Is there a way to lock an encrypted drive from the command line?

Question

I have created an encrypted drive in which to store sensitive files. I'm wondering if there is a command line tool to unmount the encrypted drive and lock it. If there is, I was going to create a launcher to go in my dock so I can click it and the command will be executed without ever having to open the command line.

I used the command sudo apt-get install cryptsetup and went into the application Disks and selected the disk I wanted formatted and selected Encrypted, compatible with Linux system (LUKS, ext4).

I created a file in gedit called lock and copied it into /bin so I can run it as a single command. In the file is the following:

#!/bin/bash
sudo umount /mnt/luks-79a537ae-8eed-42a3-be85-7c54b920d4a2
sudo cryptsetup luksClose /dev/mapper/luks-79a537ae-8eed-42a3-be85-7c54b920d4a2

I ran sudo visudo and added this line to the file:

amolith ALL=(ALL) NOPASSWD: /usr/bin/apt-get, /sbin/cryptsetup, /bin/umount, /bin/lock

I saved it, exited, and, now, when I run lock, I am still prompted for my password even though the commands should not require the root password now (AFAIK).

Answer 1

Yes, you are using LUKS . You need to know the name of the name of the partition, where it is mounted, and crypt name, it is in /dev/mapper

To mount (decrypt)

cryptsetup luksOpen /dev/sdxy name_of_crypt
mount /dev/mapper/name_of_crypt /mount_point

To unmount (encrypt)

umount /mount_point
cryptsetup luksClose name_of_crypt

You may need to run those commands as root, ie sudo, so my advice is to configure sudo to run cryptsetup without a password.

Note: scripting mount / unmount of the encrypted data sort of defeats the purpose of encrypting in the first place. I would leave it as is ;)

See How to script a mount command involving a dm-crypt / luks volume but , IMO, the answer in that question is insecure as you password is now in plain text. You could use expect to automate as well

https://www.lifewire.com/linus-unix-command-expect-2201096