatively painless. The Short Answer Use udisksctl from the udisks2 package: ...


11

So I did figure it out: I partitioned the disk partialy following the handbook: # parted -a optimal /dev/sda GNU Parted 2.3 Using /dev/sda Welcome to GNU Parted! Type 'help' to view a list of commands. (parted)mklabel gpt (parted)unit mib (parted)mkpart primary 1 3 (parted)name 1 grub (parted)set 1 bios_grub on (parted)mkpart primary 3 131 (parted)name ...


11

One of the best ways to do this is to use a smart card with a crypto key on it to unlock the keys for your encrypted block devices. You will only need to enter the passphrase (called "PIN" by the tools but it's really a passphrase) once, after which it will be cached. This has the added advantage of protecting the encrypted data with something-you-have (the ...


11

In GRUB (or whatever you're using as your bootloader), add this boot option to your kernel command line: break=premount. It should give you a shell prompt while the system is still running on initramfs and the system has not yet made any attempts to mount the real root filesystem. You can use this shell prompt to check your keyboard layout.


10

In most scenarios, one of the following three schemes works well. You only want to encrypt a few particularly confidential files. Use encfs: mkdir ~/.encrypted.d ~/encrypted encfs ~/.encrypted.d ~/encrypted editor ~/encrypted/confidential-file Pros: no overhead to access non-confidential files; you can have different hierarchies with different passwords; ...


10

It doesn't work because the /etc/crypttab line is missing the option keyword luks. Changing the line to this resolved the issue: luks-01a2e5d8-9211-40ce-b160-d3f973d1a155 UUID=01a2e5d8-9211-40ce-b160-d3f973d1a155 /etc/luks-keys/luks-01a2e5d8-9211-40ce-b160-d3f973d1a155 luks,nofail This is due to the fact that cryptdisks_start uses the options to determine ...


10

cryptsetup handles image files just as well as block devices, if that was your question. So if you make a dd image (which will be freaking huge) it will work. And if it didn't, you could just create the loop device yourself. Best practice (if you want to keep the backup encrypted) is to encrypt the backup disk also, then open both containers, then run any ...


9

Warning, wall of text incoming. It's as well formatted as I could make it. If we're going to answer this, we're going to answer the whole thing. I'm not doing another answer on this, so here goes: Let's pretend you know absolutely nothing, and I'm feeding you keystrokes. This tells you everything you need to know to do this WHOLE thing, with a little ...


9

If all you want to change is the hash, there is no need to re-encrypt. You still have to build a new LUKS header though. Same cipher, same master key, same offset, different hash. You can try this for yourself. First we set up a LUKS device with standard settings and lousy iter counts: # truncate -s 8M /dev/shm/foobar # cryptsetup --iter-time=42 luksFormat ...


8

It's very odd to have a LUKS inside a plain crypt. Why encrypt twice? Once your filesystems are mounted, lsblk will show you what's what. NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT sda 8:0 0 59.6G 0 disk └─sda1 8:1 0 59.6G 0 part └─md0 9:0 0 ...


8

If the decrypted volume is /dev/mapper/crypto then you can get the information with dmsetup table crypto 0 104853504 crypt aes-cbc-essiv:sha256 000[...]000 0 254:2 4096 If the encrypted volume is /dev/storage2/crypto then you get the information with cryptsetup luksDump /dev/storage2/crypto LUKS header information for /dev/storage2/crypto Version: ...


8

wipefs -a /dev/sdx only wipes magic signatures on that device, not on its partitions. So at best, it only wipes your partition table, but if you then proceed to re-create the partitions at the same offsets at before, the old data is still there. You'd have to wipe the partitions as well. wipefs -a /dev/sdx[1-9]* # wipe old partitions wipefs -a /dev/sdx ...


8

It appears that dmsetup computes its alignment from the optimal I/O size, without bothering to check that that is actually a multiple of the physical block size. As mentioned in the false warning question, this optimal I/O size makes sense due to USB constraints. So the solution is simple: use --align-payload to override the detected value. A value of 8 ...


7

Your approach looks good. Some remarks though: If you want to encrypt rootfs, you'll need to use initrd (to have some minimal unencrypted system that will process the encrypted partitions). If the USB device is removable, both initrd and kernel can be stored on the USB to heighten tamper resistance (supposing you make sure the USB won't get into ...


7

You can use /lib/cryptsetup/scripts/decrypt_derived in your crypttab to automatically use the key from one disk for another. The decrypt_derived script is part of Debian's cryptsetup package. Small example to add the key from sda6crypt to sda5: /lib/cryptsetup/scripts/decrypt_derived sda6crypt > /path/to/mykeyfile cryptsetup luksAddKey /dev/sda5 /path/...


7

I've implemented support for storing your LUKS key in TPM NVRAM, and RHEL6 happens to be the one platform where all features are fully tested, see this post: [1] https://security.stackexchange.com/a/24660/16522


7

The simplest method is to make the backup system independent of the encryption system. Create an encrypted volume for the backup. Mount both the original volume and the backup volume, and run your favorite filesystem-level backup software. Besides the simplicity, an advantage with this method is that the backup volume doesn't have to have the same size and ...


7

For the prompt to work, you need to add -t. ssh -t root@host cryptsetup luksOpen /dev/thing luksthing (It also works if you just type out your password when it's "stuck" waiting for input, but it will echo in your local terminal.) Alternatively, piping the passphrase works well enough: echo -n 'password' | ssh root@host cryptsetup luksOpen /dev/thing ...


Only top voted, non community-wiki answers of a minimum length are eligible