Dmcrypt

DMCrypt and LUKS are Linux utilities used to encrypt storage space. These utilities can be applied to any type of device that is natively understood by a kernel. Devices include anything in the /dev/ directory, however, a user can also create his own flat file and create a loopback device. This works on any Linux distribution.

Getting Started

First, the first utility needed is cryptsetup which can be installed via a package manager.

Encryption Ciphers and Algorithms

A list of the supported encryption ciphers and hashing algorithms is located in /proc/crypto . To list, run the command:

    grep "name\|digest\|cipher" /proc/crypto

Nearly every Linux distribution supports this, however, some LFS and other MINIX variants will not support crypto or crypttab in procfs.

Hashing Algorithms

Digest algorithms are hashing algorithms. The whirlpool algorithm is preferred, however, sha, md5, sha512 (mac), and ripemd160/320 are viable options. Whirlpool is suggested due to the collision resistance, age, and resistance to cryptanalysis attacks. There are no known cryptanalysis attacks that are able to generate reliable collisions on the whirlpool 512 digest.

Ciphers

AES is almost always available. The blowfish is recommended, however AES, serpent, and twofish are viable options. If /proc/crypto does not produce a favorable list of hashing algorithms and ciphers, refer to the distribution's documentation on installing cryptographic kernel modules. A simple search for "<distro name> kernel crypto module installation" will produce a better selection of algorithms and ciphers. If the distriution is a source-based distribution, simply rebuilding and specifying the options inside of menuconfig will provide the desired results.

Setting Up a Block Device

Notice: A new partition or file is necessary to create a block device.

Creating a Partition

To create a partition, use a partition editor cfdisk and fdisk are two good options.

After the partitions are created, format and encrypt the partition with the command:

    cryptsetup luksFormat -c <cipher name> -h <digest name> /path/to/partition (/dev/sdx)

    Ex. To encrypt /dev/sdb2 with whirlpool and blowfish:
    cryptsetup luksFormat -c blowfish -h whirlpool /dev/sdb2

Next, LUKS will prompt for a passphrase. Enter a password or, alternatively, provide a keyfile with --key-file.

• When creating a keyfile, be sure that it meets the length criteria for the selected digest algorithm.

After entering a password, skip to the LVM and Device Mapper Section.

Creating a Flat File

If no unpartitioned space is available or a new partition for encryption is undesired, a flat file can be created. First, create a blank file using touch:

    touch /path/to/flatfile
    Ex. touch ~/cryptoImg.img

Next, use either shred or dd to create the flat file in the appropriate size.

    SHRED:
    If you want a 10GB Partition:
    shred -s 10G /path/to/flatfile

    DD
    dd if=/dev/urandom bs=1024 of=/path/to/flatfile count=`echo .|awk '{print (10*1024^2)}'`

A flat file is now created and is overwritten with random data. Next, set it up as a loopback device. First, determine what loopback devices are already available:

    AS ROOT
    losetup -a

This will list all of the loopback devices. If there is nothing in the list, start with loop0:

    losetup /path/to/flatfile /dev/loop0
    Certain distributions may require:
    losetup /path/to/flatfile /dev/loop/

If an error about loop modules occurs, use modprobe to start the module or (for source-based distributions): find /usr/src/linux -name \*loop\*.ko -exec insmod '{}' \;

Once completed, refer to the LUKS commands and run:

    cryptsetup luksFormat -c <cipher name> -h <digest name> /dev/loop#

Notice: The luksFormat command was run on /dev/loop# and NOT /dev/sdx

LVM and the Device Mapper

Creating Encrypted LVM Partitions

First, open up the encrypted device with:

    cryptsetup luksOpen /dev/sdx lvm

Then, create logical partitions:

    lvm pvcreate /dev/mapper/lvm
    lvm vgcreate <volume group name> /dev/mapper/lvm

    lvm lvcreate -L 20GB -n root <volume group name from above>
    lvm lvcreate -L 4GB -n swap <volume group name from above>
    lvm lvcreate -l 100%FREE -n home <volume group name from above>

    *Obviously, the partition sizes can be altered

Encrypting the Flat File

After running the luksOpen command to unlock the partition,

    cryptsetup luksOpen -c blowfish -h whirlpool /dev/sdx /dev/mapper/cryptDir
    *The last parameter becomes the directory in /dev/mapper that you will need to format

Finally, create a filesystem on the encrypted partition with mkfs. For example, (using reiserfs):

    mkfs.reiserfs /dev/mapper/cryptDir

Now, that the keyslot is unlocked and the filesystem created, create and mount the encrypted directory:

    mkdir /home/<username>/encrypted
    mount -o loop /dev/mapper/cryptDir /home/<username>/encrypted

Starting and Stopping the Service

Now, anything that is put into the /home/<username>/encrypted directory is encrypted. To shut down the encryption service:

    umount /home/<username>/encrypted
    cryptsetup luksClose /dev/mapper/cryptDir
    *If you created a loopback device:
    losetup -d /dev/loop#

Now, all of the data is secured in an encrypted partition. To re-open the partition:

    cryptsetup luksOpen /dev/sdx /dev/mapper/cryptDir
    mount -o loop -t reiserfs /dev/mapper/cryptDir /home/<username>/encrypted

External Links

• Plaintext Passwords in Linux memory

Dmcrypt is part of a series on administration.

<center>

Dmcrypt is part of a series on countermeasures.
<center>

Tweet

</center>