James PK's Technical Journal

I recently encrypted a portable hard drive (a Verbatium "Store'n'Go" 500GB) for backups. I decided to use LUKS (Linux Unified Key Setup-on-disk-format), to encrypt an entire partition.

I found a couple of good references to Encrypt hard drives: Encrypting-your-usb-pen-drive-with-luks and Encrypting-USB-Sticks.

I created two partitions but only encrypted one of them.

NB The real device names have been modified (in case a copy & paste results has unexpected consequences).

Here are the steps I followed on Debian Wheezy.

1. Fill hard drive with random data (see above references).
2. Formating the hard drive with fdisk. I created two partitions on the dive using fdisk (making sure the device name is right).
   

   Device Boot      Start         End      Blocks   Id  System
   /dev/xyz1            2048   411043839   205520896   83  Linux
   /dev/xyz2       411043840   976773167   282864664   83  Linux
   

3. Made the file systems for the normal partition.
   

   root@sal:~# mkfs -t ext3 -L verbatim_0a -v /dev/xyz1 

4. Run cryptsetup, with the options, -y (verify passsphrase twice), (-h specify the passhrase hash), -v (verbose) -c (encryption method) -s (key length)
   

   root@sal:~# cryptsetup -yvh sha256 -c aes-xts-plain -s 256 luksFormat /dev/xyz2 

5. Open the device

   root@hal:~# cryptsetup luksOpen /dev/xyz2 verbatim_1b #note last argument is not a path
   Enter passphrase for /dev/xyz2: 
   

6. Make the file system for the encrypted partition
   

   root@sal:~# mkfs.ext3 /dev/mapper/verbatim_1b

7. Mount the device

root@hal:~# mount /dev/mapper/verbatim_1b /media/verbatim_1b

8. Copy/Rsync data - with the drive open and mounted, it should now be possible to copy/rsync data.
9. Unmount & close

root@hal:~# umount /media/verbatim_1b
root@hal:~# cryptsetup luksClose verbatim_1b

I found the status option handy;

root@hal:~# cryptsetup -v status verbatim_1b

See also;

man cryptsetup

posted at: 00:00 | path: /cryptography | permanent link to this entry

---