Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a non-Linux partition I want to encrypt with LUKS. The goal is to be able to store it by itself on a device without Linux and access it from the device when needed with an Ubuntu Live CD.

I know LUKS can't encrypt partitions in place, so I created another, unformatted partition of the EXACT same size (using GParted's "Round to MiB" option) and ran this command:

sudo cryptsetup luksFormat /dev/xxx

Where xxx is the partition's device name. Then I typed in my new passphrase and confirmed it. Oddly, the command exited immediately after, so I guess it doesn't encrypt the entire partition right away? Anyway, then I ran this command:

sudo cryptsetup luksOpen /dev/xxx xxx

Then I tried copying the contents of the existing partition (call it yyy) to the encrypted one like this:

sudo dd if=/dev/yyy of=/dev/mapper/xxx bs=1MB

and it ran for a while, but exited with this:

dd: writing `/dev/mapper/xxx': No space left on device

just before writing the last MB. I take this to mean the contents of yyy was truncated when it was copied to xxx, because I have dd'd it before, and whenever I have dd'd to a partition of the exact same size, I never get that error. (and fdisk reports they are the same size in blocks).

After a little Googling I discovered all luksFormat'ted partitions have a custom header followed by the encrypted contents. So it appears I need to create a partition exactly the size of the old one + however many bytes a LUKS header is.

What size should the destination partition be, no. 1, and no. 2, am I even on the right track here?

  • UPDATE

I found this in the LUKS FAQ:

  • I think this is overly complicated. Is there an alternative?

Yes, you can use plain dm-crypt. It does not allow multiple passphrases, but on the plus side, it has zero on disk description and if you overwrite some part of a plain dm-crypt partition, exactly the overwritten parts are lost (rounded up to sector borders).

So perhaps I shouldn't be using LUKS at all?

share|improve this question

Got it. dm-crypt did the trick. Use that instead of LUKS if you only need a single key and need the partition to be a certain size.

share|improve this answer

Very late answer to old problem, but that still exists ... maybe helpful to others.

I had a similar idea: I have a spare HDD, and I wanted to create a encrypted partition on that HDD to allow for simply rsync-based backups from my root SSD to an encrypted disk.

I read about encrypting filesystems in the wiki (and some other wiki pages).

First answer there: use gnome-disk-utiliy. Problem with that: it crashes when selecting to create an encrypted partition. Then I turned here; and found the 4 year old answer about "dm-crypt" to not be helpful with 16.04; as there is not even a package for dm-crypt around.

So I started looking into cryptsetup; and long story short: one has to type YES, in order to keep it going. And then it just works quick and nicely:

Example:

sudo cryptsetup --verbose luksFormat /dev/sdb1
sudo cryptsetup --verbose open /dev/sdb1 enc-backup
sudo mkfs.ext4 -L backup /dev/mapper/enc-backup

The first call to cryptsetup asks to type "yes" with uppercase ... and as soon as you really type YES, and not Yes or yes ... it will do its job.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.