Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Task: in CentOS 6.x system, set up and mount automatically encrypted filesystem, residing within a regular file, using one-time (random) key.

/etc/crypttab in CentOS 6.* doesn't allow using plain file as block device to mount and map automatically.

So, /etc/crypttab line like this

cfs   /var/file-with-encrypted-filesystem    some-password-source

gets ignored in CentOS.

The following sequence of commands can be used to do the task in CentOS:

losetup /dev/loop0 /var/tmpfile
dd if=/dev/urandom of=/dev/shm/tmppass bs=512 count=1
cryptsetup luksFormat /dev/loop0 --use-urandom --batch-mode --key-file /dev/shm/tmppass
cryptsetup luksOpen /dev/loop0 ctmp --batch-mode --key-file /dev/shm/tmppass
mkfs.ext2 /dev/mapper/ctmp
mount -t ext2 /dev/mapper/ctmp /mountpoint
shred -n 1 /dev/shm/tmppass
rm -f /dev/shm/tmppass

assuming file to hold filesystem is /var/tmpfile

Is there less cumbersome way to achieve the same in Debian-like way (specifying relevant entries in /etc/crypttab and /etec/fstab )?

share|improve this question
up vote 3 down vote accepted

The following /etc/crypttab entry is how you'd do it in Ubuntu:

# <target name>  <source device>                      <key file>    <options>
cfs              /var/file-with-encrypted-filesystem  /dev/urandom  tmp=ext4

Very similar to how crypted swap is handled - see the crypttab manpage example below:

# Encrypted swap device
cswap /dev/sda6 /dev/urandom cipher=aes-cbc-essiv:sha256,hash=ripemd160,size=256,swap

Does the manpage on CentOS for crypttab provide any guidance on doing this? Don't have a CentOS machine around at the moment, but on a RHEL 6 machine the same options are supported.

OK fine, I was curious. This works and it's a little nicer. Put it somewhere like /etc/rc.local. Tested on RH 6:

LODEV=$(losetup -f)
losetup $LODEV /path/to/existing/cryptfile
cryptsetup create cfs $LODEV --key-file /dev/urandom
mkfs.ext2 /dev/mapper/cfs 
mount /dev/mapper/cfs /wherever
share|improve this answer
Tested, thanks. Your script works fine in CentOS 6.x I posted this question just because I didn't find (in CentOS man pages related to LUKS/cryptsetup) any hint to do what I need. Looks like I still have the only choice, mount/umount such a filesystem via initscript. Thanks! – Konstantin Boyandin Sep 11 '13 at 7:39

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.