Cryptsetup Create Linux Encrypted Volumes

2017-09-28 · linux, security, encryption

What’s Cryptsetup?

According to the Cryptsetup GitLab project page, Cryptsetup is a utility used to conveniently set up disk encryption based on the DMCrypt kernel module.

Supported formats include plain dm-crypt volumes, LUKS volumes, loop-AES, and TrueCrypt formats (including the VeraCrypt extension).

The project also includes veritysetup, a utility used to conveniently set up the DMVerity block integrity checking kernel module.

To install Cryptsetup:

  # yum install -y cryptsetup

Activate Dmcrypt:

  # modprobe dm_crypt

Create the file to encrypt:

  # dd if=/dev/zero bs=1M count=1024 of=/home/myname/safe

Technically we are converting and copying a file. if: input file, we are using /dev/zero to fill the file with null characters (ASCII NUL, 0x00). of: output file, Write to FILE instead of standard output. bs: Block size, for both read and write, default is 512. count: copy only N input blocks, in our example we will copy 1Mx1024, the output file size will be 1GB.

Format the newly created file:

    # cryptsetup luksFormat /home/myname/safe
        WARNING!
        This will overwrite data on safe irrevocably.
        Are you sure? (Type uppercase yes): YES
        Enter passphrase:
        Verify passphrase:

This initializes the LUKS partition and sets the initial key. You need to remember this passphrase — it is the key you will use to mount or open the file.

Now, we need to open the LUKS partition:

  # cryptsetup luksOpen device name
  # cryptsetup luksOpen /home/myname/safe safe-encrypt

This command opens the LUKS partition device and sets up a mapping name after successful verification of the passphrase.

Let’s create XFS file system, you can use other file systems, adjust the command accordingly:

  # mkfs.xfs /dev/mapper/safe-encrypt

Close the LUKS partition:

  # cryptsetup luksClose name
  # cryptsetup luksClose safe-encrypt

At this point you have an encrypted LUKS partition, but you still need a mount point to access it. For this, we need to open the LUKS partition again:

  # cryptsetup luksOpen /home/myname/safe safe-encrypt

When prompted, enter your password.

Create a mount point, I chose “/mnt/encrypted”:

  # mkdir /mnt/encrypted

Mount LUKS partition:

  # mount /dev/mapper/safe-encrypt /mnt/encrypted

If you run df -h or mount | grep safe-encrypt, you should see the newly mounted partition:

   # /dev/mapper/safe-encrypt     1019M   34M  986M   4% /mnt/encrypted

When you are done working on the partition, unmount the file system then close the LUKS partition:

  # umount /mnt/encrypted
  # cryptsetup luksClose safe-encrypt