Jacobs Weblog

Works like a charm

A tip:

Before setting up LUKS on the drive overwrite it with random data in order to slow down an eventually attack on the encryption. The vise zealot would also perform a bad blocks scan to make sure the hard drive is not going to die too soon Do this in a single command:

  badblocks -c 10240 -s -w -t random -v /dev/sda

Paranoid beyond regular self toture? Willing to spend one or two days on the extra security? Do this:

  dd if=/dev/urandom of=/dev/sda

Warning: This wil definitely make your cpu and harddisk temprature rise and be in the high range the whole time!

I dunno.

Flash drives have a limited number of read-write cycles. Making a filesystem (for some filesystems; others may be different), performs many repeated writes to superblock pages.

in some cases you can wear out a flashcard just by making a filesystem on it.

It’s better to loopback-mount an image of the proper size, create the filesystem on that, and then just write the ready made image to the disk.

Have you ever tried using ntfs on a LUKS encrypted usb key? Setting it up works fine. When plugging in the key I get asked for the password. It even gets mounted, unfortunately as ntfs instead of ntfs-3g (which I have installed, non-LUKS volumes work fine, the same key just formatted with mkntfs gets mounted as ntfs-3g). Any hints on where I could say “prefer ntfs-3g over ntfs”?

I have Ubuntu Edgy Eft installed with packages ntfs-3g and pmount from

deb http://flomertens.keo.in/ubuntu/ dapper main main-all

I forget the password any way to recover it??? I thought it was a certain pass but it says incorrect

If you forgot your password I’m sorry to say that you are fucked. The password is the key to decrypt it. There is no way around it.

I hope you will remember it… good luck mate

How the hell does ubuntu know that there is an encrypted volume on the key. It should only look like an unformated partition with complete random data.

There is a BIG difference between having a usbdrive with random data (=nothing on it) and an usbdrive where i can tell that there IS an encrypted partition.

Can you give me a clue? My googling was unsuccesfull

thanx

Thanks, Jacob. Worked like a charm. And thanks, Kim, I used your badblocks command.

Sorry I don’t know

Great post! I just got a new case in the mail that converts an internal SATA harddrive into an enormous external USB. Now, thanks to the instructions above, it’s encrypted too. Works like a charm on my Gutsy laptop.

IMO the luks unified header is detected, the idea is to have a standard way of GUI opening encrypted partitions etc.

This does make the partition transparent to some extent I guess, thus reducing security; nonetheless this method is deemed secure as far as I know.

I’ve ordered a new USB hard disk that I plan to encrypt and now I’m experimenting with a USB stick. Everything seems to work but there is no magical password prompting when I insert the newly formated stick.

I’m running Kubuntu 7.04. Anyone know if I need to install something more than what is mentioned above

And how do I manually mount the encrypted drive?

Hi Kalle

I dont know how this is supposed to work in KDE but if you wanna do this manually I guess it would look something like this:

First attach the encrypted partition:

$ sudo cryptsetup luksOpen /dev/sda1 sda1
Enter LUKS passphrase:
key slot 0 unlocked
Command successful.

Now mount the encryptet filesystem:

sudo mount /dev/mapper/sda1 /mnt

When you are done unmount it again:

sudo umount /mnt

and remove the tempoary device mapped to the encrypted partition:

sudo cryptsetup luksClose sda1

I just set up an external USB hard drive with this guide, and it worked great.

Only one thing – when I now connect the USB drive, i get prompted for a password, but the drive doesn’t get mounted.

A /dev/mapper entry is set up:

ls -l /dev/mapper
total 0
crw-rw---- 1 root root  10, 63 2008-12-01 11:40 control
brw-rw---- 1 root disk 254,  0 2008-12-02 09:07 lukscrypto4e09dc8f-e411-4a34-b54c-326e7104a8ed

any suggestions on how to get it to be mounted automatically? there’s nothing useful in /var/log/messages. i suppose i can add an entry to /etc/fstab, but that still won’t make it mount automatically when it’s connected. i’m running ubuntu gutsy. thanks,

I’m sorry I have not idea why your disk won’t mount automatically

I’ve tried Ubuntu choking on the disk a few times but after a reboot everything went back to normal. But these case are very rare.

Which Ubuntu release are you running?

[...] Encrypted USB drive in Ubuntu [...]

Can this encrypted drive you create, can it be used in windows as well or just in ubuntu?

Perhaps… never tried. But I’m sure it won’t work out of the box.

Anyway of changing the default path it mounts the encrypted drive to, because now it mounts the drive to /media/disk which I need for something else.

Or maybe is there a way of disabling the auto-mount pass-phrase prompt, ’cause then I could manually mount it to a better path.

The mount point Ubuntu chooses is based on the label of the filesystem. Which means that if the label is ie. “WD 1TB” it will be mounted in /media/WD 1TB

Since the label cannot be read before the partition is actually decrypted I’m not sure Ubuntu can figure out to mount encrypted partitions using labels.

I’m not aware of anything you can do to disable auto mounting of encrypted partitions.

n00b-ish question:

I ran through all the steps which all cleared without compunction, but when I re-inserted the drive, and it prompted me for my passphrase (which I provided), it seemingly mounted but is inaccessible to me. It populates as a device but generates the error “Unable eto set up crypto device Error org.freedesktop.Hal.Device.Volume.Crypto.SetupError /dev/sdc is already setup?”. What have I done wrong?

@Malignus

If you done all the steps I must admit I don’t know what you could have done wrong. Does the error persist even after a reboot?

Just a note. If you encrypt a USB stick you should use ext2 and not ext3 as the latter is very slow on sticks due to the journalling system.

[...] http://emcken.dk/weblog/archives/164-encrypted-usb-drive-in-ubuntu.html a few seconds ago from Gwibber in context [...]

[...] Encrypted USB drive in Ubuntu Posted by Jacob Emcken [...]

I tryed this, everything is ok. Exept I cant copy files to the drive, Access denied!

I run Ubuntu 9.04