eduardo
7 Mar 2018

Preparation

Prepare a mount point for your data and change ownership.
# Create a mount point
sudo mkdir /media/cryptoUSB
# Set permissions for the owner
sudo chown stefan:stefan /media/cryptoUSB

Create an Encrypted Device

Encrypt the device with LUKS. Note that all data on the partition will be overwritten during this process.
# Create encrypted device
sudo cryptsetup --verify-passphrase luksFormat /dev/sdX -c aes -s 256 -h sha256

# From the man page:
--cipher, -c
Set the cipher specification string.
--key-size, -s
Sets key size in bits. The argument has to be a multiple of 8.
The possible key-sizes are limited by the cipher and mode used.
--verify-passphrase, -y
When interactively asking for a passphrase, ask for it twice and
complain if both inputs do not match.
--hash, -h
Specifies the passphrase hash for open (for plain and loopaes
device types).

# Open the Device
sudo cryptsetup luksOpen /dev/sdX cryptoUSB
# Create a file system (ext3)
sudo mkfs -t ext3 -m 1 -O dir_index,filetype,sparse_super /dev/mapper/cryptoUSB
# Add a label
sudo tune2fs -L Crypto-USB /dev/mapper/cryptoUSB
# Close the devicesudo cryptsetup luksClose cryptoUSB

Usage

The usage is pretty simple. With a GUI you will be prompted for decrypting the device. At the command line, use the following commads to open and decrypt the device.
# Open the Device
sudo cryptsetup luksOpen /dev/sdcX cryptoUSB
# Mount it
sudo mount /dev/mapper/cryptoUSB /media/cryptoUSB

When you are finished with your secret work, unmount and close the device properly.
sudo umount /media/cryptoUSB
sudo cryptsetup luksClose cryptoUSB

https://blog.stefanproell.at/2016/04/28/encrypt-a-usb-drive-or-any-othe…

Tags