Encrypt a partition with Dm-crypt and Linux Unified Key Setup

Dm-crypt is preferred over TrueCrypt, since dm-crypt is included in the linux kernel and since most distributions include the cryptsetup or cryptsetup-luks package. Moreover, volume encryption (rather than the per file encryption that you get with ecryptfs) is preferred, unless you need to do incremental backups of your file system. LUKS (or Linux Unified Key Setup) is the upcoming standard for Linux hard disk encryption. So, I recommend the cryptsetup-luks package.

First, fill an encrypted disk with initial random data. This makes breaking the passphrase so much harder.
/sbin/badblocks -c 10240 -s -w -t random -v /dev/sdd
OR
dd if=/dev/urandom of=/dev/sdd

Next, partition the new drive.
/sbin/fdisk /dev/sdd

Next, it is time to create a LUKS passphrase.
cryptsetup –verbose –verify-passphrase luksFormat /dev/sdd1
Enter a passphrase of your choice, the longer and more complex the better.

Now, map the logical partition to the physical partition.
cryptsetup luksOpen /dev/sdd1 crypt1
OR
cryptsetup luksOpen /dev/sdd1 sdd1
After you map it, confirm that you created a logical device
ls -al /dev/mapper

Next, format the logical device.
/sbin/mkfs.ext3 -j /dev/mapper/sdc1

Finally, mount the logical device.
mkdir /data
mount /dev/mapper/crypt1 /data

A good Web site for the commands above is:
saout.de

To add an additional passphrase key:
cryptsetup luksAddKey /dev/sdd1

To delete the first passphrase key:
cryptsetup luksDelKey /dev/sdd1 0
Warning: Your data will be lost forever if you delete all of your keys.

To unmount and close:
umount /data
cryptsetup luksClose sdd1

To remount:
cryptsetup luksOpen /dev/sdd1 sdd1
mount /dev/mapper/crypt1 /data

Leave a Reply