LUKS (Linux Unified Key Setup) is a disk-encryption specification. It is the standard for Linux hard disk encryption.

learn more… | top users | synonyms

-1
votes
0answers
10 views

TPM-LUKS on Debian 8 (Jessie) for automatic unlocking of LUKS/dmcrypt [on hold]

I'm trying to get TPM-LUKS to work with Debian 8 (64-bit) on an Intel i7 workstation w/ a TPM chip. So far I've bee able to get TrustedGRUB2 to compile/install, and I've been able to run most of the ...
0
votes
0answers
11 views

How to create a LUKS encrypted file in a vboxsf mountpoint? [migrated]

I am trying to create a LUKS encrypted file in a VirtualBox image. It works fine unless the encrypted file resides in a VirtualBox shared folder. The error output is: 10+0 records in 10+0 records ...
0
votes
0answers
21 views

What is LUKS's process for decryption?

LUKS allows multiple passphrases for a single device, however adding or revoking a passphrase doesn't take long. So the passphrases seem to only decrypt some master key which is then used for the rest ...
0
votes
1answer
23 views

Shrink non-bootable LUKS LVM

I'm importing a VMWare OVA whose second disk uses LUKS and configured to use 1TB of space, although its VMDK is only 30GB. I want to shrink this down. I am following the instructions here (https://...
0
votes
0answers
42 views

serial console luks passphrase

I access my Dell r320 server console with IPMI (serial over lan) or with ssh on the iDRAC and with the command "console com2". It works well, i see the console output but i can't enter my luks ...
2
votes
1answer
64 views

Filesystem Performance for LUKS Encrypted Volumes?

As you can format a LUKS volume with any filesystem you want, are certain filesystems better-suited to IO performance against an encrypted filesystem? Specifically, I'm wondering about a loop device ...
3
votes
1answer
429 views

Cryptsetup luks - Check that kernel supports aes-xts-plain64 cipher

I encrypted a bunch of hard drives with cryptsetup luks encryption on CentOS 5. Everything was fine, until I upgraded my system to CentOS 6. Now I cannot mount the disks anymore. To mount with my ...
3
votes
0answers
54 views

Can servers with encrypted root filesystems be made reasonably highly available?

I have some servers I'd like to keep on encrypted disks, but I don't want to have to manually type a passphrase at every boot. I also don't want to keep the key on the machine unencrypted. TPM would ...
2
votes
0answers
44 views

Dual primary DRBD with LUKS encryption

Is it possible to create a LUKS encrypted filesystem that is accessible by both nodes of a dual primary DRBD system? Here is what I tried to do: Create two nodes and establish a partition on each ...
-1
votes
1answer
80 views

Maximum length of a LUKS passphrase

Anyone know the maximum length of a LUKS passphrase? The passphrase will be randomly generated, and I can create one with any length. I am using CentOS 6 with Linux kernel 2.6.32-573.12.1.el6.x86_64,...
7
votes
2answers
185 views

LUKS Error During Boot

I only see this error on the console during the boot process of virtual machines we create. EDIT: 2/5/16 - I see it on some bare-metal installations, too. (It does proceed to boot completely.) I ...
0
votes
0answers
50 views

Encrypted LVM stops when mounting swap

I have configured a disk with LUKS this way (Ubuntu server 15.10): Boot partition Rest partition (LVM group) LVM data -> Encrypted (pass) -> ext4 /data LVM root -> Encrypted (pass) -> ext4 / LVM ...
3
votes
0answers
34 views

How secure is information on a LUKS encrypted backup media?

Imagine confidential information (certificates, keys, whatever) stored on an LUKS encrypted backup disk containing for example an ext4 file-system. AFAIK such a device contains a key file which is in ...
0
votes
1answer
70 views

cryptsetup luksOpen key-file does not work

I am getting "No key available with this passphrase." when trying: sudo cryptsetup open --type luks /dev/sdc storage --key-file=/path/to/keyfile The /path/to/keyfile file contains just the ...
1
vote
1answer
40 views

LUKS Header - 30kB mysteriously missing

I have a disk containing (only) a LUKS encrypted volume. That was created on a bare drive with no partition table using cryptsetup v.1.6.1. When unlocked, I can check the size of the decrypted ...
0
votes
0answers
7 views

Get timestamp of last luks encryption key slot change

I cannot find anything related in the documentation of luks. Is it possible to see when the given Key Slot was last changed (ie. when the user changed his password)?
-2
votes
1answer
81 views

how do I LUKS encrypt a drive that already has data?

On a CentOS 7 server, I would like to LUKS encrypt the entire hard drive, including a 50GB partition that has already received yum install and a few other updates, but nothing else. But this tutorial ...
2
votes
0answers
300 views

how do I plan partitions for LUKS encryption of a CentOS 7 server?

A CentOS 7 web server needs encryption at rest. I would like to use LUKS encryption for this, but I need direction to plan how. Can I use LUKS encryption to encrypt the entire drive as one unit on a ...
2
votes
1answer
71 views

Why use dir_index, filetype, and sparse_super with LUKS volumes?

I have been reviewing various HOWTOs and blog posts about encrypted LUKS volumes formatted with ext3. Every single document specifies mkfs with: -O dir_index,filetype,sparse_super and not one of them ...
1
vote
1answer
90 views

Can cryptsetup read mappings from /etc/crypttab?

I have a virtualized CentOS 7 server that needs to mount multiple password-protected encrypted volumes. I cannot automatically map the devices on boot, because I don't have access to the console ...
2
votes
2answers
48 views

Linux: Detecting/thwarting system modification or use of single user mode

Working through a backup solution and could use some security assistance. Please see below. The process For our editing business, we have an offsite backup server that we update nightly using rsync ...
0
votes
1answer
135 views

Ubuntu 12.04 LUKS/dmcrypt disk to disk copy freezes

I have 2 external USB hard drives encrypted with LUKS in Ubuntu 12.04. Generally, the both drives are very slow with LUKS/dmcrypt, e.g. 7 MB/s for both read/write, but I could live with this. However,...
4
votes
1answer
204 views

Creating a grow-on-demand encrypted volume with LUKS

I am trying to create an encrypted, growing-as-needed file system in with Linux. I am familiar with LUKS and cryptsetup. I can create an empty file: fallocate -l 512M /root/image I can create a ...
0
votes
1answer
117 views

Adding new physical volume in encrypted volume group (LUKS)

I have a CentOS 6.6 desktop and chose the encrypt option upon installation. This created a LUKS volume group. Everything works fine, but I want to add an additional drive to the volume group. From ...
0
votes
1answer
36 views

What are the Security Implications of not fully overwriting a fresh LUKS disk prior to use

I recently read this nice Howto tutorial about doing backups with whole disk encryption using LUKS. Surprisingly for me this tutorial contains as the first part of step #3 a command to overwrite the ...
3
votes
1answer
654 views

LUKS full disk encryption use keyfile instead of passphrase

I have enabled LUKS full disk encryption on an LVM volume while installing centos6.6, however it asks for a passphrase every time the OS is rebooted. I am now trying to use a key file according to ...
1
vote
2answers
192 views

LUKS/dm-crypt security in the case of a break-in

This is an encryption topic I've been confused by for a while now. From what I understand of LUKS, once the LUKS volume is opened with a passphrase and the resulting device mapper device is mounted, ...
0
votes
1answer
168 views

Running python to unlock luks full disk encryption

I wish to make use of full disk encryption using Luks on ubuntu 14.04. However, i wish to make use of my own python script to carry out the functionality of generating the decryption key during device ...
1
vote
1answer
113 views

How do I replace a disk with LUKS on LVM2 - no raid, no span

I have LUKS on LVM (LVM Partitions created first, then each partition is encrypted separately, following this guide on Arch Wiki). I am using two volume groups, and each is isolated to a drive. This ...
3
votes
1answer
1k views

Removing failing drive from LVM volume group … and recovering partial data from an incomplete LV (with a missing PV)

I've been fighting this issue for some time now. I have a Logical Volume with 3 disks, 1.5TB, 2TB and 3TB. The 1.5TB drive is failing. Lots of I/O errors and dead bad sectors. I started pvmove to ...
2
votes
1answer
626 views

LUKS partition recovery

A drive with 2 partitions - the first partition is plain ext4, second one is encrypted LUKS. The partition table has been overwritten. I've found the beginning of the second partition, which I need to ...
1
vote
0answers
699 views

How to open unmounted luks volume which believes it is open

I took a snapshot of a (live) luks encrypted block device, copied it to another system and am now trying to open it, but am unable to do so. Any help with solving this problem would be much ...
1
vote
1answer
546 views

LUKS and /etc/crypttab on centos 7 - hang at startup

I have a problem with following crypttab echo "secret /dev/sdb8 none" > /etc/crypttab When I do it by hand, following way everything is ok, disk is mounted: cryptsetup luksFormat /dev/sdb8 ...
1
vote
0answers
130 views

Snapshot of BTRFS Device on top of luks Volume

I have the following problem: I can't figure out, how to create a snapshot of a btrfs volume residing on a crypted disk. This is the setup: /dev/sdb is a 1TB USB 3 disk. it has a partition /dev/...
1
vote
1answer
61 views

encrypted (luks) partition had some damage - any chance?

I was trying to run Debian installer on top of an already luks-encrypted partition (I tried to do use cryptsetup in the console). I don't remember ever saying "yes, destroy" data, but what I see now, ...
2
votes
2answers
497 views

Best way to secure Kickstart encrypted partition passwords

I have a CentOS 6.5 environment that boots up servers using Kickstart. One of the requirements of our Kickstart is that the partitions are encrypted. Since Anaconda can only take plain text passwords ...
1
vote
2answers
1k views

How do you repair a Ubuntu 14.04 RAID-LVM-DM-CRYPT-LUKS Physical to Virtual system that won't boot?

I can't get a Ubuntu 14.04 Virtual server to boot correctly. It's recently been cloned "dd if=/dev/sda of=vmimage" The Physical has a RAID1-LVM-DMCRYPT-LUKS configuration, The boot sequence aborts and ...
4
votes
2answers
1k views

BTRFS and Luks integration

I would like to build a RAID1/BTRFS/Luks setup. What I found about it so far is: An encrypted Btrfs file system can be created on top of the dm_crypt disk encryption subsystem and Linux Unified Key ...
4
votes
1answer
455 views

ZFS on LUKS not recognized at boot

I've got 6 physical drives in RAID-Z2, which I intend to one-by-one convert to dm-crypt devices. My process was roughly: dd if=/dev/zero of=/dev/sdf Create keyfile /etc/crypttab.d/crypt-1.key ...
1
vote
1answer
114 views

Encrypted partition on Debian requiring multiple keys to unlock

The title pretty much sums it up, but I want to create a second data partition on a web-facing server which is encrypted and requires two people to provide passphrases before it can be unlocked. Is ...
13
votes
3answers
5k views

ZFS RAID and LUKS encryption in Linux

I'm planning to setup a set of 3x 2TB 7200rpm drives as a LUKS-encrypted Z-RAID pool in Linux (for a NAS solution). My understanding of the problem at hand is that the only way to achieve this is to ...
1
vote
1answer
3k views

Recover data from ubuntu encrypted drive (LUKS)

I had a Host with Ubuntu 12.10 installed, and the entire harddrive was encrypted (with LUKS it appears), I remember the passphrase, but I have trouble to "open it". I am now on a beta version of ...
1
vote
2answers
8k views

Ubuntu 13.10 - How to disable LVM and cryptsetup? cryptsetup: evms_activate is not available

I am trying to remove whole drive encryption from my Ubuntu installation. I've run Ubuntu from Live CD, mounted crypt partition and copied it to another partition /dev/sda3. sudo cryptsetup luksOpen /...
0
votes
1answer
497 views

Move encrypted debian system on luks+lvm with dropbear from single SSD to SSD-RAID1

We have a debian linux server which has a single 120GB SSD and 2x2TB HDDs as RAID 1. We now have to move to another server which has 2x240GB SSD and a single 2TB HDD. The aim is to move the current ...
1
vote
1answer
170 views

ID_FS_LABEL empty for luks volume

I have an LUKS encrypted partition on a disk. I would like to label it and have it available at /dev/disk/by-label. The value used is ID_FS_LABEL to create the link in /dev/disk/by-label. That value ...
3
votes
1answer
1k views

Automounting encrypted filesystem (using random key), residing in regular file under CentOS 6.*

Task: in CentOS 6.x system, set up and mount automatically encrypted filesystem, residing within a regular file, using one-time (random) key. /etc/crypttab in CentOS 6.* doesn't allow using plain ...
1
vote
1answer
351 views

Anybody experiencing full system lockups with LUKS?

I've recently setup a couple of new servers. This time I'm encrypting most of my partitions using dmcrypt+LUKS. However these new servers crash very often, every few days. Full lockups, kernel does ...
6
votes
2answers
3k views

How secure/private is full disk encryption on a VPS? [duplicate]

Security principles say that if someone else has physical access to a machine, then there is no security/privacy. I'm wondering about some examples of this in the case where I want to have a hosted ...
1
vote
1answer
2k views

how to mount a luks-encrypted file?

I had a good-working system. Cent OS 6. But after I made a reboot luks-partition has been unmounted. And our system administrator have a weekends now :( Please help me to mount a luks partition again....
4
votes
1answer
3k views

How to non-interactively supply a passphrase to 'dmcrypt luksFormat'?

I'm writing a script which automatically sets up testing environment virtual machines. This script should automatically format a dmcrypt+LUKS partition for me, with a certain passphrase. Because this ...