cryptsetup
Synonyms:
For headless server, we need automatically unlock LUKS encrypted drives after reboot.
$[texteditor]$
List Disks
lsblk -o NAME,UUID,SIZE,FSTYPE,TYPE,MOUNTPOINT
Install cryptsetup
sudo apt install cryptsetup
Create LUKS Disk
$[device]$
sudo cryptsetup --verbose --verify-passphrase --cipher=aes-xts-plain64 --hash=sha512 luksFormat $device$
Create a random keyfile
sudo dd if=/dev/urandom of=/root/keyfile bs=1024 count=4
sudo chmod 0400 /root/keyfile
Add the keyfile to LUKS
sudo cryptsetup luksAddKey $device$ /root/keyfile
Create device mapper
$[mappername]$
$[uuid]$
sudo $texteditor$ /etc/crypttab
add this line
$mappername$ UUID=$uuid$ /root/keyfile luks
or using this one line command
echo '$mappername$ UUID=$uuid$ /root/keyfile luks' | sudo tee -a /etc/crypttab
Reboot and check encrypted disk is automatically decrypted using the key file
sudo reboot
lsblk -o NAME,UUID,SIZE,FSTYPE,TYPE,MOUNTPOINT
sudo cryptsetup luksDump $device$
format disk using device mapper name
sudo mkfs.ext4 /dev/mapper/$mappername$
mount disk using device mapper name
$[mountpath]$
$[mount_option]$
sudo $texteditor$ /etc/fstab
add this line
/dev/mapper/$mappername$ $mountpath$ ext4 $mount_option$ 0 0
or using this one line command
echo '/dev/mapper/$mappername$ $mountpath$ ext4 $mount_option$ 0 0' | sudo tee -a /etc/fstab
mount now and check
sudo mkdir -p $mountpath$
sudo mount -a
df -h -x devtmpfs -x tmpfs
or you may mount by UUID