{"id":8522,"date":"2021-04-02T13:30:33","date_gmt":"2021-04-02T10:30:33","guid":{"rendered":"https:\/\/kifarunix.com\/?p=8522"},"modified":"2024-03-19T08:29:43","modified_gmt":"2024-03-19T05:29:43","slug":"automount-luks-encrypted-device-in-linux","status":"publish","type":"post","link":"https:\/\/kifarunix.com\/automount-luks-encrypted-device-in-linux\/","title":{"rendered":"Automount LUKS Encrypted Device in Linux"},"content":{"rendered":"\n<p>In this tutorial, you will learn how to automount LUKS encrypted device in Linux on system startup. Unless you configure the device to automount, it usually doesn&#8217;t by default. However, if you enabled device encryption with LUKS during system install, the automount is usually setup and the device automatically mounts once you supply the correct drive encryption passphrase.<\/p>\n\n\n\n<p>Please note that security wise, automounting an encrypted device might not be a good practise, IMO.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Automatically Mount LUKS Encrypted Device in Linux<\/h2>\n\n\n\n<p>In our previous tutorial, we learnt how to <a aria-label=\"encrypt a disk partition with LUKS in Linux (opens in a new tab)\" class=\"rank-math-link\" href=\"https:\/\/kifarunix.com\/encrypt-drives-with-luks-in-linux\/\" target=\"_blank\" rel=\"noreferrer noopener\">encrypt a disk partition with LUKS in Linux<\/a>. We will be using the same device to demonstrate how to automatically mount LUKS Encrypted Device in Linux.<\/p>\n\n\n\n<p>Below command lists the block device that we will use to demonstrate the auto-mounting procedure.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>lsblk<\/code><\/pre>\n\n\n\n<pre class=\"scroll-box\"><code>\nNAME                                          MAJ:MIN RM  SIZE RO TYPE  MOUNTPOINT\nsda                                             8:0    0   15G  0 disk  \n\u251c\u2500sda1                                          8:1    0   13G  0 part  \/\n\u251c\u2500sda2                                          8:2    0    1K  0 part  \n\u2514\u2500sda5                                          8:5    0    2G  0 part  [SWAP]\nsdb                                             8:16   0    4G  0 disk  \n\u2514\u2500sdb1                                          8:17   0    4G  0 part  \n<strong>  \u2514\u2500luks-242c24d8-ac65-413d-b3a2-eb7f2f0993b0 254:0    0    4G  0 crypt<\/strong>\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Create LUKS Key File<\/h3>\n\n\n\n<p>With LUKS encryption, you can unlock the device by interactively supplying the passphrase or automatically specifying a key file containing the passphrase to unlock the drive.<\/p>\n\n\n\n<p>To create the LUKS key file, you use the <strong><code>dd<\/code><\/strong> command as follows.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>dd if=\/dev\/random of=\/etc\/.crypt-me bs=32 count=1<\/code><\/pre>\n\n\n\n<p>So, we use the <strong><code>\/etc\/.crypt-me<\/code><\/strong> file as our LUKS key file, can be a different file for you. The command above fills random data on the key file as evident by the command below;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>xxd \/etc\/.crypt-me<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>00000000: 62cc f2b2 b431 fdb5 d908 8cfd b6c5 b27d  b....1.........}\n00000010: f38b 877a 6575 279c 3c20 5b36 a5fa ce7d  ...zeu'.&lt; &#91;6...}<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Add a Passphrase to LUKS Key File<\/h3>\n\n\n\n<p>Once you have created a LUKS key file, you need to add a new passphrase to the file using the&nbsp;<code>cryptsetup<\/code>&nbsp;utility:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>cryptsetup luksAddKey &lt;device&gt; &lt;path-to-key-file&gt;<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>cryptsetup luksAddKey \/dev\/sdb1 \/etc\/.crypt-me<\/code><\/pre>\n\n\n\n<p>You will be prompted to enter any existing passphrase.<\/p>\n\n\n\n<p>If you specified the existing passphrase using the key file as well, then use the command below;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>cryptsetup luksAddKey &lt;device&gt; &lt;path-to-key-file&gt; --key-file &lt;path-to-existing-passphrase-key-file&gt;<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>cryptsetup luksAddKey \/dev\/sdb1 \/etc\/.crypt-me --key-file ~\/luks-key<\/code><\/pre>\n\n\n\n<p>For now, the device has two key slots used, as per our setup. To confirm, print the device details.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>cryptsetup luksDump \/dev\/sdb1<\/code><\/pre>\n\n\n\n<pre class=\"scroll-box\"><code>\nLUKS header information\nVersion:       \t2\nEpoch:         \t4\nMetadata area: \t16384 [bytes]\nKeyslots area: \t16744448 [bytes]\nUUID:          \t242c24d8-ac65-413d-b3a2-eb7f2f0993b0\nLabel:         \t(no label)\nSubsystem:     \t(no subsystem)\nFlags:       \t(no flags)\n\nData segments:\n  0: crypt\n\toffset: 16777216 [bytes]\n\tlength: (whole device)\n\tcipher: aes-xts-plain64\n\tsector: 512 [bytes]\n\n<strong>Keyslots:\n  0: luks2\n\tKey:        512 bits\n\tPriority:   normal\n\tCipher:     aes-xts-plain64\n\tCipher key: 512 bits\n\tPBKDF:      argon2i\n\tTime cost:  4\n\tMemory:     1003317\n\tThreads:    2\n\tSalt:       b3 c8 b0 69 db 38 cb bd 1c 58 d0 a2 8a b8 92 12 \n\t            05 47 ca dd c7 3d dd 94 c0 f7 51 04 12 fb 3a 56 \n\tAF stripes: 4000\n\tAF hash:    sha256\n\tArea offset:32768 [bytes]\n\tArea length:258048 [bytes]\n\tDigest ID:  0\n  1: luks2\n\tKey:        512 bits\n\tPriority:   normal\n\tCipher:     aes-xts-plain64\n\tCipher key: 512 bits\n\tPBKDF:      argon2i\n\tTime cost:  4\n\tMemory:     984615\n\tThreads:    2\n\tSalt:       17 9c 29 fc 61 a2 a4 b0 8b 10 42 6d 51 a0 5b 37 \n\t            77 18 ef db 05 40 79 71 79 88 0a b1 85 41 ee 41 \n\tAF stripes: 4000\n\tAF hash:    sha256\n\tArea offset:290816 [bytes]\n\tArea length:258048 [bytes]\n\tDigest ID:  0<\/strong>\nTokens:\nDigests:\n  0: pbkdf2\n\tHash:       sha256\n\tIterations: 133338\n\tSalt:       e1 9b 70 5e 87 25 46 d6 08 20 43 60 6c ae 2c 06 \n\t            42 fa 61 32 f0 fc ca 5f 10 f9 3d 63 dd 22 a4 96 \n\tDigest:     e9 62 ab 83 4c 3c 81 88 52 08 42 9b 47 c2 e1 b6 \n\t            d5 8a 59 88 5c 17 02 54 c4 89 36 7e 5f e0 f5 ec\n<\/code><\/pre>\n\n\n\n<p>Verify that you can unlock the disk with the key file created using the command;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>cryptsetup luksOpen &lt;device&gt; &lt;name&gt; --key-file &lt;path-to-key-file&gt;<\/code><\/pre>\n\n\n\n<p>If the drive is already opened, then close if first;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>cryptsetup -v luksClose luks-242c24d8-ac65-413d-b3a2-eb7f2f0993b0 <\/code><\/pre>\n\n\n\n<p>Next, verify the new key file can unlock the LUKS drive;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>cryptsetup -v luksOpen \/dev\/sdb1 luks-242c24d8-ac65-413d-b3a2-eb7f2f0993b0 --key-file \/etc\/.crypt-me<\/code><\/pre>\n\n\n\n<p>Sample output;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Key slot 1 unlocked.\nCommand successful.<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Automount LUKS Device on System Startup<\/h3>\n\n\n\n<h4 class=\"wp-block-heading\">Update crypttab file with device information<\/h4>\n\n\n\n<p>Next, you need to add an entry to <code>\/etc\/crypttab<\/code> describing the information about the LUKS encrypted device that you need to automount.<\/p>\n\n\n\n<p>An entry in <code><strong>\/etc\/crypttab<\/strong><\/code> should look like;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;target name&gt; &lt;source device&gt; &lt;key-file&gt; &lt;options&gt;<\/code><\/pre>\n\n\n\n<p> Where:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong><code>target name<\/code><\/strong>: describes the mapped device name. For example, if your device mapping is <code><strong>\/dev\/mapper\/name<\/strong><\/code>, then <code><strong>name<\/strong><\/code> is the required target.<\/li>\n\n\n\n<li><strong><code>source device<\/code><\/strong>: describes either the block special device or file that contains the encrypted data. This is specified using UUID=&lt;uuid&gt;, or LABEL=&lt;label&gt;, PARTUUID=&lt;partuuid&gt; or PARTLABEL=&lt;partlabel&gt;.<\/li>\n<\/ul>\n\n\n\n<p>You can obtain the UUID, PARTUUID using the <strong><code>blkid<\/code><\/strong> command. For example:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>blkid \/dev\/sdb1<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>\/dev\/sdb1: <strong>UUID=\"242c24d8-ac65-413d-b3a2-eb7f2f0993b0\"<\/strong> TYPE=\"crypto_LUKS\" <strong>PARTUUID=\"629e6177-01\"<\/strong><\/code><\/pre>\n\n\n\n<p>To obtain the LABEL, use <code><strong>lsblk<\/strong><\/code> command;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>lsblk -f \/dev\/sdb1<\/code><\/pre>\n\n\n\n<pre class=\"scroll-box\"><code>\nNAME                                        FSTYPE      LABEL UUID                                 FSAVAIL FSUSE% MOUNTPOINT\nsdb1                                        crypto_LUKS       242c24d8-ac65-413d-b3a2-eb7f2f0993b0                \n\u2514\u2500luks-242c24d8-ac65-413d-b3a2-eb7f2f0993b0 ext4              <strong>e940b45b-dbc8-4c40-aaa5-9acf9fcb2119<\/strong>\n<\/code><\/pre>\n\n\n\n<p>Also, you can obtain the UUID using the command below;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>cryptsetup luksDump \/dev\/sdb1 | grep \"UUID\"<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong><code>key file<\/code><\/strong>: describes the file to use as a key for decrypting the data of the source device. Note that the passphrase must not be followed by a newline character.<\/li>\n\n\n\n<li><strong><code>options<\/code><\/strong>: describes the cryptsetup options associated with the encryption process. At minimum, the field should contain either the string luks respectively tcrypt or the cipher, hash and size options. Options are in the format: <strong><code>key=value [,key=value \u2026]<\/code><\/strong>.<\/li>\n<\/ul>\n\n\n\n<p>Consult <strong><code>man crypttab<\/code><\/strong> for more information.<\/p>\n\n\n\n<p>Therefore, this is how our device entry looks on <code><strong>\/etc\/crypttab<\/strong><\/code> file.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>luks-242c24d8-ac65-413d-b3a2-eb7f2f0993b0 UUID=\"242c24d8-ac65-413d-b3a2-eb7f2f0993b0\" \/etc\/.crypt-me luks<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\">Update fstab file with Device information<\/h4>\n\n\n\n<p>Next, you need to update the <strong><code>\/etc\/fstab<\/code><\/strong> file with device information as well to define how to mount the LUKS device.<\/p>\n\n\n\n<p>The entry in the <strong><code>\/etc\/fstab<\/code><\/strong> file should take the format;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;file system&gt; &lt;mount point&gt;   &lt;type&gt;  &lt;options&gt;    &lt;dump&gt;  &lt;pass&gt;<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>\/dev\/mapper\/luks-242c24d8-ac65-413d-b3a2-eb7f2f0993b0 \/mnt\/luks-242c24d8 ext4 defaults,nofail 0 0<\/code><\/pre>\n\n\n\n<p>Make the changes accordingly.<\/p>\n\n\n\n<p>Ensure the mount point exists.<\/p>\n\n\n\n<p>Verify the mounting using the <code>mount<\/code> command before you can reboot your system. If all is well, you should see &#8220;<strong>successfully mounted&#8221;<\/strong> for your LUKS device.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>mount -av<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>\/                        : ignored\n\/mnt\/luks-242c24d8       : successfully mounted<\/code><\/pre>\n\n\n\n<p>You can now reboot your system to confirm the same.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>systemctl reboot<\/code><\/pre>\n\n\n\n<p>Once the reboot is done, check the mounting;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>lsblk<\/code><\/pre>\n\n\n\n<pre class=\"scroll-box\"><code>\nNAME                                          MAJ:MIN RM  SIZE RO TYPE  MOUNTPOINT\nsda                                             8:0    0   15G  0 disk  \n\u251c\u2500sda1                                          8:1    0   13G  0 part  \/\n\u251c\u2500sda2                                          8:2    0    1K  0 part  \n\u2514\u2500sda5                                          8:5    0    2G  0 part  [SWAP]\nsdb                                             8:16   0    4G  0 disk  \n\u2514\u2500sdb1                                          8:17   0    4G  0 part  \n  \u2514\u2500<strong>luks-242c24d8-ac65-413d-b3a2-eb7f2f0993b0 254:0    0    4G  0 crypt \/mnt\/luks-242c24d8<\/strong>\n<\/code><\/pre>\n\n\n\n<p>Or use <code>df<\/code> command.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>df -hT<\/code><\/pre>\n\n\n\n<pre class=\"scroll-box\"><code>\nFilesystem     Type      Size  Used Avail Use% Mounted on\nudev           devtmpfs  984M     0  984M   0% \/dev\ntmpfs          tmpfs     200M  3.1M  197M   2% \/run\n\/dev\/sda1      ext4       13G  3.6G  8.5G  30% \/\n<strong>\/dev\/dm-0      ext4      3.9G   16M  3.7G   1% \/mnt\/luks-242c24d8<\/strong>\n<\/code><\/pre>\n\n\n\n<p>That concludes our guide.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Other tutorials;<\/h3>\n\n\n\n<p><a href=\"https:\/\/kifarunix.com\/how-to-use-veracrypt-on-command-line-to-encrypt-drives-on-ubuntu-18-04\/\" target=\"_blank\" rel=\"noreferrer noopener\">How to Use VeraCrypt on Command Line to Encrypt Drives on Ubuntu 18.04<\/a><\/p>\n\n\n\n<p><a href=\"https:\/\/kifarunix.com\/how-to-encrypt-files-and-folders-with-ecryptfs-on-ubuntu-18-04\/\" target=\"_blank\" rel=\"noreferrer noopener\">How to Encrypt Files and Folders with eCryptFS on Ubuntu 18.04<\/a><\/p>\n\n\n\n<p><a rel=\"noreferrer noopener\" class=\"rank-math-link\" href=\"https:\/\/kifarunix.com\/install-and-setup-veracrypt-on-ubuntu-20-04\/\" target=\"_blank\">Install and Setup VeraCrypt on Ubuntu 20.04<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>In this tutorial, you will learn how to automount LUKS encrypted device in Linux on system startup. Unless you configure the device to automount, it<\/p>\n","protected":false},"author":3,"featured_media":8525,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"rank_math_lock_modified_date":false,"footnotes":""},"categories":[34,159,121],"tags":[3379,3382,3383,3384,3385,3380],"class_list":["post-8522","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","category-encryption","category-howtos","tag-auto-mount-luks-device-in-linux","tag-crypttab","tag-fstab-entry-for-luks-device","tag-luks-add-key-to-device","tag-mount-luks-device-automatically","tag-mount-luks-device-on-start-up-automatically","generate-columns","tablet-grid-50","mobile-grid-100","grid-parent","grid-50","resize-featured-image"],"_links":{"self":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/8522"}],"collection":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/comments?post=8522"}],"version-history":[{"count":5,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/8522\/revisions"}],"predecessor-version":[{"id":21861,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/8522\/revisions\/21861"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/media\/8525"}],"wp:attachment":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/media?parent=8522"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/categories?post=8522"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/tags?post=8522"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}