Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

If I have an encrypted external disk (or an internal disk that is not in fstab), I see an entry for it in Nautilus -- with an entry like "X GB Encrypted Volume". I can click on this volume, and am prompted for a password to decrypt and mount the device.

But how do I do this from the command line?

This wiki page, and other docs I can find, only refer to GUI methods of decrypting the device; but this won't do in the context of headless servers or SSH logins. Is there a simple way to get devices to mount to automatic locations in "/media" just like they would with the GUI?

(I'm not asking about encrypted home directories -- I'm aware of ecryptfs-mount-private. This question is about additional encrypted volumes.)

share|improve this question

Your volume is probably encrypted with LUKS, here's how to mount it:

You need:

sudo apt-get install cryptsetup

To decrypt the volume:

sudo cryptsetup luksOpen /dev/sda1 my_encrypted_volume

Now you can mount it as usual:

sudo mkdir /media/my_device
sudo mount /dev/mapper/my_encrypted_volume /media/my_device

To lock the container again, it needs to be unmounted first:

sudo umount /media/my_device
sudo cryptsetup luksClose my_encrypted_volume

To automatically put it in the /media location, use the udisks tool

sudo udisks --mount /dev/mapper/my_encrypted_volume
share|improve this answer
So I can't do it as a non-privileged user, either, even though I could via the GUI? – cha Sep 30 '11 at 16:12
That actually depends on your system setting. I believe most commands should work as long as your system gives your user access to the devices. – Georg Schölly Sep 30 '11 at 19:45
Ubuntu 15.04 ships the udisks2 package in place of udisks, and the former renames the tool udisksctl. – skierpage Jun 29 '15 at 2:08

The steps in @Georg Schölly's answer did not work for me, as after the sudo mount /dev/mapper/my_encrypted_volume /media/my_device step I got the error:

mount: unknown filesystem type 'LVM2_member'

Here's what worked (/dev/sdb5 is the partition on my hard disk marked as crypt-luks):

udisksctl unlock -b /dev/sdb5
udisksctl mount -b /dev/mapper/ubuntu-root

The commands are executed without sudo. After entering my encryption passphrase after being prompted on the the first step, I then ended up with:

Mounted /dev/dm-1 at /media/dpm/e8cf82c0-f0a3-41b3-ab28-1f9d23fcfa72

From there I could access the data :)

share|improve this answer
I think this is the best answer, because I suspect this is more or less what nautilus does using libudisks2. Also, I've tested this to work well as an unprivileged user. – SlashV Aug 24 '15 at 14:52
I unfortunately get the error Object /org/freedesktop/UDisks2/block_devices/dm_2d3 is not a mountable filesystem. any advice? – wawa Dec 1 '15 at 14:41

One problem i ran into, was duplicate volume groups: Both my recovery system and the drive to be recovered were ubuntu systems with LVM. This is, why I had two ubuntu-vg volume groups (vgdisplay would display both, each with their own UUID, but i couldn't get to their logical volumes).

My solution builds on the answer of Georg:

  • Boot off a live-linux (so that you don't run into the duplicate volume group name)
  • sudo cryptsetup luksOpen /dev/sdaX my_encrypted_volume
  • enter your passphrase when prompted
  • sudo vgscan should now pick up the contained volumes/groups.


    use sudo vgrename ubuntu-vg ubuntu-vg2 to rename the volume group.

    If you need to boot off that drive, you can do these steps again, but rename your volume group back to ubuntu-vg. A different possibility is to alter your boot configuration to the new vg-name.

Now that the duplicate vg-name is resolved, i can boot back into my regular system, redo the cryptsetup..., vgscan and then mount /dev/mapper/ubuntu--vg2-root anywhere you like.

share|improve this answer
Looks like you can also do sudo vgdispay to find the UUID and use that instead of the duplicate name in order to do the rename of just the one volume. That is, grabbing the UUID and then doing sudo vgrename <uuid> old worked for me. – Mike May 14 at 0:17
I can't test Mike's suggestion right now, but If it works, it's better than renaming the volume group! – amenthes May 15 at 14:52

If you get this error:

mount: unknown filesystem type 'LVM2_member'


sudo apt-get install lvm2
sudo lvscan

then activate all LVM you see

sudo vgchange -ay

then re-run the mount:

sudo mount /dev/mapper/my_encrypted_volume /media/my_device
share|improve this answer

Was looking for the same...

The mkdir steps were my reason to look further, also I've modified policykit to allow my user to mount without asking first for the root passwd and then for the encrypted volume password, so the sudo was also over kill.

My solution I found was the use of gvfs-mount from the gvfs-bin package. Now with a gvfs-mount -d /dev/sda7 I'm asked for the encrypted password only and it's mounted under /media/VOLUME_LABEL.

share|improve this answer
Not getting luck with this. Steps I took: first, cat /proc/partitions to identify the /dev label for the drive. Second, gvfs-mount -d /dev/sdf1. This gives the error "No volume for device file /dev/sdf1". This looks close, though! – cha Jun 20 '12 at 14:18
It works for me. Strangely not through /dev/disks/by-label or /by-uuid, but only by /dev/sdxx – Redsandro Mar 4 '13 at 17:55
FYI: gvfs-mount -d /dev/sdaX worked perfectly for me in Linux Mint 17.3 -- No password required as with the GUI. – Jonathan Cross May 3 at 19:33

sdb1 here is an example you should input your device name, none of this commands will require root privileges

unlock encrypted disk

udisksctl unlock -b /dev/sdb1

after inserting the correct passphrase it will output something like this: Unlocked /dev/sdb1 as /dev/dm-3

then mount it to /media/

udisksctl mount -b /dev/dm-3

it should output something like this: Mounted /dev/dm-3 at /media/yourUserName/sdb

to unmount it

udisksctl unmount -b /dev/dm-3

to lock it again

udisksctl lock -b /dev/sdb1
share|improve this answer

The message "No volume for device file /dev/sdf1" will be present until you delete according device from /etc/fstab.
After that gvfs-mount works as designed

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.