4

How can I create an encrypted file container with the tools already available in Ubuntu, without installing any extra applications? I've tried VeraCrypt and zuluCrypt, but they both require installation.

3
  • I think the best way is to start with a fresh installation, and during the installation, at the partitioning window, select LVM with LUKS encryption 'encrypted disk'. You do this from the Ubuntu live drive (created from the Ubuntu iso file), so you need no extra application program.
    – sudodus
    May 25, 2020 at 15:21
  • I want a separate file container (or multiple containers) not disk/partition encryption.
    – kat
    May 25, 2020 at 16:37
  • I see. Do you want containers, that you can use as file systems, or would it be OK to use for example an zip archive with encryption (lower security level) or a gpg encrypted tarball (higher security level)?
    – sudodus
    May 25, 2020 at 16:47

1 Answer 1

6

I am compiling this as an answer, but a much more comprehensive explanation can be found at this link. I recommend reading through it.

To create a file container encrypted with LUKS/dm-crypt, using cryptsetup as the user-space tool (both available in Ubuntu repositories), follow these steps:

  1. Install cryptsetup:

sudo apt install -y cryptsetup

  1. Create the actual container, containing random data:

sudo dd if=/dev/urandom of=/path/to/your/file.bin bs=1M count=1024

This will create a 1GB (1024 x 1MB) container at the location you specify in the of parameter, adapt the size to your need via the count parameter.

  1. Mount the file container as a loopback device:

sudo losetup -f --show /path/to/your/file.bin

Note the loop device number that is assigned by losetup.

  1. Create the encrypted container:

sudo cryptsetup luksFormat /dev/loopX

where you replace loopX with the actual device number you noted just before. Choose your password when prompted. You can verify that the container has been correctly formatted by LUKS by doing

sudo cryptsetup luksDump /dev/loopX

  1. Map the encrypted container (you can replace c1 by whatever name you want):

sudo cryptsetup luksOpen /dev/loopX c1

  1. Create a filesystem in the mapped container - here I use ext4:

sudo mkfs.ext4 /dev/mapper/c1

  1. Finally, mount the file system anywhere you want:

sudo mount /dev/mapper/c1 /mnt

After that, to use the container you repeat steps 2, 4 and 6. This can easily be automated in a script.

LUKS encryption has many other useful features, such as keyslots, detached headers etc. that I let you discover for yourself.

And remember, the single most important thing when encrypting stuff is CHOOSE A STRONG PASSWORD.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.