Initial commit

Keith Irwin 2021-07-05 19:17:27 -06:00
commit bcac96299f
Signed by: ki9
GPG Key ID: DF773B3F4A88DA86
3 changed files with 229 additions and 0 deletions

32 100644
View File

@ -0,0 +1,32 @@
# luksit
luks-encrypt an entire hard drive using a randomly-generated keyfile.
## Origins
I based on a tutorial on [a github gist]( that's now down. I found [a cached version]( on bing. That original tutorial can be found in ``.
## Installation
### Linux & friends
git clone /usr/local/src/luksit
ln -s /usr/local/src/luksit/luksit /usr/local/bin/luksit
## Usage
> **WARNING!** This program will wipe any drive you feed it and replace it with an empty luks-encrypted filesystem. Always read command line prompts before typing 'y'. Always double-check the device filename. Always keep backups of your important data. I am not responsible for misuse of this program.
First, find the device name of the target drive. I use the `lsblk` command. Others prefer `fdisk -l`. Check and double check. If you go by the size, ensure you have no other drives of that size.
Assuming the target device file is `/dev/sdf`, you can create a luks-encrypted ext4 filesystem on that drive by running this command. You can change `mydrive` to something more memorable. The decryption key will be saved to `/root/luks/mydrive.key` unless you modify the `$KEYDIR` var in the script.
luksit sdf mydrive ext4
### Mounting on boot
The script does not yet support adding lines to `/etc/fstab` or `/etc/crypttab`. Consult the "automountable" section in `` for help with automounting the drive.

luksit 100755
View File

@ -0,0 +1,89 @@
# luksit
# USAGE: luksit <device> <name> [filesystem]
# EXAMPLE: luksit sdf mydrive ext4
# Check for root
if [[ $EUID -ne 0 ]]; then
echo "This script must be run as root"
exit 1
# Get args
if [[ $# -eq 3 ]]; then
elif [[ $# -eq 2 ]]; then
echo "USAGE: $0 <device> <name> [filesystem]"
exit 2
# Quit if given "no" at prompt
bail(){ [[ "$0" = "$BASH_SOURCE" ]] && exit 1 || return 1; }
# Where keys are stored
# Check if name is used
#if [ -h "/dev/mapper/$name" ]; then
# echo "/dev/mapper/$name already exists."
# exit 420
# Wipe disk
read -p "Wipe /dev/$device with zeroes first? [y/n]" -n 1 -r
echo; [[ $REPLY =~ ^[Yy]$ ]] && \
( echo "Wiping disk with zeros..." ; \
dd if=/dev/zero bs=1M | pv | dd of="/dev/$device" bs=1M )
# Set up partition
echo "Setting up partition..."
umount "/dev/$device" >/dev/null
parted "/dev/$device" mklabel gpt && \
parted --script -- "/dev/$device" mkpart primary 1 -1 && \
# Get first partition name
part="$(lsblk --list --noheadings --output name "/dev/$device" | sed -n '2 p')"
# Generate key file
mkdir "$KEYDIR/" >/dev/null
if [ -f "$KEYDIR/$name.key" ]; then
echo ""
echo -n "Generating key file... "
dd if=/dev/urandom of="$KEYDIR/$name.key" bs=1024 count=4 && \
chmod 0400 "$KEYDIR/$name.key" && echo "Done."
# Encrypt
echo "Creating luks encrypted partition..."
cryptsetup luksFormat "/dev/$part" "$KEYDIR/$name.key" && \
cryptsetup luksAddKey "/dev/$part" "$KEYDIR/$name.key" --key-file="$KEYDIR/$name.key" && \
# Mount new luks partition
echo "Mounting luks partition..."
cryptsetup luksOpen "/dev/$part" "$name" --key-file="$KEYDIR/$name.key" && \
# Write filesystem on new luks partition
echo "Creating $fs filesystem in luks partition..."
cryptsetup resize "$name" --key-file="$KEYDIR/$name.key"&& \
"mkfs.$fs" "/dev/mapper/$name" -L "$name" && \
echo "Mounting $fs filesystem to /mnt/$name..."
mkdir "/mnt/$name" >/dev/null
chmod 755 "/mnt/$name"
mount "/dev/mapper/$name" "/mnt/$name" && \
df -h "/mnt/$name" && \
echo "DONE!"
# TODO: Show lines for fstab and crypttab

View File

@ -0,0 +1,108 @@
#### Source
[Original Gist](
[Bing cache](
# LUKS crypt
In this guide, I'm going to setup a keyfile-encrypted LUKS partition. I will be using a single, max-size partition on a single physical device. My physical device is located at /dev/sde
## partition the physical device
parted /dev/sde
(parted) mklabel gpt
(parted) mkpart primary 1 -1
(parted) quit
## create the key file
Before we go further, let's create our 2048-bit key file first. I'm going to install it /root/secret.key
sudo dd if=/dev/urandom of=/root/secret.key bs=1024 count=2
sudo chmod 0400 /root/secret.key
## create LUKS partition
In my case, /dev/sde1 was created by parted. Create the LUKS partition with our key file now.
cryptsetup luksFormat /dev/sde1 /root/secret.key
Associating our key with the LUKS partition will allow us to automount it later and prevent us from ever seeing a password prompt.
cryptsetup luksAddKey /dev/sde1 /root/secret.key --key-file=/root/secret.key
## initialize the LUKS partition
Before we can start using our LUKS partition, we have to size it properly and format it first. In order to do that, we will first use luksOpen which creates an IO backing device that allows us to interact with the partition. I'll call my device secret; you can call yours whatever you want.
cryptsetup luksOpen /dev/sde1 secret --key-file=/root/secret.key
the LUKS mapping device will now be available at /dev/mapper/secret
## size the LUKS partition
When using resize without any additional vars, it will use the max size of the underlying partition.
cryptsetup resize secret --key-file=/root/secret.key
## format the LUKS partition
I'm going to use ext4; you can use whatever you want.
mkfs.ext4 /dev/mapper/secret
## create a mount point
I'll create a mount point at /secret
sudo mkdir -p /secret
sudo chmod 755 /secret
## mount the LUKS mapping device
mount /dev/mapper/secret /secret
df /secret
## automountable
To avoid the hassle of mounting are encrypted volume manually, we can set it up such that it automounts using the specified key file. First you have to get the UUID for your partition.
ls -l /dev/disk/by-uuid
Find the UUID that links to your disk. In my case, it is 651322a-8171-49b4-9707-a96698ec826e.
export UUID="651322a-8171-49b4-9707-a96698ec826e"
sudo echo "secret UUID=${UUID} /root/secret.key luks" >> /etc/crypttab
Finally, specify the automount
sudo echo "/dev/mapper/secret /secret auto" >> /etc/fstab
Mount stuff!
sudo mount -a