The Node

It can sometimes be useful to have an encrypted partition to keep your stuff secret from prying eyes. Most tutorials will tell you to encrypt your home partition and have it open at boot time. But this means that the encrypted partition is un-encrypted as long as your machine is switched on and you are logged in.
Here, I’ll show you how to set up a free partition or disk as an “on demand” encrypted partition. Meaning that we’ll write a couple of shell scripts to open and close the protected partition so that the partition is only open when you need it. It also has the added benefit on being mostly invisible to a cursory glance at the system. Unless somebody thinks to check the contents of /dev, your encrypted partition will not be visible because it’s not always mounted.

I will explain how to encrypt your partition using Linux Unified Key Setup (LUKS) on Ubuntu Linux. Ubuntu uses the AES-256 cipher to encrypt the disk volume, so it’s pretty secure. LUKS is the basic standard for disk encryption for Linux and is available for all Linux systems running a 2.6+ kernel…which these days is pretty much every system.

For this, you will either need a second hard disk you want to use as an encrypted drive – meaning the partition takes up the whole disk or an empty partition on your primary disk, assuming you didn’t use the entire disk when you set up your Ubuntu system. If you don’t have a spare disk or partition available, don’t worry – LUKS is flexible enough that you can use a file container to act as an encrypted storage area. If you’re using a partition, I’ll assume it’s called /dev/sdb1 (first primary partition on the second hard disk). Yours can be anything, obviously.

First you will need cryptsetup, a utility for setting up encrypted file-systems using Device Mapper and the dm-crypt kernel module. You can install it with: –

sudo apt-get install cryptsetup

Once this is installed, you can use it to set up the initial partition. Remember, we’re using /dev/sdb1 (first partition on the second disk) but you can use anything.

sudo cryptsetup -y -v luksFormat /dev/sdb1

This will warn you that this will wipe the data on the partition, so make sure you’ve passed it the right one :-) Here is also where you’ll set the password/passphrase for the partition, so don’t forget it!

WARNING!
========
This will overwrite data on /dev/sdb1 irrevocably.
 
Are you sure? (Type uppercase yes): YES
Enter LUKS passphrase:
Verify passphrase:
Command successful.

Okay, now the partition needs to be opened by the encryption manager. Do this with: –

sudo cryptsetup luksOpen /dev/sdb1 encrypted

You will be prompted for your password you created when you created the encrypted partition. The “encrypted” string here is arbitrary – it’ll just used as a label for the device mapper. You can call this anything. I’ve called mine “encrypted” for clarity. You’ll see this if you issue a “ls /dev/mapper” command. The new encrypted partiton is listed as “/dev/mapper/encrypted”.

Next, we’re going to make sure the partition is securely clean by using the dd command to zero out all the bits.

sudo dd if=/dev/zero of=/dev/mapper/encrypted bs=128M

The partition is now available but it still needs to be formatted with the normal file-system tools in order to be usable. You can format it in the usual manner.

sudo mkfs.ext4 /dev/mapper/encrypted

Now you can start using it! Here is the shell script to open the partition. I’m mounting my encrypted partition on $HOME/encrypted but you can change that part of the script to anything you like.

encrypted-open.sh

#!/bin/bash
sudo cryptsetup luksOpen /dev/sdb1 encrypted
# Comment out the above and uncomment the below if
# you want to use a file container instead of a partition
# See further down for file containers example.
# sudo cryptsetup luksOpen $HOME/encrypted-container encrypted
sudo mount /dev/mapper/encrypted $HOME/encrypted
df -h | grep encrypted
mount | grep encrypted
echo "ENCRYPTED PARTITION ACTIVE ON $HOME/encrypted"

and the shell script to close the partition again…

encrypted-close.sh

#!/bin/bash
sudo umount $HOME/encrypted
sudo cryptsetup luksClose encrypted
df -h
echo "ENCRYPTED PARTITON DEACTIVATED."

That’s it. Now here’s how to create a file container instead of a partition instead if you don’t have any easy way to create or use another partition. To store our encrypted data this way, we’ll need to create a file which will act as our storage device instead of the partition.

We want to create an empty file, but we can’t have that be a sparse “empty” file, because it doesn’t actually allocate the full file size when it is created which is no good for us. There are two ways to do this.

The easiest and the quickest way of going about this operation is with the “fallocate” command. This instantly allocates the amount of disk you would like for a file and assigns it the filename you give it. For this example we’ll create a 2GB file for our encrypted storage container.

fallocate -l 2G $HOME/encrypted-container

So this will create a 2GB file under your $HOME directory called “encrypted-container”. This disadvantage of this method is that it will not overwrite whatever old, deleted data that used to be used by those blocks with zeros or random data. This probably will not be desirable for your purposes because we don’t want people to be able to tell which portion of the file has encrypted data written to it.

A better but much slower way is to use the “dd” command in a similar manner as we used on the partition above. It will overwrite the blocks with zeroes at the file container location, giving us a zero’ed file of the proper size we want – in this case 2GB (count=2000).

sudo dd if=/dev/zero of=$HOME/encrypted-container bs=1M count=2000

Now we can use this file container and set up LUKS for it.

sudo cryptsetup -y luksFormat $HOME/encrypted-container

As with setting up a partition in the same way, you’ll be warned that it will wipe the data in the file and ask you to set the password/passphrase for the encrypted container.

Once this is done, you can check out the file and see that it’s now a LUKS encrypted file.

file $HOME/encrypted-container

encrypted-container: LUKS encrypted file, ver 1 [aes, cbc-essiv:sha256, sha1] UUID: 0451db36-3423-4ee1-8e2e-cc34c49e05f3

Now you can open the encrypted container using your password.

sudo cryptsetup luksOpen $HOME/encrypted-container encrypted

This is much the same as the process for opening a partition above. We’re using the same mapping name of “encrypted”.

As before the container still needs to be formatted as a regular EXT4 “partition” (even though it’s a file). Do so with: –

sudo mkfs.ext4 -j /dev/mapper/encrypted

Now you can use the same shell scripts as listed above as long as you change the parameters passed to the luksOpen command from the partition to the path to the file container. the rest is the same because really the only difference is how the /dev/mapper/encrypted device is created via luksOpen. Once you have that, be it from a file container or a partition, the rest of the process is identical.