Security :: Luks Root Partition On Laptop

May 9, 2011

if encrypt my root partition with Luksformat on my laptop and the battery suddenly goes out without a proper shutdown, I stand a big chance on corrupting the luks header or key slot?

View 1 Replies


Fedora Security :: Unlock A LUKS Encrypted Root Partition Via Ssh?

May 20, 2010

Anyone had any experience with unlocking a LUKS encrypted root partition via ssh? It is ok to leave /boot unencrypted.

There are a few pages from google with the debians variants, archived by putting dropbear into initrd.

I like to do that with my fedora/centos remote servers, but struggle to find any resources specific to it. Anyone has any suggestions and thoughts as to what might be a suitable way forward?

View 2 Replies View Related

Ubuntu Security :: LUKS On LVM And Resizing Partition

May 10, 2010

I have a LVM logical volume, that contains a LUKS encrypted volume, on which is an ext4 filesystem. I shrank the partition to the minimum size. Next step is to luksClose the device, and then to resize the LVM logical volume. I suspect that LUKS has overhead. So if the ext4 filesystem was resized from, say 1TB to 500G, I have the idea that resizing the LVM LV to 500G does not take LUKS overhead into account and this might corrupt data on the end of the FS. So, what's the smart move to take? How do I calculate the safe minimum LV size? Or should I just give the 500G disk a few gigabytes extra to be sure?

View 4 Replies View Related

Fedora Security :: LUKS Encryption At Partition Level Or LVM?

Jul 19, 2010

I'm planning a fresh F13 install, with separate partitions for /boot, /home, /tmp, /, and swap. All but /boot will be logical volumes, and I'd like to encrypt all but boot. If I encrypt the underlying partitions, is there any reason to also encrypt the logical volumes themselves?

my system will be:
HP dv6-3040us Pavillion laptop
AMD Phenon II

View 3 Replies View Related

Ubuntu Security :: LUKS - Dm-crypt And Encrypted Partition At Boot

Feb 22, 2010

I'm trying to have a LUKS encrypted partition mounted at startup and to have GDM ask for my key so it will decrypt. Now I followed [URL] to the letter. Except for now, I have it just mounted into /mnt/cryptohome so I'm not messing with my system. My problem is the one everyone mentions in the comments, ubuntu isn't asking for the LUKS key in the X display, it's asking in the first terminal (Ctrl-Alt-F1). This will not do. I need it to ask to mount my drive before I'm even asked to login, so eventually I can encrypt my /home.

View 9 Replies View Related

Fedora Security :: Image An Entire Luks System Encrypted Volume And The Rest Of The Used HDD, The MBR And /boot Partition?

Jan 21, 2009

I need a FREE solution that can image an entire Luks system encrypted volume and the rest of the used HDD, the MBR and /boot partition. Note: MBR and /boot are not encrypted. Note 2: I want to be able to restore entire drive from image with only a couple of steps. Note 3: Destination HDD space is a factor. Image file must be compressed and the image file must be around 40 to 50 GB or less. The smaller the image the better.

I have used clonezilla live cd before but not for encrypted volumes. I know you can install it in Linux. But, I don't know how to configure it after installation. I would be very happy if someone could tell me how to configure clonezilla in Fedora. How to guides are also welcome. I have one more question. If I image the encrypted volumes and all the stuff I mentioned above while logged in to Fedora, and I restore the drive from the image, will the recovered drive still be encrypted?

View 8 Replies View Related

Ubuntu Security :: Grub With Luks Support - Encrypting The Boot Partition To Prevent The Kernel From Being Modified?

Mar 9, 2011

Has anyone tried encrypting the boot partition to prevent the kernel from being modified. Iv tried following this but I'm running into issues when building. [URL] Im using the source from bzr checkout [URL] Last time I tried I screwed grub and it wouldnt boot.

View 9 Replies View Related

General :: Format Master LUKS Partition With/without Damaging Other Partition?

May 11, 2010

I need to change my LUKS partition to NTFS as I do not need the boot partition any longer, but I need to keep sdb3 (truecrypted ext3) intact. This is how the disk looks now:


Disk /dev/sdb: 1000.2 GB, 1000204886016 bytes
255 heads, 63 sectors/track, 121601 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes


View 2 Replies View Related

Slackware :: 12.2 - RAID-1 - LVM - LUKS Encrypted Root

Dec 17, 2008

I am trying to get Slackware 12.2 running on a system with two identical harddiscs using RAID-1, LVM and LUKS.

Here is what I get:


The system is still the same, however, the results of upgrading or installing 12.2 are different. The system refuses to boot. The screen messages during boot seem to suggest, that the RAID system is "seen" by the system, but the encrypted filesystem is not.

I can boot with the installation DVD, however, and


View 14 Replies View Related

Debian Installation :: LUKS On Root Killed By Apt-get Update

Sep 24, 2015

Root LUKS to be broken by apt-get update? This did happen to me on 3 different laptops, both on previous install (from Debian 8.0), and also on clean installs (Debian 8.1), repeatedly.

When I reboot, grub starts, but then it cannot find the root file system (I end up with the emergency console).

Code: Select allLoading Linux 3.16.0-4-amd64 ...
Loading initial ramdisk ...
Loading, please wait...
[many seconds waiting]
ALERT! /dev/mapper/sda2_crypt does not exists.
modprobe: modprobe ehci-orion not found in modules.dep

This is the most simple, clean, conservative install ever, no closed driver.

But LUKS on the root file system:

Code: Select allone ext4 partition on /boot
one ext4 partition on / (trough LUKS, all defaults)

There is no LVM.

All the 3 laptops killed at different time, when updating. Clean install is fine until the first update.

Booting on the rescue system allows me to see everything.

Code: Select all$ update-grub
Generating grub configuration file ...
Found background image: /usr/share/images/desktop-base/desktop-grub.png
Found linux image: /boot/vmlinuz-3.16.0-4-amd64
Found initrd image: /boot/initrd.img-3.16.0-4-amd64
No volume groups found

How can I recover from this?

View 5 Replies View Related

SUSE / Novell :: Encrypted Root With LUKS On LVM And RAID-1 ?

Apr 15, 2009

OpenSuSE 11.1 is by far the best SuSE version in a long time. It's generally up to competition or ahead of it. It's admirable, how thoughtful this system is set up, and how clean and fast it is compared to its predecessors. It ssems, that SuSE is fighting its way back to where they came from before the Novell "merger."

Having said that, it is even harder to understand, IMHO, why the installer doesn't support encrypted root partitions. Of course, there is a manual solution:

However, this HOW-TO doesn't explain how to combine LUKS encryption with LVM on a RAID-1 system, as described for Slackware 12.2 here:


Is there a similar guide anywhere available for OpenSuSE 11.1?

If not: Would it be possible to do all the low-level setup work, like partitioning, setting up the logical volumes and encrypting everything, with Slackware, following the document above, and then install OpenSuSE 11.1 on that system? Would that work?

View 5 Replies View Related

Security :: LUKS For Servers Pro And Cons?

Jul 29, 2010

I am trying to decide whether or not to use LUKS with LVM install for NAS Box, mysql, postfix, ddns, bind, NFS, sshd, Appletalk, maybe samba. I have decided to give LVMs a try but not sure how LUKS will affect access to services. LAN includes Standalone headless web server(not on LVM, no LUKS). Aren't permissions,iptables and firewalls sufficient? Not sure how services are supose to interract if everything is encrypted especially root?

So far what I have read recommends vgOS /, swap, /var, /tmp encription and vgdata /home encryption but no one tells how they did it. The 2 servers I'm working on only have small /home for admin stuff and considering making NAS headless, except i read somewhere that some gui would make it easier to manage mysql which brings me to the question if I don't install X on NAS can I ssh in with my desktop using its gui? I am experimenting with minimal server tagfiles. LUKS and LVMs are new to me. Decided to use LVMs to seperate OS from data, different data types and resizing flexibility. I have read some material on LUKS just wonder if its more complicated than my needs require. Certainly i don't want to leave myself open to someone just distroying my setup for kicks.

View 6 Replies View Related

Debian :: Resize LUKS Partition Without LVM

Aug 20, 2011

I need to resize (increase) LUKS partition. I have found a lot of manuals, but they are just for LVM volumes(I dont use LVM and I dont plan to use it). I have HDD splited to the 4 parts:


I want to increase LUKS partition, by using the part of unalocated space.

BUT I dont want to do the following:
Backup data from LUKS partition
Delete LUKS partition
Create new bigger LUKS partition
Restore data to the LUKS partition

View 1 Replies View Related

Fedora Security :: How To Enable Encryption With Luks

Jun 17, 2010

1.) I am wondering how to enable the lock to an encrypted partition which has been unlocked, using luks? On boot, I am been asked automatically for the pass phrase to unlock my partitions. After doing a back up, I want lock the encrypted partition again, but I don't know the command?! I umounted the partition but after mounting it again, I was not asked for the pass phrase but had access to my data.

2.) How secure is the default fedora version of luks? Is truecrypt better?

View 2 Replies View Related

Ubuntu Security :: Recommendations For Luks Encryption?

Jan 8, 2010

When 10.04 is released I'll encrypt my /home partition using luks. I've read that xts is good for hard drive encryption and aes is good for cipher encryption. I'm looking for something that is fairly secure without sacrificing a lot of speed.

View 2 Replies View Related

Security :: Is LUKS The Best Data/system Encryption

Mar 20, 2011

Is LUKS the best data/system encryption? Or is there one that is even better and stronger?

View 1 Replies View Related

Software :: Corrupted LUKS-encrypted Partition ?

Jun 30, 2010

I have a really tricky and may be intresting problem with a encrypted disk partition (cryptsetup luks...) which was fine until it accidentally got re-formatted by an instance of Windows 7. Most of the data on that 1TB-disk will probably still exist, only the LUKS header at the very beginning of the partition is - of course - gone.

So when I try to open the container, it gives no verbose, just the return value 234.

I scanned the whole partition for other LUKS headers with hexedit, none there. But, luckyly I have another partition which is encrypted in the exact same way with the exact same passphrase (which I remember very well!), so I had an idea: I copied the LUKS header (592 bytes) from the other LUKS encrypted partition over to the damaged partition.
When I now issue


No key available with this passphrase

Here is the command how I created the container:


How do I get the existing passphrase accepted by LUKS?

View 9 Replies View Related

Fedora Security :: LUKS Encrypted Partion And Start Up

Aug 18, 2010

I run fedora 13 on my laptop (dual boot with Windows 7) and I just created a new partion to hold sensible data, encrypted with LUKS. I followed this tutorial for creating it.Now, everything went well and the new partition works well. But I needed something a little different from what the tutorial suggested, because I don't want the partition to be mounted on the system each time it boots, but I would (unlock and) mount it manually when I need it.

To do so I just didn't follow the Tutorial steps from 7 to 13, thinking that without the changes to crypttab and fstab the partition wouldn't be even touched by the start up process. And that's partially true: the partition isn't mapped nor mounted in the system when I boot, but the problem is that it however keeps asking for the passphrase to unlock it even if it doesn't get mounted or mapped.It just asks for it before the system loads all it's parts (udev, filesystems, etc) and I can't understand why, what it uses it for if it doesn't unlock it.So my question is: why does it ask for the passphrase to unlock luks if I haven't set crypttab and fstab to mount the partition on start up?

View 2 Replies View Related

Ubuntu Security :: Aes-xts - Aes-lrw - Aes-cbc - Set Up Encrypted Volumes With Dm_crypt And LUKS?

Jan 3, 2010

I'm just wondering - what is the best way to set up your encrypted volumes with dm_crypt and LUKS?

My understanding was that aes-lrw ws better than aes-cbc - and then I stumble upon [url] which says that LRW has some problems, and XTS is better? I dont know enough about encryption theory to be able to say anything, so i'm hoping some folks more enlightened will be able to say something here.

I was previously using aes-lrw-benbi to set up a volume. If xts is truly better - should i be using '-c aes-xts-benbi' then?

View 4 Replies View Related

Ubuntu Security :: Difference Between Dm-crypt/LUKS And TrueCrypt

Oct 4, 2010

I'm simply interested in a more basic discussion of why one would choose one of these methods over the other. What do they offer that the other does not? I'll start with what I know:

- dm-crypt/LUKS
--- included in a lot of install images already; in other words, perhaps easier to implement on a fresh install
- TrueCrypt
--- multiple encryption algorithms possible


For me... I have no need for Windows compatibility, though I do use OS X on a dual booting MacBook. I believe TrueCrypt woks with OS X, so that could be a bonus, though I can simply encrypt my home folder on OS X with it's own FireVault and be fine.My setup (after wiping and starting over) will probably be like so:

- /boot on it's own primary partition
- / on it's own primary partition with logical partitions within
--- /usr, /var, /etc, /opt, and the like on a logical partition
--- /home on a logical partition

/home will surely be encrypted and I'm leaning toward encrypting the rest as well, though perhaps it's not necessary. I'm open to input there as well -- is there anything the leaks from normal application use into /var or /tmp that would make one lean toward just encrypting the whole thing?

I opened up TrueCrypt just to look at it and since I can't encrypt a whole partition without losing data... I pretty much have to encrypt from what? A live CD? This could be a drawback -- I think since TrueCrypt isn't coming on install disks, I'd have to go with an unencrypted (or dm-crypt/LUKS) root partition and then use TrueCrypt to make a container (or partition) for /home only. I can't think of another way to do this since I can't encrypt the whole disk as one entity with my dual booting situation...

View 9 Replies View Related

Ubuntu Security :: How To Mount A Dm-crypt/luks Drive

Apr 4, 2011

I have a perfectly OK 2.5 inch disk drive from a dead laptop (graphics card failed).

The hard drive is fine. I know the passphrase.

I had installed Ubuntu 10.04 with full fisk encryption using dm-crypt/luks using the alternate install cd.

I'm not exactly sure of the configuration I selected. Just that its full disk encryption with a pre-boot passphrase prompt.

Now my issue is, I have put the drive into a usb drive docking station, and I simply want to mount the partition on my new laptop, so I can copy the files over.

I've tried googling for various things like "mount dm-crypt drive linux" and "how to mount a luks encrypted partition linux", but I get no results.

View 4 Replies View Related

Security :: Create A LUKS Encryption Drive With Different Passwords?

Jun 20, 2010

I'd like to know if there's a simple way to create a LUKS encryption drive with different passwords? A real one that leads to one set of data, and another that leads to a whole different set of data. Is this even possible with LUKS?

View 1 Replies View Related

Security :: Traces Of Deleted Data On LUKS Filesystem ?

Apr 25, 2010

Recently, I started protecting all user-accessible filesystems on my Sidux desktop machine with LUKS. Before that, I would regularly erase traces of deleted data, and I wonder if this is still necessary.

It would be most valuable to me to be pointed towards a good introductory article on the underlying mechanics of LUKS and cryptsetup, as there are a few more minor questions to be answered. Unfortunately, I lack the necessary mathematic and cryptographic background to understand scientific papers.

View 2 Replies View Related

Debian :: Mount Encrypted LUKS Partition (On Former System HDD)

Feb 1, 2016

I have two basically identical harddrives that are encrypted with LUKS containing a complete debian installation:

Code: Select allroot@x200s:/home/b# lsblk --fs
NAME                   FSTYPE      LABEL UUID                                   MOUNTPOINT
├─sda1                 ext2              0b851969-281e-4db2-8a5b-3798e801711b   /boot
└─sda5                 crypto_LUKS       cfcf63ef-448a-4f72-9f58-8f7731cf3dfc   
  └─sda5_crypt         LVM2_member       21CS3f-SQeQ-XcMr-kyDs-OPtR-egmT-HkvJAu

[Code] ....

sda is what I currently run to write this text, sdb is my former harddrive, connected via USB.

I want to access the root partition on sdb.

The problem is:

Code: Select allcryptsetup luksOpen /dev/sdb5 oldhd
Enter passphrase for /dev/sdb5:
root@x200s:/home/b# ls /dev/mapper/
control  oldhd   sda5_crypt  x200s--vg-root  x200s--vg-swap_1
root@x200s:/home/b# mount /dev/mapper/oldhd /mnt/
[b]mount: unknown filesystem type 'LVM2_member'[/b]

[Code] ..

Before all this, both sda and sdb where in the same volume group. I renamed the volume group of sdb to "oldDisk"

Code: Select allvgrename <UUID> oldDisk

How I can access the data on the root filesystem of my sdb..

View 2 Replies View Related

Fedora :: Access /etc/modprobe.d On An Encrypted LVM LUKS Partition?

Nov 8, 2009

I need to access /etc/modprobe.d on an encrypted LVM LUKS partition. I m not sure how to go about it though. Mount usually handles my mounting needs, do I need to decrypt the physical volume first? LIst of commands need would make my day.

View 1 Replies View Related

Fedora :: 13 - Disable LUKS-encrypted Partition From Automount?

Aug 30, 2010

I have encrypted a partition while installing Fedora 13, and I need to disable its automount - I will mount those manually.

But even though I commented out the corresponding line in /etc/fstab, I am still asked for the passphrase for the partition at startup.

How to completely disable this behaviour - and how to mount the partition manually afterwards?

View 5 Replies View Related

General :: Moving A LVM/LUKS Encrypted Partition To The End Of A Harddrive?

May 16, 2011

I need to move a LUKS encrypted partition to the end of a harddrive to expand another partition. Does anyone know how to do this?

Is it possible to do this with other partition editing programs?

Gparted doesnt support LUKS/LVM

View 1 Replies View Related

Slackware :: Pondering About Encrypting The Keycard For A LUKS/LVM Partition?

Aug 15, 2010

So I was wondering about the dilemma of how to encrypt the password file on a key card to unlock your harddrive without having to enter any password. I came to the conclusion that that the scripts could do this without storing any passwords in plane text them self. Have a few extra steps to the scripts that would:

1. Read the UUID of any disks coming in.

2. Attempt to use that ID to decrypt a password file stored in the initrd.

3. Use the decrypted password file to unlock the the keycard partition.

4. THEN use the password files on the keycard to decrypt the main partition and boot the system.

However, if somebody stole your key card and didn't know what the unencrypted information was, then it's harmless for them to have it anyway. And if they did know, you wouldn't be any better off with it being encrypted because they probably can gain access to your computer anyway; leaving them to just pop the key card in and automatically decrypt the drive.

I suppose encrypting the keycard would give you extra assurance that the information would be much harder to recover if you destroyed the key card in a hurry. So would this extra security step even be worth it?

I guess the most secure thing would be to only have a password and type it in every time... unless you are concerned about the aliens/government stealing that from your brain which would probably mean they wouldn't need your password anyway.

View 3 Replies View Related

Fedora Security :: Remove Boot Mount Of Dm-crypt LUKS Md1?

Dec 22, 2009

When I upgraded from FC11 to FC12 of the encrypted raid partitions started to request password on boot (in FC11 not having references to encrypted md1 in fstab and crypttab, was enough for FC11 not to ask for passwords on boot) despite the fact that I removed /etc/crypttab and there is nothing in /etc/fstab relating to encrypted md1 (raid array). I want my machine to boot w/o asking me passwords for encrypted devices, and I will open and mount them myself manually after boot.

View 11 Replies View Related

Security :: Forgot LUKS Password - Possible To Crack With Limited Charset?

May 22, 2011

I've encrypted my root partition with LUKS and cannot remember my password. My main question is this: is it possible to extract the hash (or key; not sure on the correct terminology here) from the LUKS header and run it through a cracker? The hash type is SHA1 and I can remember the characters I used for the password, just not in the correct order (lots of special characters). That being said, given such a small charset, it should be crackable within a reasonable time, correct? Especially if I used a GPU accelerated cracker. What I don't know how to do is go about getting the hash from the LUKS header. Is any of this possible, or am I SOL? Of course, I have physical access to the system so I can boot it into any utilities I may need to.

View 3 Replies View Related

Copyrights 2005-15, All rights reserved