Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Because of limitation of filename size of ecryptfs, I decided to use encrypted partition. Since I already use ecryptfs, for my home folder, I don't need the key to be password-protected.

I need a script, that can non-interactively mount an encrypted filesystem contained in a given file with a key stored in a binary file. I am open to any working solution to this problem, as long, as I can use sparse file as a backing storage (so no truecrypt, and no cryptmount-setup).

share|improve this question
up vote 2 down vote accepted

It should be possible to use dm-crypt/LUKS/cryptsetup for this using the following steps:

  1. Create a sparse disk image file: dd if=/dev/zero of=IMAGEFILE bs=1 count=1 seek=SIZE
  2. Generate a random key in a file: dd if=/dev/random of=KEYFILE bs=1024 count=1
  3. Use cryptsetup luksFormat --key-file KEYFILE --cipher aes-xts-plain --size 512 IMAGEFILE (Or use another cipher and key length. Note that 512 here will give you AES with 256 bits because of XTS.)
  4. Open crypt container: cryptsetup luksOpen --key-file KEYFILE IMAGEFILE NAME
  5. Create file system on /dev/mapper/NAME.
  6. Mount file system as usual.

Your script would just have to do steps 4 and 6. For unmounting/closing, umount the file system and call cryptsetup luksClose NAME.

Note that using sparse files will leak the information which sectors of the disk have been used already (the same way as not overwriting a partition with random data before encrypting it). It is up to you to decide whether this is ok for you.

Also note that deleting files will not make the disk image smaller. The sparse file will grow monotonically.

share|improve this answer
Thank you! I'm giving it a try. BTW, isn't that for this setup only first 64 bytes of the key will be used? – Adam Ryczkowski Aug 17 '12 at 13:48
Yes, the man page of cryptsetup says it will use the appropriate amount of key material from the file. I just used 1 KB to surely have enough in there, but it's not necessary. – Philipp Wendler Aug 17 '12 at 13:51

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.