Block Device Encryption - dm-crypt - Revision history

NKirnbauer: fixed "Pages using deprecated source tags"

2024-09-03T10:07:47Z

fixed "Pages using deprecated source tags"

← Older revision		Revision as of 10:07, 3 September 2024
Line 9:		Line 9:
	== TL;DR ==		== TL;DR ==

	<~~source~~ lang="bash"># Encrypt block device		<syntaxhighlight lang="bash"># Encrypt block device
	sudo cryptsetup luksFormat $BLOCK_DEVICE		sudo cryptsetup luksFormat $BLOCK_DEVICE
	# Generate a random keyfile		# Generate a random keyfile
Line 23:		Line 23:
	# USE IT.		# USE IT.
	man cryptsetup		man cryptsetup
	</~~source~~>		</syntaxhighlight>

	== Encryption ==		== Encryption ==
Line 29:		Line 29:
	Initializes a LUKS partition and sets the initial passphrase (''for key-slot 0''). LUKS2 is used by default. All available algorithms (''cipher, hash'') are listed in <code>/proc/crypto</code> or use <code>cryptsetup benchmark</code>.		Initializes a LUKS partition and sets the initial passphrase (''for key-slot 0''). LUKS2 is used by default. All available algorithms (''cipher, hash'') are listed in <code>/proc/crypto</code> or use <code>cryptsetup benchmark</code>.

	<~~source~~ lang="bash"># CHANGE THIS VARIABLE TO THE APPROPRIATE BLOCK DEVICE		<syntaxhighlight lang="bash"># CHANGE THIS VARIABLE TO THE APPROPRIATE BLOCK DEVICE
	BLOCK_DEVICE="/dev/sdb1"		BLOCK_DEVICE="/dev/sdb1"

Line 39:		Line 39:
	# Verify: Inspect device content		# Verify: Inspect device content
	sudo hexdump -C $BLOCK_DEVICE \| less		sudo hexdump -C $BLOCK_DEVICE \| less
	</~~source~~>		</syntaxhighlight>
	'''Additional <code>luksFormat</code> parameters''':		'''Additional <code>luksFormat</code> parameters''':

Line 52:		Line 52:
	In the following a keyfile will be added to the LUKS header key store to use with <code>crypttab</code> for automatic device unlocking and mapping at boot. The resulting mapped device can be added a filesystem via <code>mkfs</code> and automatically mounted using <code>fstab</code>.		In the following a keyfile will be added to the LUKS header key store to use with <code>crypttab</code> for automatic device unlocking and mapping at boot. The resulting mapped device can be added a filesystem via <code>mkfs</code> and automatically mounted using <code>fstab</code>.

	<~~source~~ lang="bash"># CHANGE THIS VARIABLE TO A SAFE LOCATION TO STORE THE KEYFILE		<syntaxhighlight lang="bash"># CHANGE THIS VARIABLE TO A SAFE LOCATION TO STORE THE KEYFILE
	KEYFILE="/root/key.bin"		KEYFILE="/root/key.bin"
	# CHANGE THIS VARIABLE TO THE NAME OF THE DEVICE MAPPER MOUNTPOINT		# CHANGE THIS VARIABLE TO THE NAME OF THE DEVICE MAPPER MOUNTPOINT
Line 73:		Line 73:
	# Reboot. Then Verify.		# Reboot. Then Verify.
	lsblk "/dev/mapper/$MAPPER_NAME"		lsblk "/dev/mapper/$MAPPER_NAME"
	</~~source~~>		</syntaxhighlight>
	== References ==		== References ==

Ikramer at 18:27, 12 March 2024

2024-03-12T18:27:23Z

← Older revision		Revision as of 18:27, 12 March 2024
Line 82:		Line 82:

	[[Category:Documentation]]		[[Category:Documentation]]
			[[Category:Basics]]

JPDoe: Minor: Added to Category Documentations

2020-09-17T17:10:31Z

Minor: Added to Category Documentations

← Older revision		Revision as of 17:10, 17 September 2020
Line 80:		Line 80:
	* https://wiki.archlinux.org/index.php/Dm-crypt/Device_encryption		* https://wiki.archlinux.org/index.php/Dm-crypt/Device_encryption
	* https://wiki.archlinux.org/index.php/Dm-crypt/System_configuration#crypttab		* https://wiki.archlinux.org/index.php/Dm-crypt/System_configuration#crypttab

			[[Category:Documentation]]

JPDoe: Major: Initial version

2020-09-17T16:30:54Z

Major: Initial version

New page

This document describes for Linux-based systems, how to encrypt a block device using LUKS/dm-Crypt/cryptsetup and automatically unlock and map the encrypted block device on boot.

== Requirements ==

* Linux-based Operating System (''Here: Ubuntu 20.04 LTS'')
* Plain dm-crypt and LUKS encrypted volumes manager installed (<code>apt install cryptsetup</code>) (''Here: v2.2.2'')
* Block device (''e.g. partition'') that is unmapped and ready to encrypt. (''Any content will be lost!'')

== TL;DR ==

<source lang="bash"># Encrypt block device
sudo cryptsetup luksFormat $BLOCK_DEVICE
# Generate a random keyfile
sudo dd if=/dev/urandom bs=256 count=1 of=$KEYFILE
# Add keyfile to the LUKS header key store
sudo cryptsetup luksAddKey $BLOCK_DEVICE $KEYFILE
# Unlock and map the encrypted device on boot via UUID (See: man crypttab)
UUID=`sudo cryptsetup luksUUID $BLOCK_DEVICE`
echo "$MAPPER_NAME UUID=$UUID $KEYFILE" | sudo tee -a /etc/crypttab
# Dump the header information of a LUKS device.
sudo cryptsetup luksDump $BLOCK_DEVICE

# USE IT.
man cryptsetup
</source>

== Encryption ==

Initializes a LUKS partition and sets the initial passphrase (''for key-slot 0''). LUKS2 is used by default. All available algorithms (''cipher, hash'') are listed in <code>/proc/crypto</code> or use <code>cryptsetup benchmark</code>.

<source lang="bash"># CHANGE THIS VARIABLE TO THE APPROPRIATE BLOCK DEVICE
BLOCK_DEVICE="/dev/sdb1"

# Encrypt block device (Here: using defaults)
sudo cryptsetup luksFormat $BLOCK_DEVICE

# Verify: Dump the header information
sudo cryptsetup luksDump $BLOCK_DEVICE
# Verify: Inspect device content
sudo hexdump -C $BLOCK_DEVICE | less
</source>
'''Additional <code>luksFormat</code> parameters''':

<code>--cypher</code>: (Default: '''aes-xts-plain64''')<br />
<code>--key-size</code>: (Default: '''256''')<br />
<code>--hash</code>: Algorithm used to derive the key. (Default: '''sha256''')<br />
<code>--time</code>: The time used for passphrase processing. (Default: '''2000''') milliseconds.<br />
<code>--use-random/--use-urandom</code>: Used RNG. (Default: '''--use-urandom''')

== Auto-Mount during Boot ==

In the following a keyfile will be added to the LUKS header key store to use with <code>crypttab</code> for automatic device unlocking and mapping at boot. The resulting mapped device can be added a filesystem via <code>mkfs</code> and automatically mounted using <code>fstab</code>.

<source lang="bash"># CHANGE THIS VARIABLE TO A SAFE LOCATION TO STORE THE KEYFILE
KEYFILE="/root/key.bin"
# CHANGE THIS VARIABLE TO THE NAME OF THE DEVICE MAPPER MOUNTPOINT
MAPPER_NAME="enc_dev"

# Generate a random Keyfil and limit access
sudo dd if=/dev/urandom bs=32 count=1 of=$KEYFILE
sudo chmod 400 $KEYFILE

# Add keyfile to the LUKS key storage (max. 8)
sudo cryptsetup luksAddKey $BLOCK_DEVICE $KEYFILE
# Remove: sudo cryptsetup luksRemoveKey $BLOCK_DEVICE
# The passphrase (aka. key-slot 0) remains as backup key

# The crypttab file describes encrypted block devices that are set up during system boot.
# Format: volume-name encrypted-device key-file options
UUID=`sudo cryptsetup luksUUID $BLOCK_DEVICE`
echo "$MAPPER_NAME UUID=$UUID $KEYFILE" | sudo tee -a /etc/crypttab

# Reboot. Then Verify.
lsblk "/dev/mapper/$MAPPER_NAME"
</source>
== References ==

* https://gitlab.com/cryptsetup/cryptsetup/
* https://wiki.archlinux.org/index.php/Dm-crypt/Drive_preparation
* https://wiki.archlinux.org/index.php/Dm-crypt/Device_encryption
* https://wiki.archlinux.org/index.php/Dm-crypt/System_configuration#crypttab