cryptsetup

Sun, 25 Jan 2009 00:00:00 +0000

I switched already quite a while ago from the old cryptoloop technology to the newer cryptsetup technology. However, I still forget how to manually create and mount encrypted volumes, because I do this rarely. Here are the commands:cryptsetup create cryptovolume /dev/mapper/logical_volumemount /dev/mapper/cryptovolume /mountpointIn this case I mapped a logical volume, but of course you can map physical volumes, too:cryptsetup create cryptovolume /dev/sdb1mount /dev/mapper/cryptovolume /mountpoint

Mounting disk image files and encrypted filesystems/partitions

Sat, 26 May 2007 00:00:00 +0000

To dump a disk (or a partition) into a file, you use the following command:dd if=/dev/hda3 of=file.binThis command writes the complete data on the hda3 partition into the file file.bin.To mount the filesystem that is in the file, you need to create a loopback device:losetup /dev/loop0 file.binNow you can mount the filesystem as usual:mount -r -t filesystemtype /dev/loop0 /mnt/mountpointApparently, one can combine the last two commands into one:mount -t filesystemtype -o loop ./file.bin /mnt/mountpointIf you want to encrypt the data on a file, that contains a whole filesystem, it is getting a bit more complicated:sudo mkdir /mnt/secure (create mount point for the filesystem)dd if=/dev/zero of=path/to/file bs=1k count=409600 (create an empty file with 400 MB size) sudo /sbin/losetup -e xor /dev/loop0 path/to/file/sbin/mkfs -t ext2 /dev/loop0 409600 (format the device as ext2)sudo mount -t ext2 /dev/loop0 /mnt/secure (mount the device file)cd /mnt/securechown username . (change the owner of the top level directory of the filesystem)If you want to unmount the filesystem:sudo umount /dev/loop0If you want to get rid of the filesystem, you have to un-associate it from the loop device 0: /sbin/losetup -d /dev/loop0For some reason RedHat 9 doesn’t come with DES support, so for the time being (until I patch the kernel or move to Suse Linux) I am using the faster, but much weaker xor encryption.Suse 9 comes with inbuilt strong encryption and offers already during the installation the possibility to create an encrypted partition. Suse 9 asks during booting for the passphrase to mount the encrypted filesystem. The boot process stops and waits for 2 minutes before continuing if you don’t type in the password. In order to reduce this time, you can edit the file /etc/init.d/boot.crypto. Change in the following line 120 to e.g. 10::${TIMEOUT:=120}If you have missed your chance to type in the passphrase during boot time, you can mount the encrypted partition as follows:/sbin/losetup -e twofish /dev/loop0 /dev/hda7 mount /dev/loop0 /media/confBTW: The information about encrypted filesystems resides in /etc/cryptotab.

Mouting of encrypted partitions under SuSE 9.3 (losetup, cryptotab, twofish256, twofishSL92)

Wed, 04 Apr 2007 00:00:00 +0000

I have one encrypted partition that was created under SuSE 9.2. After a fresh install of 9.3 (not an update) the mounting of that partition during bootup failed. I could, however, still mount it manually later using another loopdevice. To fix this, I had to change the encryption algorithm in /etc/cryptotab from twofish256 to twofishSL92. More detailed information .

Cryptoloop on Michael’s Domain

cryptsetup

Mounting disk image files and encrypted filesystems/partitions

Mouting of encrypted partitions under SuSE 9.3 (losetup, cryptotab, twofish256, twofishSL92)