Find encrypted partitions
- lsblk -lf | grep LUKS
Manually mounting an encrypted partition
- $ sudo cryptsetup luksOpen /dev/sda1 encrypted_partition
- $ sudo mkdir /media/decrypted_partition
- $ sudo mount /dev/mapper/encrypted_partition /media/decrypted_partition
Manually unmounting a temporarily decrypted partition
- $ sudo umount /media/decrypted_partition
- $ sudo cryptsetup luksClose encrypted_partition
Encrypting a partition on Ubuntu 7.10 (Gutsy) using cryptsetup (LUKS)
- fdisk your partitions and remember them.
I will use sdb2 in my example.
- $ sudo apt-get install cryptsetup
- $ sudo cryptsetup luksFormat /dev/sdb2 -c aes -s 256 -h sha256
WARNING! ======== This will overwrite data on /dev/sdb2 irrevocably. Are you sure? (Type uppercase yes): YES Enter LUKS passphrase:
This is where you make up a password.
- sudo cryptsetup luksOpen /dev/sdb2 backup
I called it backup, you can call it whatever you want. You can do
$ ls -la /dev/mapper
and you should be able to see it!
- $ sudo mke2fs -j /dev/mapper/backup -L backup
You can label it whatever you want, most people use the same as that in /dev/mapper/ for simplicity. This also assumes you want an ext3 filesystem (the -j option). Make whatever filesystem you prefer. You can now mount /dev/mapper/backup manually, or add it to /etc/fstab and /etc/crypttab if it's a static partition.
From passphrase prompt to a file
Although not recommended unless you're aware of the repercussions, you may wish to store the passphrase in a file on your system instead of being prompted. If this is the case, you can create a file either randomly:
$ sudo dd if=/dev/urandom of=/root/lukssecretkey bs=1024 count=4
or manually create a file with any passphrase in it you choose. Assuming sdc5 is the partition you want to encrypt, add the new key:
$ sudo cryptsetup luksAddKey /dev/sdc5 /root/lukssecretkey
finally you want to edit your /etc/crypttab entry to use the keyfile:
# <target name> <source device> <key file> <options> crypto /dev/sdc5 /root/lukssecretkey luks,check=ext2,retry=5