We have heard multiple stories where someone looses a pendrive or a laptop containing sensitive\/private data which is then published by the person who found the drive embarrassing the owner of the data. The best way to prevent something like that from happening to you if you loose a disk is to make sure all your data is encrypted. Historically this used to be quite painful to setup and required a lost of technical know-how. Thankfully this is no longer the case. After trying a bunch of different options I found Linux Unified Key Setup-on-disk-format (LUKS) to be the most user-friendly and easy to setup option for me. <\/p>\n
Setting it up is quite easy by following the instructions over at www.cyberciti.biz<\/a>. However since things on the internet have a tendency of disappearing on a fairly frequent basis, I am using this post to save a paraphrased version of the installation instructions (along with my notes\/comments) just in case the original site goes down and I need to reinstall. All credit goes to original author. So without further ado here we go:<\/p>\n Install cryptsetup<\/b><\/p>\n First we need to install cryptsetup utility which contains all the utilities we need to encrypt our drive. To install it in Debian\/Ubuntu you just issue the following command as root:<\/p>\n Configure LUKS partition<\/b><\/p>\n Warning: This will remove all data on the partition that you are encrypting. So make sure you have a working backup before proceeding amd don’t blame me if you manage to destroy your data\/device.<\/p><\/blockquote>\n Run the following command as root to start the encryption process:<\/p>\n where <device> is the partition we want to encrypt (e.g. \/dev\/sda1). The command will ask you for confirmation and a passphrase. This passphrase is not recoverable so make sure you don’t forget it. <\/p>\n Create drive mapping<\/b><\/p>\n Once the previous command completes you need to create a mapping of the encrypted drive by issuing the following command:<\/p>\n You can also map a partition to using its UUID (which is what I do) by issuing the following command instead (This works great if you want to script automated backups to an external drive):<\/p>\n Replace the UUID in the example with the UUID of your drive. (Instructions on how to find the UUID are available here<\/a>).<\/p>\n Use the following command to see the status for the mapping and to check if the command succeeded:<\/p>\n Format LUKS partition<\/b><\/p>\n Now that we have created the mapping we need to write zeroes to the encrypted device, to ensure that the outside world sees this as random data and protects the system against disclosure of usage by issuing the following command:<\/p>\n Since this command can take a long time to complete depending on the drive size and dd by default doesn’t give any feedback on the percentage completed\/remaining I recommend that you use the pv command to monitor the progress by issuing the following command instead:<\/p>\n This will take a while to run so you can go for a walk or read a book while it runs. Once the command completes you can create a filesystem on the device (I prefer to use ext4 but you can use any filesystem you like) by formatting the device:<\/p>\n After the filesystem is created you can mount and use the partition as usual by issuing the following command:<\/p>\n That’s it. You now have an encrypted partition that shows up as a regular partition in Linux which you can use as a regular drive without having to worry about anything. No special changes are needed to use this partition which means any software can use it without requiring changes. <\/p>\n How to unmount and secure the data<\/b><\/p>\n After you are done transferring data to\/from the drive you can unmount and secure the partition by issuing the following commands as root:<\/p>\n followed by<\/p>\n Creating a backup of the LUKS headers<\/b><\/p>\n Before you start anything else, you should create a backup copy of the LUKS header because if this header gets corrupted somehow then all data in the encrypted partition is lost forever with no way to recover it. From the cryptsetup man page:<\/p>\n \u00e2\u20ac\u0153LUKS header: If the header of a LUKS volume gets damaged, all data is permanently lost unless you have a header-backup. If a key-slot is damaged, it can only be restored from a header-backup or if another active key-slot with known passphrase is undamaged. Damaging the LUKS header is something people manage to do with surprising frequency. This risk is the result of a trade-off between security and safety, as LUKS is designed for fast and secure wiping by just overwriting header and key-slot area.\u00e2\u20ac\u009d<\/p><\/blockquote>\n Create a backup by issuing the following command:<\/p>\n Important note: a LUKS header backup can grant access to most or all data, therefore you need to make sure that nobody has access to it. <\/p>\n In case of disaster where our LUKS header gets broken, we can restore it by issuing the following command:<\/p>\n How to remount the encrypted partition?<\/b><\/p>\n Issue the following commands in sequence to mount the partition:<\/p>\n Please note that data encrypted by LUKS is quite obvious with most Linux systems identifying it as an encrypted partition automatically. So if someone examines your system they will know you have encrypted data and can force you to divulge the password by various means (including the use of Rubber-hose Cryptanalysis<\/a>. ) <\/p>\n If you want the encrypted partition to be hidden then you can use Deniable encryption<\/a>\/Hidden Partition<\/a> or use steganography. I haven’t really used either so can’t comment on how to set it up correctly but maybe I can talk about it in a future post after I explore them a bit more.<\/p>\n Well this is all for now, hope you find this useful. Will write more later.<\/p>\n – Suramya<\/p>\n","protected":false},"excerpt":{"rendered":" We have heard multiple stories where someone looses a pendrive or a laptop containing sensitive\/private data which is then published by the person who found the drive embarrassing the owner of the data. The best way to prevent something like that from happening to you if you loose a disk is to make sure all […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"activitypub_content_warning":"","activitypub_content_visibility":"","activitypub_max_image_attachments":3,"activitypub_interaction_policy_quote":"anyone","activitypub_status":"","footnotes":""},"categories":[19,24,13,17,2],"tags":[],"class_list":["post-2600","post","type-post","status-publish","format-standard","hentry","category-computer-security","category-knowledgebase","category-linuxunix-related","category-security-tutorials","category-techie-stuff"],"_links":{"self":[{"href":"https:\/\/www.suramya.com\/blog\/wp-json\/wp\/v2\/posts\/2600","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.suramya.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.suramya.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.suramya.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.suramya.com\/blog\/wp-json\/wp\/v2\/comments?post=2600"}],"version-history":[{"count":12,"href":"https:\/\/www.suramya.com\/blog\/wp-json\/wp\/v2\/posts\/2600\/revisions"}],"predecessor-version":[{"id":2612,"href":"https:\/\/www.suramya.com\/blog\/wp-json\/wp\/v2\/posts\/2600\/revisions\/2612"}],"wp:attachment":[{"href":"https:\/\/www.suramya.com\/blog\/wp-json\/wp\/v2\/media?parent=2600"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.suramya.com\/blog\/wp-json\/wp\/v2\/categories?post=2600"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.suramya.com\/blog\/wp-json\/wp\/v2\/tags?post=2600"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}apt-get install cryptsetup<\/pre>\n
cryptsetup -y -v luksFormat <device><\/pre>\n
cryptsetup luksOpen <device> backup2<\/pre>\n
cryptsetup luksOpen UUID=88848060-fab7-4e9e-bac2-f9a2323c7c29 backup2<\/pre>\n
cryptsetup -v status backup2<\/pre>\n
dd if=\/dev\/zero of=\/dev\/mapper\/backup2<\/pre>\n
pv -tpreb \/dev\/zero | dd of=\/dev\/mapper\/backup2 bs=128M<\/pre>\n
mkfs.ext4 \/dev\/mapper\/backup2<\/pre>\n
mount \/dev\/mapper\/backup2 \/mnt\/backup<\/pre>\n
umount \/mnt\/backup<\/pre>\n
cryptsetup luksClose backup2<\/pre>\n
cryptsetup luksHeaderBackup <device> --header-backup-file <file><\/pre>\n
cryptsetup luksHeaderRestore <device> --header-backup-file <file><\/pre>\n
cryptsetup luksOpen <device> backup2\r\nmount \/dev\/mapper\/backup2 \/mnt\/backup\r\n<\/pre>\n
\n