LUKS dm-crypt/Device encryption GUIDE

LUKS dm-crypt/Device encryption GUIDE

This section covers how to manually utilize dm-crypt from the command line to encrypt a system.

• 1 Preparation
• 2 Cryptsetup usage
  • 2.1 Cryptsetup passphrases and keys
• 3 Encryption options with dm-crypt
  • 3.1 Encryption options for LUKS mode
  • 3.2 Encryption options for plain mode
• 4 Encrypting devices with cryptsetup
  • 4.1 Encrypting devices with LUKS mode
    • 4.1.1 Formatting LUKS partitions
      • 4.1.1.1 Using LUKS to format partitions with a keyfile
    • 4.1.2 Unlocking/Mapping LUKS partitions with the device mapper
  • 4.2 Encrypting devices with plain mode
• 5 Cryptsetup actions specific for LUKS
  • 5.1 Key management
    • 5.1.1 Adding LUKS keys
    • 5.1.2 Removing LUKS keys
  • 5.2 Backup and restore
    • 5.2.1 Backup using cryptsetup
    • 5.2.2 Restore using cryptsetup
    • 5.2.3 Manual backup and restore
  • 5.3 Re-encrypting devices
    • 5.3.1 Encrypt an unencrypted filesystem
    • 5.3.2 Re-encrypting an existing LUKS partition
• 6 Resizing encrypted devices
  • 6.1 Loopback filesystem
• 7 Keyfiles
  • 7.1 Types of keyfiles
    • 7.1.1 passphrase
    • 7.1.2 randomtext
    • 7.1.3 binary
  • 7.2 Creating a keyfile with random characters
    • 7.2.1 Storing the keyfile on a filesystem
      • 7.2.1.1 Securely overwriting stored keyfiles
    • 7.2.2 Storing the keyfile in ramfs
  • 7.3 Configuring LUKS to make use of the keyfile
  • 7.4 Manually unlocking a partition using a keyfile
  • 7.5 Unlocking a secondary partition at boot
  • 7.6 Unlocking the root partition at boot
    • 7.6.1 With a keyfile stored on an external media
      • 7.6.1.1 Configuring mkinitcpio
      • 7.6.1.2 Configuring the kernel parameters
    • 7.6.2 With a keyfile embedded in the initramfs