|
|
|
|
@ -1,44 +1,86 @@
|
|
|
|
|
# DM-Crypt
|
|
|
|
|
|
|
|
|
|
`dm-crypt` can create and manage encrypted devices.
|
|
|
|
|
DM-Crypt can create and manage encrypted devices.
|
|
|
|
|
|
|
|
|
|
## Creating an encrypted devices
|
|
|
|
|
|
|
|
|
|
## Usage
|
|
|
|
|
|
|
|
|
|
### Creating an Encrypted Devices
|
|
|
|
|
|
|
|
|
|
To create a encrypted device simply run:
|
|
|
|
|
`cryptsetup -y -v luksFormat /dev/sda2`.
|
|
|
|
|
Where `/dev/sda2` is the device you want to create.
|
|
|
|
|
Where `/dev/sda2` is the device to be created.
|
|
|
|
|
|
|
|
|
|
## Open/Close an encrypted device
|
|
|
|
|
### Create/Add a Key File to an encrypted volume
|
|
|
|
|
|
|
|
|
|
To open and map a device run `cryptsetup luksOpen /dev/sda1 crypt0` where
|
|
|
|
|
`/dev/sda1` is your encrypted device and `crypt0` is where it will be mapped to
|
|
|
|
|
with `dev/mapper/crypt0`.
|
|
|
|
|
Afterwards it can be closed by running `cryptsetup close /dev/mapper/crypt0`.
|
|
|
|
|
First a key file has to be created.
|
|
|
|
|
With the following lines a random file will be created that will later be used
|
|
|
|
|
as the key file.
|
|
|
|
|
If a key file already exists this part can be skipped.
|
|
|
|
|
The following command needs to be adapted.
|
|
|
|
|
It will create a key of bitlength 2048 (512 x 4).
|
|
|
|
|
|
|
|
|
|
```txt
|
|
|
|
|
dd bs=512 count=4 if=/dev/random of=<path to destination>
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
It is possible to increase the length to get a stronger key file.
|
|
|
|
|
Alternatively strong LUKS keys can be created using [OpenSSL](./openssl.md)
|
|
|
|
|
using a bitlength of 4096:
|
|
|
|
|
`openssl genrsa -out <path to destination> 4096`.
|
|
|
|
|
The key file will then be saved to `<path to destination>`.
|
|
|
|
|
|
|
|
|
|
Finally the key file can be added to an opened LUKS encrypted volume by running
|
|
|
|
|
the following command:
|
|
|
|
|
`cryptsetup luksAddKey <path to LUKS volume> <path to key file>`.
|
|
|
|
|
|
|
|
|
|
`<path to LUKS device>` is the encrypted device (for example `/dev/sda2`) and
|
|
|
|
|
`<path to key file>` is the location of the key file.
|
|
|
|
|
|
|
|
|
|
## Resize a LUKS encrypted volume
|
|
|
|
|
### Resize a LUKS Encrypted Volume
|
|
|
|
|
|
|
|
|
|
If you have volume groups on the encrypted volume make sure to close them
|
|
|
|
|
with the following command modified to your needs:
|
|
|
|
|
If volume groups on the encrypted volume are opened make sure to close them
|
|
|
|
|
with the following command modified to the present needs:
|
|
|
|
|
`vgchange -a n <volume group>`
|
|
|
|
|
|
|
|
|
|
Open the encrypted volume (assuming its stored at `/dev/sda2` and you map it
|
|
|
|
|
to `crypt-volume`):
|
|
|
|
|
`cryptsetup luksOpen /dev/sda2 crypt-volume`
|
|
|
|
|
Open the encrypted volume:
|
|
|
|
|
`cryptsetup luksOpen <path to LUKS volume> <mapper location>`.
|
|
|
|
|
`<path to LUKS device>` is the encrypted device (for example `/dev/sda2`) and
|
|
|
|
|
`<mapper location>` is where it will be mapped to with `dev/mapper/` prepended.
|
|
|
|
|
|
|
|
|
|
Now resize the encrypted volume to all available space of the partition.
|
|
|
|
|
If you don't want to extend the encrypted volume to the whole partition
|
|
|
|
|
or the partition is to small for your purposes, make sure to resize the
|
|
|
|
|
If the encrypted volume should not be extended to the whole partition
|
|
|
|
|
or the partition is too small for its intended purposes, make sure to resize the
|
|
|
|
|
partition first accordingly (see [disk management](./disk-management.md)).
|
|
|
|
|
`cryptsetup resize crypt-volume`
|
|
|
|
|
|
|
|
|
|
## Creating an automatic decryption key with an USB stick
|
|
|
|
|
### Open/Close an Encrypted Volume
|
|
|
|
|
|
|
|
|
|
This guide assumes you to have an Arch Linux System, as installed in
|
|
|
|
|
To open and map a device using a set password run
|
|
|
|
|
`cryptsetup luksOpen <path to LUKS device> <mapper location>` where
|
|
|
|
|
`<path to LUKS device>` is the encrypted device (for example `/dev/sda2`) and
|
|
|
|
|
`<mapper location>` is where it will be mapped to with `dev/mapper/` prepended.
|
|
|
|
|
Using `secret` as a `<map location>` the opened drive is available at
|
|
|
|
|
`/dev/mapper/secret`.
|
|
|
|
|
|
|
|
|
|
Alternatively an encrypted volume can be decrypted using
|
|
|
|
|
[a key file](#createadd-a-key-file-to-an-encrypted-volume) if set up for it.
|
|
|
|
|
This can be achieved by running:
|
|
|
|
|
`cryptsetup luksOpen <path to LUKS volume> crypt-volume --key-file=<key file location>`.
|
|
|
|
|
`<path to LUKS device>` is the encrypted device (for example `/dev/sda2`).
|
|
|
|
|
|
|
|
|
|
Afterwards it can be closed by running `cryptsetup close /dev/mapper/crypt0`.
|
|
|
|
|
|
|
|
|
|
### Creating/Add a USB Decryption Key
|
|
|
|
|
|
|
|
|
|
This guide assumes an Arch Linux System, as installed in
|
|
|
|
|
[this wikis arch linux installation](./arch-linux/installation.md).
|
|
|
|
|
This section is based on entries from the
|
|
|
|
|
[arch linux forum](https://forum.archlinux.de/d/28886-systementschluesselung-per-usb-stick).
|
|
|
|
|
It uses a similar technique to the decryption of the encrypted volume via
|
|
|
|
|
[a key file](#createadd-a-key-file-to-an-encrypted-volume).
|
|
|
|
|
|
|
|
|
|
Insert your USB stick.
|
|
|
|
|
Insert the USB stick.
|
|
|
|
|
This guide will assume its address is `/dev/sde`.
|
|
|
|
|
|
|
|
|
|
Fill in the first sectors (in this case 94, make sure this number is bigger
|
|
|
|
|
@ -55,7 +97,7 @@ called `/dev/sda2`):
|
|
|
|
|
|
|
|
|
|
Next it has to be made sure that the decryption key, is available at the same
|
|
|
|
|
position every time.
|
|
|
|
|
For this check the `serial` and `product` of your USB stick with the following
|
|
|
|
|
For this check the `serial` and `product` of the USB stick with the following
|
|
|
|
|
commands.
|
|
|
|
|
|
|
|
|
|
```sh
|
|
|
|
|
@ -64,7 +106,7 @@ udevadm info -a -p `udevadm info -q path -n /dev/sde` | grep ATTRS{product}
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
The first line gives the `serial`, the second the `product`.
|
|
|
|
|
The `product` should match your USB stick.
|
|
|
|
|
The `product` should match the USB stick.
|
|
|
|
|
|
|
|
|
|
After this create a file at `/etc/udev/rules.d/50-usbkey.rules` with the
|
|
|
|
|
following content.
|
|
|
|
|
@ -80,6 +122,17 @@ Then reload the udev rules by running:
|
|
|
|
|
Unplug the stick and plug it back in.
|
|
|
|
|
It should be available under `dev/usbkey`.
|
|
|
|
|
|
|
|
|
|
With the following command an encrypted device can be decrypted with the usb
|
|
|
|
|
stick.
|
|
|
|
|
Use this to confirm the correct setup of the decryption key and the encrypted
|
|
|
|
|
device.
|
|
|
|
|
Make sure to edit `--key-file`, `--keyfile-offset` and `--keyfile-size` to
|
|
|
|
|
match the settings used in the creation of the USB key.
|
|
|
|
|
|
|
|
|
|
```sh
|
|
|
|
|
cryptsetup luksOpen /dev/sda2 crypt-volume --key-file=/dev/usbkey --keyfile-offset=14848 --keyfile-size=2048
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
After that make sure in `/etc/mkinitcpio.conf` under the `HOOKS` section
|
|
|
|
|
`keymap encrypt lvm2` are written before `filesystems`.
|
|
|
|
|
Add `/etc/udev/rules.d/50-usbkey.rules` under the `FILES` section.
|
|
|
|
|
@ -95,13 +148,30 @@ Reboot the system with `reboot`.
|
|
|
|
|
Make sure the USB key for decryption is plugged in.
|
|
|
|
|
If so the encrypted partition should be decrypted automatically.
|
|
|
|
|
|
|
|
|
|
## Unlock an encrypted device with the USB key created in the previous section
|
|
|
|
|
### Automatical Mounting of an Encrypted Volume
|
|
|
|
|
|
|
|
|
|
With the following command an encrypted device can be decrypted with the usb
|
|
|
|
|
stick created in the previous section.
|
|
|
|
|
Make sure to edit `--key-file`, `--keyfile-offset` and `--keyfile-size` to
|
|
|
|
|
match the settings used in the creation of the USB key.
|
|
|
|
|
For automatic mounting of an encrypted volume a keyfile is needed.
|
|
|
|
|
This will be achieved by entries in the file`/etc/fstab` aswell as the file
|
|
|
|
|
`/etc/crypttab`.
|
|
|
|
|
First adapt and insert the following lines into `/etc/fstab`:
|
|
|
|
|
|
|
|
|
|
```sh
|
|
|
|
|
cryptsetup luksOpen /dev/sda2 crypt-volume --key-file=/dev/usbkey --keyfile-offset=14848 --keyfile-size=2048
|
|
|
|
|
```txt
|
|
|
|
|
/dev/mapper/<mapping location> <mount location> ext4 defaults 0 0
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
`<mapping location>` is a freely choosable identificator and while the
|
|
|
|
|
`<mount location>` is an existing directory for the volume to be mounted on.
|
|
|
|
|
|
|
|
|
|
Additionally the following lines has to be adapted and added to the file
|
|
|
|
|
`/etc/crypttab`:
|
|
|
|
|
|
|
|
|
|
```txt
|
|
|
|
|
<mapping location> UUID=<UUID of encrypted volume> <location of key file>
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
`<mapping location>` has to be the same as chosen in the step before.
|
|
|
|
|
`<UUID of encrypted volume>` is the
|
|
|
|
|
[universally unique identifier](/wiki/linux/filesystems.md#universally-unique-identifier)
|
|
|
|
|
of the volume.
|
|
|
|
|
`<location of key file>` describes the location where to find the key file
|
|
|
|
|
created in the previous step.
|
|
|
|
|
|
