How To Create a dm-crypt LUKS Volume Without LVM
The following details the procedure for creating an encrypted 32GB dmcrypt LUKS volume on Ubuntu without using LVM.
Create an empty file to serve as storage device
To store our encrypted data, we need to create a file which will act as our storage device.
root@asus:/media/kevin# fallocate -l 32G /media/kevin/newvol
root@asus:/media/kevin# ll -h
total 33G
drwxr-x—+ 8 root root 4,0K Jul 19 23:05 ./
drwxr-xr-x 3 root root 4,0K Jul 11 17:42 ../
drwxrwxr-x 43 kevin kevin 4,0K Jul 19 22:06 DATA/
drwxrwxr-x 37 kevin kevin 4,0K Jun 16 08:35 DATAVOLUMELUKS/
drwxr-xr-x 2 kevin kevin 4,0K Jun 15 16:13 Downloads/
-rw-r–r– 1 root root 32G Jul 19 23:05 newvol
drwxrwxrwx 10 kevin kevin 4,0K Jul 11 19:11 PRIMARY_BACKUP/
drwxrwxrwx 6 kevin kevin 4,0K Jun 20 21:02 PRIMARY_MEDIA/
drwxr-xr-x 2 root root 4,0K Jun 15 19:55 USBSTICK/
root@asus:/media/kevin#
Create a dm-crypt LUKS Container inside the File
Before formatting the file we created above, we need to create a LUKS partition within the file. LUKS – the Linux Unified Key Setup, is a standard used for disk encryption.
create the container with this command:
root@asus:/media/kevin# cryptsetup -y luksFormat /media/kevin/newvol
WARNING!
========
This will overwrite data on /media/kevin/newvol irrevocably.
Are you sure? (Type ‘yes’ in capital letters): YES
Enter passphrase for /media/kevin/newvol:
Verify passphrase:
root@asus:/media/kevin#
use “file” to check that this is now a LUKS encrypted file:
file /media/kevin/newvol
root@asus:/media/kevin# file /media/kevin/newvol
/media/kevin/newvol: LUKS encrypted file, ver 2 [, , sha256] UUID: 15affa5e-c600-4a40-86e7-4a7d91fee29e
root@asus:/media/kevin#
Now we have the container in our file, we can open the container:
cryptsetup luksOpen /media/kevin/newvol DATAVOLUMELUKSNEW
This opens the LUKS device and maps it to a name we specify. In this case /dev/mapper/DATAVOLUMELUKSNEW. This opens the file as a local loopback device so the file system can handle the file as if it were a real device.
Create and Mount the File System
Now that we have created a LUKS container opened as a regular device on the system, we can format and create a filesystem on the device.
We will use:
mkfs.ext4 -j /dev/mapper/DATAVOLUMELUKSNEW
root@asus:/media/kevin# mkfs.ext4 -j /dev/mapper/DATAVOLUMELUKSNEW
mke2fs 1.45.6 (20-Mar-2020)
Creating filesystem with 8384512 4k blocks and 2097152 inodes
Filesystem UUID: 3d2880eb-dd75-4542-97d1-b69240101931
Superblock backups stored on blocks:
32768, 98304, 163840, 229376, 294912, 819200, 884736, 1605632, 2654208,
4096000, 7962624
Allocating group tables: done
Writing inode tables: done
Creating journal (32768 blocks): done
Writing superblocks and filesystem accounting information: done
root@asus:/media/kevin#
then mount the volume:
root@asus:/media/kevin# mkdir DATAVOLUMELUKSNEW
root@asus:/media/kevin# mount /dev/mapper/DATAVOLUMELUKSNEW /media/kevin/DATAVOLUMELUKSNEW
root@asus:/media/kevin# df
Filesystem 1K-blocks Used Available Use% Mounted on
tmpfs 1844344 2176 1842168 1% /run
/dev/nvme0n1p4 413839584 197374804 195373196 51% /
tmpfs 9221708 335416 8886292 4% /dev/shm
tmpfs 5120 4 5116 1% /run/lock
tmpfs 4096 0 4096 0% /sys/fs/cgroup
/dev/nvme0n1p1 98304 33565 64739 35% /boot/efi
tmpfs 1844340 80 1844260 1% /run/user/1000
geminivpn:/export/DATA 56721408 37371392 16450048 70% /media/kevin/DATA
intelvpn:/media/kevin/PRIMARY_MEDIA 2063187968 1228222464 730091520 63% /media/kevin/PRIMARY_MEDIA
intelvpn:/media/kevin/PRIMARY_BACKUP 1031070720 231892992 746732544 24% /media/kevin/PRIMARY_BACKUP
tmpfs 1844340 60 1844280 1% /run/user/131
tmpfs 1844340 60 1844280 1% /run/user/0
/dev/mapper/DATAVOLUMELUKSNEW 32880400 49176 31137940 1% /media/kevin/DATAVOLUMELUKSNEW
root@asus:/media/kevin#
We are mounting the volume as DATAVOLUMELUKSNEW as we want to move the data from the old DATAVOLUMELUKS to DATAVOLUMELUKSNEW
then we will unmount and delete the old DATAVOLUMELUKS and rename the new DATAVOLUMELUKSNEW as DATAVOLUMELUKS
root@asus:/media/kevin# mountdata
Enter passphrase for /home/kevin/BACKUP/DATAVOLUMELUKS:
Filesystem Size Used Avail Use% Mounted on
tmpfs 1,8G 2,2M 1,8G 1% /run
/dev/nvme0n1p4 395G 189G 187G 51% /
tmpfs 8,8G 328M 8,5G 4% /dev/shm
tmpfs 5,0M 4,0K 5,0M 1% /run/lock
tmpfs 4,0M 0 4,0M 0% /sys/fs/cgroup
/dev/nvme0n1p1 96M 33M 64M 35% /boot/efi
tmpfs 1,8G 80K 1,8G 1% /run/user/1000
geminivpn:/export/DATA 55G 36G 16G 70% /media/kevin/DATA
intelvpn:/media/kevin/PRIMARY_MEDIA 2,0T 1,2T 697G 63% /media/kevin/PRIMARY_MEDIA
intelvpn:/media/kevin/PRIMARY_BACKUP 984G 222G 713G 24% /media/kevin/PRIMARY_BACKUP
tmpfs 1,8G 60K 1,8G 1% /run/user/131
/dev/mapper/DATAVOLUMELUKSNEW 32G 49M 30G 1% /media/kevin/DATAVOLUMELUKSNEW
/dev/mapper/DATAVOLUMELUKS 20G 12G 6,6G 64% /media/kevin/DATAVOLUMELUKS
root@asus:/media/kevin#
next we do an rsync from DATAVOLUMELUKS to DATAVOLUMELUKSNEW:
rsync -av /media/kevin/DATAVOLUMELUKS/ /media/kevin/DATAVOLUMELUKSNEW/
we can then delete the old DATAVOLUMELUKS and switch to the new one:
umount /media/kevin/DATAVOLUMELUKS
cryptsetup luksClose DATAVOLUMELUKS
root@intel:/home/kevin/BACKUP# rm /home/kevin/BACKUP/DATAVOLUMELUKS
root@intel:/home/kevin/BACKUP#
root@intel:/media/kevin# mv /media/kevin/newvol /home/kevin/BACKUP/DATAVOLUMELUKS
root@intel:/media/kevin#
umount the new volume:
umount /media/kevin/DATAVOLUMELUKSNEW
cryptsetup luksClose DATAVOLUMELUKSNEW
and remount the new one:
cryptsetup luksOpen /home/kevin/BACKUP/DATAVOLUMELUKS DATAVOLUMELUKS
mount /dev/mapper/DATAVOLUMELUKS /media/kevin/DATAVOLUMELUKS
root@intel:/media/kevin# df -h
Filesystem Size Used Avail Use% Mounted on
tmpfs 785M 2,0M 783M 1% /run
/dev/sdb5 153G 51G 95G 35% /
tmpfs 3,9G 89M 3,8G 3% /dev/shm
tmpfs 5,0M 4,0K 5,0M 1% /run/lock
tmpfs 4,0M 0 4,0M 0% /sys/fs/cgroup
tmpfs 785M 104K 785M 1% /run/user/1000
/dev/sdd2 984G 222G 713G 24% /media/kevin/PRIMARY_BACKUP
/dev/sdd1 2,0T 1,2T 697G 63% /media/kevin/PRIMARY_MEDIA
geminivpn:/export/DATA 55G 37G 15G 71% /media/kevin/DATA
/dev/sda1 112G 108M 112G 1% /media/kevin/New Volume
/dev/sdc1 1,8T 1,5T 217G 88% /media/kevin/SECONDARY_MEDIA
tmpfs 785M 72K 785M 1% /run/user/0
/dev/mapper/DATAVOLUMELUKS 32G 7,9G 22G 27% /media/kevin/DATAVOLUMELUKS
root@intel:/media/kevin#
the temporary new mount point can now also be removed:
root@intel:/media/kevin# rmdir DATAVOLUMELUKSNEW
root@intel:/media/kevin#