Cryptsetup reference for full disk encryption

May 05, 2019 / linux, terminal

cryptsetup provides an interface to dm-crypt (including LUKS) and can be used to easily encrypt, decrypt, and otherwise manage encrypted disks and partitions.

Formatting

cryptsetup -y -v luksFormat /dev/<some device>

This will create a LUKS device that can be formatted as usual after it is unlocked. This will also erase the device.

Mapping/unlocking

cryptsetup luksOpen /dev/<some device> <some mapping name>

Viewing status

cryptsetup -v status <some mapping name>

Dumping LUKS header

cryptsetup luksDump /dev/<some device>

Mounting

mount /dev/mapper/<some mapping name> <some mount point>

Locking

umount <some mount point> cryptsetup luksClose <some mapping name>

Adding a passphrase

cryptsetup luksAddKey /dev/<some device>

Removing a passphrase

cryptsetup luksRemoveKey /dev/<some device>

To change the passphrase, simply add a new one and then remove the old one.

Typical workflow

In most cases the following steps take place:

1. Unlock/map the LUKS device.
2. Mount the mapper device.
3. Access the data at will.
4. Unmount the mapper device.
5. Lock the LUKS device.

Gnome on Ubuntu (and most probably other distributions) includes support for performing most of these tasks through a GUI. It also offers the option of saving the encryption passphrase in the system keychain.

Links

• cryptsetup command manual page
• cryptsetup and LUKS project
• dm-crypt Wikipedia page