Let's get started!
I’m gonna encrypt an entire USB stick using dm-crypt and Luks!
You should follow the same steps if you want to encrypt a hard disk partition or an external usb
hard drive.
The following commands will destroy all data on the disk and I recommend you to make a backup before continuing.
Keep in mind that this is a full disk encryption solution for Linux based operating systems.
And if you want to access the encrypted disk on Windows or MAC you must install another software; for
example on Windows you should install LibreCrypt to access the encrypted drive. LibreCrypt is the
only way to read UKS volumes on Windows.
The first step is to install cryptsetup,
if it's not already there.
Cryptsetup is a utility for setting up encrypted filesystems using a Device Mapper and dm-crypt.
All following commands will be executed as root.
So if you don't have cryptsetup you can install it using apt install cryptsetup.
okay.
Upgrading cryptsetup on some Linux distributions like Fedora or Centos the name of the package is
cryptsetup-luks.
The next step is optional but recommended and consists of filling the partition you want to encrypt
with random data.
This will ensure that the outside world will see this as random data and protect against disclosure
of usage patterns.
At this moment I'm inserting the USB drive.
if you are running Linux in a VM you should see the USB drive in the properties of the VM at the USB
section. so settingss and USB here you should see the drive
USB flash drive.
And if you don't see it there and you run Virtual Box you should install Virtual Box Extension Pack.
This piece of software; okay I've just inserted the USB drive.
I'm waiting a few seconds and then I'll check the name of the newly inserted drive.
fdisk -l and its name is sdc; probably in your case another name could be displayed like
sdb or sdd; If you want to encrypt only a partition, not the entire disk,
use that partition’s name. A partition’s name
always ends in a digit like 1, 2 or 5
in this example.
What is the most important is to use the correct name.
Take care that if you use a wrong disk or partition name
all data on that disk or partition will be lost forever.
The following command will remove all data on the disk or the partition
you are encrypting; so make sure you have first backed up your data to an external source. so
dd if= from imput file
/dev/urandom This is one way of generating random data and of=/dev/sdb
name of the drive and status=progress
The operation will take a few minutes depending on the size of your disk. in this example I'm stopping
it. I am pressing control +C. The next step will initialize the LUKS partition and set the initial
passphrase, either via prompting or via key file.
In this example we'll use a passphrase.
The command will fail if the partition is already mounted,
so please unmount it
if it's the case so cryptsetup
- y -v luksformat - use the camel case notation- and the name of the drive /dev/sdb.
- y option is used to interactively ask for a passphrase or to ask for it twice and complain
if both inputs do not mach. And -v comes from verbose.
This will overwrite the data on sdb irrevocably. I'm typing uppercase Yes.
And I'm entering a passphrase
after verifying the passphrase it displays command successfully.
The next step is to open the encrypted device and set up a mapping name.
After the successful verification of the supplied passphrase the mapping device file will be in /dev
/mapper so cryptsetup luksOpen /dev/sdc the drive and the name of the mapper
file.
You can write anything you want.
Let's say secret data and I'm entering the passphrase.
The command has created a mapping between the disk and the spatial device file called secretdata in
dev mapper; here.
This is the file!
It's in fact a sim link to dm-0; to this file.
We notice this is a special block device.
You can use the following command to see the status of the mapping cryptsetup status and the name of
the mapping secretdata.
You are seeing the symmetric encryption algorithm used, the length of the key and much more. Next, we'll
format the filesystem! mkfs.ext4 /dev/mapper/secretdata
ext4 is the most used file system for Linux; okay!
And it takes a few seconds; 10 20 seconds depending on the disk size;
and it's over!
Finally we mounted the encrypted filesystem to the main file tree like this mount /dev/mapper/secretdata
and an existing directory let's say /mnt. At this point you can use the mounted disk
normally; you copy move or erase files on the disk
as with any other disk; the content of the disk will be in /mnt
You can also create a new directory and mount the encrypted disk to that directory.
Like this I am creating a directory in /route secretdata and I am mounting the encrypted disk
to that directory.
I can access
/dev/mapper/secretdata so the encrypted disk both in /mnt and route secretdata; by the way
in the Linux you can mount a storage device or a disk on more directories; the encryption is transparent
and you won't notice anything.
And once again data is protected at rest or when the disk is not mounted; at this moment when the disk is
mounted, it can be accessed normally by anyone. A hacker could run on exploit and connect using ssh on your
machine and steal all your data.
But once you unmount the disk the data will be unaccessible.
Let's see how to unmont the disk umount /mnt and umount /secretdata
After umounting the directory
we must also close the LUKS volume cryptsetup luksClose
secretdata; this is the name of the mappper file,
the file in dev/mapper.
Okay.
Now the disk is protected; next time when you want to access the disk you just run cryptsetup luksOpen
and mount like this.
This is the mapper file and I can write anything I want.
Like secret; I am entering the passphrase and the disk was unlocked.
This is the mapper file and mount/ dev/ mapper in root secret data
the directory I've just created.
Sorry it's dev/ mapper/ secret.
I am creating a file on the encrypted disk.
If you are using a graphical interface
it's also probable that the Linux operating system will recognize the disk when inserted and prompt
you automatically for the passphrase.
Don't forget that any storage media fails and the backup is mandatory for encrypted data as well.
Of course if the data has any worth.