LUKS (Linux Unified Key Setup) is a disk-encryption specification. It is the standard for Linux hard disk encryption.

learn more… | top users | synonyms

14
votes
3answers
6k views

ZFS RAID and LUKS encryption in Linux

I'm planning to setup a set of 3x 2TB 7200rpm drives as a LUKS-encrypted Z-RAID pool in Linux (for a NAS solution). My understanding of the problem at hand is that the only way to achieve this is to ...
9
votes
1answer
6k views

Resizing a LUKS encrypted volume

I have a 500GiB ext4 filesystem on top of LUKS on top of an LVM LV. I want to resize the LV to 100GiB. I know how to resize ext4 on top of an LVM LV, but how do I deal with the LUKS volume? mgorven@...
8
votes
3answers
5k views

Is it possible to hardware accelerate LUKS encryption?

My Linux server spends a lot of time computing LUKS encryption. Is there any way to hardware accelerate it (with a PCI express card for example)?
8
votes
4answers
1k views

On Ubuntu 11.10, is it possible to decrypt 2 hard disks encrypted with LUKS / LVM by entering only one passphrase at boot?

here the configuration I have : - 2 hard drives, - first one is encrypted using LUKS and LVM. I'd like to add in the volume group encrypted a second hard drive. I have successfully installed it and ...
7
votes
2answers
189 views

LUKS Error During Boot

I only see this error on the console during the boot process of virtual machines we create. EDIT: 2/5/16 - I see it on some bare-metal installations, too. (It does proceed to boot completely.) I ...
6
votes
2answers
14k views

Using fsck to check and repair LUKS encrypted disk?

My Ubuntu 11.04 machine uses LUKS encryption for root, swap and home. A routine fsck -n revealed a set of errors I need to repair. fsck requires to unmount the partitions. Before luks I would simply ...
6
votes
1answer
335 views

Does LUKS also encrypt free space?

I have moved to Ubuntu 12 and chosen to use full disk encryption (encrypted LVM). So now I'm wondering: should I shred (eg: with secure-delete package, srm) the free disk space to remove any remnant ...
6
votes
2answers
3k views

How secure/private is full disk encryption on a VPS? [duplicate]

Security principles say that if someone else has physical access to a machine, then there is no security/privacy. I'm wondering about some examples of this in the case where I want to have a hosted ...
5
votes
1answer
3k views

High I/O latency with software RAID, LUKS encrypted and LVM partitioned KVM setup

I found out a performance problems with a Mumble server, which I described in a previous question are caused by an I/O latency problem of unknown origin. As I have no idea what is causing this and how ...
5
votes
1answer
427 views

How to skip the luksFormat prompt?

If I setup a new luks volume with "cryptsetup --verbose --cipher=aes-cbc-essiv:sha256 --key-size=256 luksFormat /dev/foo /my/keyfile" it requires me to enter "YES" to actually do anything. Is there a ...
5
votes
1answer
282 views

Determine if LUKS/dmcrypt key is present

I am writing a Chef LWRP to add a key to a LUKS container and I'm having difficulty coming up with a way to determine whether or not my key already exists. cryptsetup luksAddKey will happily add the ...
4
votes
1answer
3k views

How to non-interactively supply a passphrase to 'dmcrypt luksFormat'?

I'm writing a script which automatically sets up testing environment virtual machines. This script should automatically format a dmcrypt+LUKS partition for me, with a certain passphrase. Because this ...
4
votes
2answers
1k views

BTRFS and Luks integration

I would like to build a RAID1/BTRFS/Luks setup. What I found about it so far is: An encrypted Btrfs file system can be created on top of the dm_crypt disk encryption subsystem and Linux Unified Key ...
4
votes
1answer
226 views

Creating a grow-on-demand encrypted volume with LUKS

I am trying to create an encrypted, growing-as-needed file system in with Linux. I am familiar with LUKS and cryptsetup. I can create an empty file: fallocate -l 512M /root/image I can create a ...
4
votes
1answer
462 views

ZFS on LUKS not recognized at boot

I've got 6 physical drives in RAID-Z2, which I intend to one-by-one convert to dm-crypt devices. My process was roughly: dd if=/dev/zero of=/dev/sdf Create keyfile /etc/crypttab.d/crypt-1.key ...
3
votes
1answer
1k views

Automounting encrypted filesystem (using random key), residing in regular file under CentOS 6.*

Task: in CentOS 6.x system, set up and mount automatically encrypted filesystem, residing within a regular file, using one-time (random) key. /etc/crypttab in CentOS 6.* doesn't allow using plain ...
3
votes
1answer
983 views

Why is mkfs overwriting the LUKS encryption header on LVM on RAID partitions on Ubuntu 12.04?

I'm trying to setup a couple of LUKS-encrypted partitions to be mounted after boot-time on a new Ubuntu server which was installed with LVM on top of software RAID. After running cryptsetup luksFormat,...
3
votes
1answer
2k views

Recover files from LUKS-encrypted partition

I have a partition encrypted with LUKS. I used it without problems every day until suddenly the password stopped working. Is there anything I can do? I have tried with a different keyboard and from a ...
3
votes
1answer
447 views

Cryptsetup luks - Check that kernel supports aes-xts-plain64 cipher

I encrypted a bunch of hard drives with cryptsetup luks encryption on CentOS 5. Everything was fine, until I upgraded my system to CentOS 6. Now I cannot mount the disks anymore. To mount with my ...
3
votes
1answer
685 views

LUKS full disk encryption use keyfile instead of passphrase

I have enabled LUKS full disk encryption on an LVM volume while installing centos6.6, however it asks for a passphrase every time the OS is rebooted. I am now trying to use a key file according to ...
3
votes
1answer
1k views

Removing failing drive from LVM volume group … and recovering partial data from an incomplete LV (with a missing PV)

I've been fighting this issue for some time now. I have a Logical Volume with 3 disks, 1.5TB, 2TB and 3TB. The 1.5TB drive is failing. Lots of I/O errors and dead bad sectors. I started pvmove to ...
3
votes
1answer
372 views

What partition is my LVM with LUKS using?

I'm trying to figure out what partition dm-X is on. It's on /dev/sdaX, but which X? What am I missing? I know there has to be a way to find this out. I need to grow my physical volume, but can't do ...
3
votes
0answers
58 views

Can servers with encrypted root filesystems be made reasonably highly available?

I have some servers I'd like to keep on encrypted disks, but I don't want to have to manually type a passphrase at every boot. I also don't want to keep the key on the machine unencrypted. TPM would ...
3
votes
0answers
34 views

How secure is information on a LUKS encrypted backup media?

Imagine confidential information (certificates, keys, whatever) stored on an LUKS encrypted backup disk containing for example an ext4 file-system. AFAIK such a device contains a key file which is in ...
2
votes
1answer
89 views

Filesystem Performance for LUKS Encrypted Volumes?

As you can format a LUKS volume with any filesystem you want, are certain filesystems better-suited to IO performance against an encrypted filesystem? Specifically, I'm wondering about a loop device ...
2
votes
1answer
642 views

LUKS partition recovery

A drive with 2 partitions - the first partition is plain ext4, second one is encrypted LUKS. The partition table has been overwritten. I've found the beginning of the second partition, which I need to ...
2
votes
1answer
743 views

Possible to set encryption block size in LUKS?

When I do a benchmark test modprobe tcrypt sec=2 mode=200 I see that different encryption block sizes are used test 0 (128 bit key, 16 byte blocks): 4460604 operations in 2 seconds (71369664 bytes)...
2
votes
1answer
76 views

Why use dir_index, filetype, and sparse_super with LUKS volumes?

I have been reviewing various HOWTOs and blog posts about encrypted LUKS volumes formatted with ext3. Every single document specifies mkfs with: -O dir_index,filetype,sparse_super and not one of them ...
2
votes
2answers
49 views

Linux: Detecting/thwarting system modification or use of single user mode

Working through a backup solution and could use some security assistance. Please see below. The process For our editing business, we have an offsite backup server that we update nightly using rsync ...
2
votes
0answers
54 views

Dual primary DRBD with LUKS encryption

Is it possible to create a LUKS encrypted filesystem that is accessible by both nodes of a dual primary DRBD system? Here is what I tried to do: Create two nodes and establish a partition on each ...
2
votes
1answer
318 views

how do I plan partitions for LUKS encryption of a CentOS 7 server?

A CentOS 7 web server needs encryption at rest. I would like to use LUKS encryption for this, but I need direction to plan how. Can I use LUKS encryption to encrypt the entire drive as one unit on a ...
2
votes
2answers
522 views

Best way to secure Kickstart encrypted partition passwords

I have a CentOS 6.5 environment that boots up servers using Kickstart. One of the requirements of our Kickstart is that the partitions are encrypted. Since Anaconda can only take plain text passwords ...
1
vote
2answers
203 views

LUKS/dm-crypt security in the case of a break-in

This is an encryption topic I've been confused by for a while now. From what I understand of LUKS, once the LUKS volume is opened with a passphrase and the resulting device mapper device is mounted, ...
1
vote
1answer
123 views

Recover Crypt password on Partition - RHEL 6

I'm new around here and I'm not sure if this is the right place to post. I was recently asked to bring in a used server from another site of ours. On booting, I found that it has been encrypted using ...
1
vote
1answer
2k views

Disable asking for a passphrase without having to re-make the encrypted partition

I have a server which I set up with its root partition totally encrypted. I urgently need to disable the passphrase dialog at startup because it is not letting the server boot up after an electricity ...
1
vote
1answer
62 views

encrypted (luks) partition had some damage - any chance?

I was trying to run Debian installer on top of an already luks-encrypted partition (I tried to do use cryptsetup in the console). I don't remember ever saying "yes, destroy" data, but what I see now, ...
1
vote
1answer
2k views

how to mount a luks-encrypted file?

I had a good-working system. Cent OS 6. But after I made a reboot luks-partition has been unmounted. And our system administrator have a weekends now :( Please help me to mount a luks partition again....
1
vote
1answer
820 views

Why are these dmsetup commands there?

On this page are there examples of LUKS encryptions. Example below. Why are the dmsetup commands there? What do they do? dd if=/dev/zero of=./volumes/vol_default.vol bs=1M count=1 losetup /dev/...
1
vote
1answer
1k views

How to verify that a physical volume is encrypted? (Ubuntu 10.04 w/ LUKS) [closed]

I am very new to LUKS. During installation, I tried to set up an encrypted physical volume so that everything underneath it would be encrypted. I chose "Use as: physical volume for encryption," the ...
1
vote
1answer
43 views

LUKS Header - 30kB mysteriously missing

I have a disk containing (only) a LUKS encrypted volume. That was created on a bare drive with no partition table using cryptsetup v.1.6.1. When unlocked, I can check the size of the decrypted ...
1
vote
1answer
3k views

Recover data from ubuntu encrypted drive (LUKS)

I had a Host with Ubuntu 12.10 installed, and the entire harddrive was encrypted (with LUKS it appears), I remember the passphrase, but I have trouble to "open it". I am now on a beta version of ...
1
vote
1answer
774 views

Does cryptsetup “Plain mode” store the hashed passphrase in each sector?

When I read the manpage for cryptsetup on Linux about "Plain mode" it says: Plain dm-crypt encrypts the device sector-by-sector with a single, non-salted hash of the passphrase. and the -c ...
1
vote
1answer
555 views

LUKS and /etc/crypttab on centos 7 - hang at startup

I have a problem with following crypttab echo "secret /dev/sdb8 none" > /etc/crypttab When I do it by hand, following way everything is ok, disk is mounted: cryptsetup luksFormat /dev/sdb8 ...
1
vote
2answers
8k views

Ubuntu 13.10 - How to disable LVM and cryptsetup? cryptsetup: evms_activate is not available

I am trying to remove whole drive encryption from my Ubuntu installation. I've run Ubuntu from Live CD, mounted crypt partition and copied it to another partition /dev/sda3. sudo cryptsetup luksOpen /...
1
vote
1answer
372 views

Anybody experiencing full system lockups with LUKS?

I've recently setup a couple of new servers. This time I'm encrypting most of my partitions using dmcrypt+LUKS. However these new servers crash very often, every few days. Full lockups, kernel does ...
1
vote
2answers
1k views

Change LUKS UUID (without cryptsetup > 1.2)

According to the cryptsetup changelog (1.2.0): Allow explicit UUID setting in luksFormat and allow change it later in luksUUID (--uuid parameter). My problem is that the current Debian ...
1
vote
1answer
94 views

Can cryptsetup read mappings from /etc/crypttab?

I have a virtualized CentOS 7 server that needs to mount multiple password-protected encrypted volumes. I cannot automatically map the devices on boot, because I don't have access to the console ...
1
vote
1answer
125 views

How do I replace a disk with LUKS on LVM2 - no raid, no span

I have LUKS on LVM (LVM Partitions created first, then each partition is encrypted separately, following this guide on Arch Wiki). I am using two volume groups, and each is isolated to a drive. This ...
1
vote
0answers
747 views

How to open unmounted luks volume which believes it is open

I took a snapshot of a (live) luks encrypted block device, copied it to another system and am now trying to open it, but am unable to do so. Any help with solving this problem would be much ...
1
vote
0answers
130 views

Snapshot of BTRFS Device on top of luks Volume

I have the following problem: I can't figure out, how to create a snapshot of a btrfs volume residing on a crypted disk. This is the setup: /dev/sdb is a 1TB USB 3 disk. it has a partition /dev/...