Did you ever want to feel like secret agent or do you really need to transport and exchange sensitive data? Encrypting your data is not much effort and can be used to protect a pen drive or any partition and the data on it from unauthorized access. In the following example you see how to create an encrypted partition on a disk. Note two things: If you accidentally encrypt the wrong partition, the data is lost. For ever. So be careful when entering the commands below. Secondly, the method shown below only protects the data at rest. As soon as you decrypt and mount the device, the data can be read from everyone else if you do not use correct permissions.
Prepare a mount point for your data and change ownership.
# Create a mount point sudo mkdir /media/cryptoUSB # Set permissions for the owner sudo chown stefan:stefan /media/cryptoUSB
Create an Encrypted Device
Encrypt the device with LUKS. Note that all data on the partition will be overwritten during this process.
# Create encrypted device sudo cryptsetup --verify-passphrase luksFormat /dev/sdX -c aes -s 256 -h sha256 # From the man page: --cipher, -c Set the cipher specification string. --key-size, -s Sets key size in bits. The argument has to be a multiple of 8. The possible key-sizes are limited by the cipher and mode used. --verify-passphrase, -y When interactively asking for a passphrase, ask for it twice and complain if both inputs do not match. --hash, -h Specifies the passphrase hash for open (for plain and loopaes device types). # Open the Device sudo cryptsetup luksOpen /dev/sdX cryptoUSB # Create a file system (ext3) sudo mkfs -t ext3 -m 1 -O dir_index,filetype,sparse_super /dev/mapper/cryptoUSB # Add a label sudo tune2fs -L Crypto-USB /dev/mapper/cryptoUSB # Close the devicesudo cryptsetup luksClose cryptoUSB
The usage is pretty simple. With a GUI you will be prompted for decrypting the device. At the command line, use the following commads to open and decrypt the device.
# Open the Device sudo cryptsetup luksOpen /dev/sdcX cryptoUSB # Mount it sudo mount /dev/mapper/cryptoUSB /media/cryptoUSB
When you are finished with your secret work, unmount and close the device properly.
sudo umount /media/cryptoUSB sudo cryptsetup luksClose cryptoUSB