2

I am trying to make a script that will mount an encrypted volume (dm-crypt / luks) with a password that is passed as argument to that script.

My trouble is that I can't find a way to make that script work ...

For instance, when I run this :

mount /my/encrypted/path > file.txt 2>&1

it still shows me the password question outside the script and let me type the password .... It's just like the mount command found a way to escape the redirections that I've set ....

So it's impossible for me now to input a password due to the fact that the part that ask me the password runs outside my script .....

How mount found a way to escape redirection ? I don't know.

Do I have to change some configuration file ? I don't know.

Is mount has some luks specific commands ? I don't know.

How can I mount an encrypted volume via a script without having "human" interaction with my script (aka : my script type the password) ?

I know that what I try to achieve may represent a security risk .... but the password will be transferred in a secure way to the script (so do not care about the potential security risk that it can involve).

In case this matters : I try to achieve this under Ubuntu 64bit 11.10.

2 Answers 2

2

Is mount has some luks specific commands ? I don't know.

No, the whole encryption part is managed with the crypsetup-tools and in /etc/crypttab, both have valuable man-pages.

How can I mount an encrypted volume via a script without having "human" interaction with my script (aka : my script type the password)?

You can use keyfiles instead of passwords. See the documentation mentioned above or search the web for tutorials and examples. There is also the script /lib/cryptsetup/scripts/decrypt_derived which allows the use of unlocked luks-devices as key. You will also find help on that topic in the web.

1

I've finally found the answer in another website.

In order to script a password process with mount you can do it by redirecting to stdin the password.

In order to do that you must specify to mount that you want to use stdin for the password witch is the option "-p 0"

The script for auto mounting an encrypted volume is like this :

mount /your/encrypted/path -p 0 <<EOF
The password
EOF

This is one of the existing methods in order to write to stdin. This one is not quite secure but the simplest way to do it in order to show the concept.

Best regards.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .