2

I have created an encrypted drive in which to store sensitive files. I'm wondering if there is a command line tool to unmount the encrypted drive and lock it. If there is, I was going to create a launcher to go in my dock so I can click it and the command will be executed without ever having to open the command line.

I used the command sudo apt-get install cryptsetup and went into the application Disks and selected the disk I wanted formatted and selected Encrypted, compatible with Linux system (LUKS, ext4).

I created a file in gedit called lock and copied it into /bin so I can run it as a single command. In the file is the following:

#!/bin/bash
sudo umount /mnt/luks-79a537ae-8eed-42a3-be85-7c54b920d4a2
sudo cryptsetup luksClose /dev/mapper/luks-79a537ae-8eed-42a3-be85-7c54b920d4a2

I ran sudo visudo and added this line to the file:

amolith ALL=(ALL) NOPASSWD: /usr/bin/apt-get, /sbin/cryptsetup, /bin/umount, /bin/lock

I saved it, exited, and, now, when I run lock, I am still prompted for my password even though the commands should not require the root password now (AFAIK).

9
  • I assume you're using LUKS? Sep 11, 2017 at 15:52
  • Yes, but we need to know the encryption technology.
    – Panther
    Sep 11, 2017 at 15:55
  • @bodhi.zazen I added the information.
    – Amolith
    Sep 11, 2017 at 15:57
  • @AndroidDev I added the information.
    – Amolith
    Sep 11, 2017 at 15:57
  • Where is the information @Amolith? Sep 11, 2017 at 15:59

1 Answer 1

3

Yes, you are using LUKS . You need to know the name of the name of the partition, where it is mounted, and crypt name, it is in /dev/mapper

To mount (decrypt)

cryptsetup luksOpen /dev/sdxy name_of_crypt
mount /dev/mapper/name_of_crypt /mount_point

To unmount (encrypt)

umount /mount_point
cryptsetup luksClose name_of_crypt

You may need to run those commands as root, ie sudo, so my advice is to configure sudo to run cryptsetup without a password.

Note: scripting mount / unmount of the encrypted data sort of defeats the purpose of encrypting in the first place. I would leave it as is ;)

See How to script a mount command involving a dm-crypt / luks volume but , IMO, the answer in that question is insecure as you password is now in plain text. You could use expect to automate as well

https://www.lifewire.com/linus-unix-command-expect-2201096

9
  • I'm looking at this to configure sudo so I don't have to enter my password for cryptsetup. I can't find where cryptsetup be in the filesystem though.
    – Amolith
    Sep 11, 2017 at 20:39
  • which cryptsetup or sudo updatedb && locate cryptsetup | grep bin
    – Panther
    Sep 11, 2017 at 20:51
  • It doesn't now, though. I wrote the script, it executes fine, cryptsetup executes without sudo, but umount does not (even when added to visudo) and, when I run ls in /bin, umount is highlighted red.
    – Amolith
    Sep 12, 2017 at 0:57
  • I have named the file lock and and copied it into /bin and marked it as executable. When I run lock, I'm prompted for the password and I don't want to be. I've figured about that the issue is with umount but I don't know why I'm prompted for it when umount is already added to visudo.
    – Amolith
    Sep 12, 2017 at 1:00
  • you would have to post your sudo configuration and never hurts to post the commands you ran so we may check your syntax.
    – Panther
    Sep 12, 2017 at 2:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.