Changes between Version 2 and Version 3 of luks

Timestamp:

Nov 15, 2007 4:01:34 PM (6 years ago)

Author:

dkg

Comment:

--

luks

@@ -11 +11 @@
 
 When you want to use a LUKS-formatted volume, the computer you're using asks you for a passphrase (or a passphrase file).  It uses that passphrase with one of the scrambled passphrases to unscramble the secret key.  The key is then used to unscramble sections of the underlying block device as they are requested by the OS.  This is represented as a new virtual block device available to the system.  A regular filesystem can be written to the virtual block device, and the actual data stored on disk will be encrypted.
+
+== how to use LUKS ==
+
+on [http://debian.org debian] systems, to put a layer of encryption over `/dev/sda1`, running an ext3 filesystem, it would look something like this:
+
+{{{
+0 root@lemur:~# aptitude install cryptsetup
+0 root@lemur:~# cryptsetup luksFormat /dev/sda1 
+
+WARNING!
+========
+This will overwrite data on /dev/sda1 irrevocably.
+
+Are you sure? (Type uppercase yes): YES
+Enter LUKS passphrase: 
+Verify passphrase: 
+Command successful.
+0 root@lemur:~# cryptsetup luksOpen /dev/sda1 mynewdisk
+Enter LUKS passphrase: 
+key slot 0 unlocked.
+Command successful.
+0 root@lemur:~# mkfs -t ext3 -q /dev/mapper/mynewdisk
+0 root@lemur:~# mount /dev/mapper/mynewdisk /mnt
+0 root@lemur:~# 
+}}}
+
+When you're done with the disk, you unmount it and release the encryption:
+{{{
+0 root@lemur:~# umount /dev/mapper/mynewdisk
+0 root@lemur:~# cryptsetup luksClose mynewdisk
+0 root@lemur:~# 
+}}}
+
+If you want regular access to an encrypted block device (might not make sense for a portable drive, for example), you can add entries in `/etc/crypttab` to prompt for keys at boot time.  Note that if you do this, you need to be at the computer (or have remote console access) when it boots, or it will wait forever for you to get to the console and put in the keys!
 
 == advantages of LUKS ==
@@ -29 +63 @@
 
 Once an encrypted block device is "!LuksOpen"ed on a computer, any process running as superuser on that computer has access to all the unencrypted data.  If you want individual files to be opaque to the system administrator, you probably should encrypt those files individually somewhere else before transferring the encrypted version to the computer in question.
+
+== other links ==
+
+ * [http://www.freeotfe.org/ FreeOTFE] claims to be able to use LUKS volumes on windows.
+ * [https://www.debian-administration.org/articles/536 resizing encrpyted filesystems]