# Cryptsetup

In this book, I will explain how to encrypt your partitions using Linux Unified Key Setup-on-disk-format (LUKS) on your Linux based computer or laptop.

## Linux encryption methods

There are two methods to encrypt your data:

### Filesystem stacked level encryption

* eCryptfs - It is a cryptographic stacked Linux filesystem. eCryptfs stores cryptographic metadata in the header of each file written, so that encrypted files can be copied between hosts; the file will be decrypted with the proper key in the Linux kernel keyring. This solution is widely used, as the basis for Ubuntu's Encrypted Home Directory, natively within Google's ChromeOS, and transparently embedded in several network attached storage (NAS) devices.
* EncFS -It provides an encrypted filesystem in user-space. It runs without any special permissions and uses the FUSE library and Linux kernel module to provide the filesystem interface. You can find links to source and binary releases below. EncFS is open source software, licensed under the GPL.

### Block device level encryption

* Loop-AES - Fast and transparent file system and swap encryption package for linux. No source code changes to linux kernel. Works with 3.x, 2.6, 2.4, 2.2 and 2.0 kernels.
* Truecrypt - It is free open-source disk encryption software for Windows 7/Vista/XP, Mac OS X and Linux. (Deprecated)
* dm-crypt+LUKS - dm-crypt is a transparent disk encryption subsystem in Linux kernel v2.6+ and later and DragonFly BSD. It can encrypt whole disks, removable media, partitions, software RAID volumes, logical volumes, and files.

## Install cryptsetup utility

You need to install the following package. It contains cryptsetup, a utility for setting up encrypted filesystems using Device Mapper and the dm-crypt target. Debian / Ubuntu Linux user type the following apt-get command:
Sample outputs:
RHEL / CentOS / Fedora Linux user type the following yum command:

## Configure LUKS partition

In this example, I'll use partition called /dev/xvdc, and our first task will be to overwrite that partition 3 times with random data, that's enough to protect you against forensic investigation. It took me nearly 30 minutes for 20 GB partition to be overwritten 3 times.
Next, I'm going to encrypt /dev/xvdc. Type the following command:
Sample outputs:
This command initializes the volume, and sets an initial key or passphrase. Please note that the passphrase is not recoverable so do not forget it.Type the following command create a mapping:
Sample outputs:
You can see a mapping name /dev/mapper/backup2 after successful verification of the supplied key material which was created with luksFormat command extension:
Sample outputs:
You can use the following command to see the status for the mapping:
Sample outputs:
You can dump LUKS headers using the following command:

## Format LUKS partition

First, you need to write zeros to /dev/mapper/backup2 encrypted device. This will allocate block data with zeros. This ensures that outside world will see this as random data i.e. it protect against disclosure of usage patterns:
The dd command may take many hours to complete. I suggest that you use pv command to monitor the progress:
To create a filesystem i.e. format filesystem, enter:
To mount the new filesystem at /backup2, enter:

## How do I unmount and secure data?

Type the following commands:

## How do I mount or remount encrypted partition?

Type the following command:
See shell script wrapper that opens LUKS partition and sets up a mapping for nas devices.

## Can I run fsck on LUKS based partition / LVM volume?

Yes, you can use the fsck command on LUKS based systems:
See how to run fsck On LUKS (dm-crypt) based LVM physical volume for more details.

## How do I change LUKS passphrase (password) for encrypted partition?

Type the following command
Remove or delete the old password:
Please note that you need to enter the old password / passphrase.