Comments (5)
Backup of LUKS header is easy, something like that (not much tested:-):
DEVICE=/dev/sdg
BACKUP_FILE=tst
SECTORS=$(cryptsetup luksDump $DEVICE | grep 'Payload offset' | sed 's/^.*\W//')
dd if=$DEVICE of=$BACKUP_FILE bs=512 count=$SECTORS
luksRestore is simple dd file back.
Maybe is internal luksBackup/Restore (to provided filespec) enough?
Original comment by [email protected]
on 20 Jul 2009 at 7:16
- Added labels: Type-Enhancement, Priority-Low
- Removed labels: Type-Defect, Priority-Medium
from cryptsetup.
Hey,
I know that it's that simple to backup the luks header, but I guess that people
would
be more satisfied with implemented luksBackup/luksRestore actions in cryptsetup.
Maybe the luksBackup action could prompt for confirmation after printing a big
fat
warning that dumping the luks header to a filesystem is unsecure and that
people need
to be really careful with the header backup.
(i.e. best to write it directly to a usb device, and if it's burned to
cd/dvd/...
then at least /tmp should be encrypted)
In another bugreport in debian (bugs.debian.org/432150) we got a request for
something like a luksRepair function, which fixes broken luks headers (for sure
that's only possible if both the master key and at least one slot are still
available).
greetings,
jonas
PS: thanks for taking care of cryptsetup, i've the impression that you do a
really
good job :-)
Original comment by [email protected]
on 21 Jul 2009 at 10:25
from cryptsetup.
I added luksHeaderBackup and luksHeaderRestore commands.
(if just stores header + keyslot are, so it is compatible with dd above)
Backup also wipes unused area between header and keyslot area, so
backup->restore can
be used for basic repair for LUKS header including e.g. old swap signature.
(Alsready fixed problem, but old header need not-too-user-friendly hack with dd
to
fix this.)
I added some warning to man page about possible security problems... If you have
better formulation, please send a patch:-)
LUKS1 will never support multiple headers on disk - it will need new header
structure
(-> LUKS2 maybe) and proper handling of redundant metadata. (We solved similar
problems in lvm2 and maintaining multiple metadata areas on disk _properly_ is
not
so easy as it seems...)
Original comment by [email protected]
on 28 Sep 2009 at 7:04
- Changed state: Fixed
from cryptsetup.
Mmmm, will be possible to convert LUKS1 to the future LUKS2? I mean without
having to
move all the date, redone the dm-crpyt and dump the data back again?
Original comment by [email protected]
on 6 Oct 2009 at 3:21
from cryptsetup.
> will be possible to convert LUKS1 to the future LUKS2?
I have no answer to that question, LUKS2 do not exist yet:-) But if there is no
technical reason, there should be some automatic conversion, (but
Backup/Restore is
intended for using the same format)
Convert can use backup->retrieve master key->format with LUKS 2 using the same
parameters + the same master key, this way no shuffle of data is needed.
Anyway, you cannot convert automatically all keyslots without entering all
passphrases.
Original comment by [email protected]
on 6 Oct 2009 at 3:45
from cryptsetup.
Related Issues (20)
- enhancement: give crypttab option "user" so users can mount preconfigured encrypted devices as fstab has HOT 1
- luksSuspend should work without specifying detached header HOT 1
- The whrilpool cryptsetup FAQ entry should be updated to reflect that the issue happens too with libgcrypt 1.5.4 HOT 10
- dm-crypt 1.6.6 is unable to open partition with password stored in file HOT 8
- Ubuntu 12.04, 1.6.6 can NOT open truecrypt disc/partition/container. HOT 5
- luksDump prints unsigned fields as signed HOT 4
- Keep multiple copies of the headers/keyslots throughout the volume HOT 1
- Please add support for TrueCrypt using libtcplay HOT 4
- Support decryption in cryptsetup_reencrypt HOT 2
- Segfault due to use of non-portable strerror_r HOT 4
- cryptsetup-1.6.6 does not open LUKS ecb-mode partitions HOT 6
- veritysetup bug that depends on the size of the image HOT 2
- could not find fipscheck library HOT 3
- Please add TOTP support HOT 1
- Fails to open loop-AES if password is given at the prompt HOT 5
- keyfile-offset ignored (again?) HOT 3
- Typo in man HOT 1
- veracrypt support HOT 12
- Display password on screen HOT 4
- Fails to decrypt LUKS file on a samba server due to use of O_DIRECT flag HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from cryptsetup.