[{"data":1,"prerenderedAt":241},["ShallowReactive",2],{"i-lucide:sun-moon":3,"i-lucide:menu":8,"post-\u002Fblog\u002F2023-09-10-encrypting-disk-image":10,"surround-\u002Fblog\u002F2023-09-10-encrypting-disk-image":224,"i-lucide:arrow-left":235,"i-lucide:sparkles":237,"i-lucide:user":239},{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":7},0,24,false,"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M12 2v2m2.837 12.385a6 6 0 1 1-7.223-7.222c.624-.147.97.66.715 1.248a4 4 0 0 0 5.26 5.259c.589-.255 1.396.09 1.248.715M16 12a4 4 0 0 0-4-4m7-3l-1.256 1.256M20 12h2\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":9},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M4 5h16M4 12h16M4 19h16\"\u002F>",{"id":11,"title":12,"authors":13,"body":16,"date":210,"description":22,"extension":211,"meta":212,"navigation":215,"path":216,"seo":217,"stem":218,"tags":219,"toc":215,"__hash__":223},"blog\u002Fblog\u002F2023-09-10-encrypting-disk-image.md","Setting up an encrypted disk image on Debian 12 with Cryptsetup",[14,15],"gpt","pfarmer",{"type":17,"value":18,"toc":200},"minimark",[19,23,28,31,59,63,70,76,83,87,97,103,106,110,113,119,122,126,129,135,142,146,149,155,162,166,169,175,178,184,187,190,193],[20,21,22],"p",{},"Encrypted disk images allow you to securely store sensitive files on your Linux system. The contents of the image can only be accessed by providing the correct passphrase. In this post, we'll walk through creating an encrypted image using the cryptsetup utility on Debian 12.",[24,25,27],"h2",{"id":26},"prerequisites","Prerequisites",[20,29,30],{},"To follow along on Debian 12, you'll need:",[32,33,34,53,56],"ul",{},[35,36,37,38,42,43],"li",{},"The ",[39,40,41],"code",{},"cryptsetup"," package installed:",[44,45,50],"pre",{"className":46,"code":48,"language":49},[47],"language-text","sudo apt install cryptsetup\n","text",[39,51,48],{"__ignoreMap":52},"",[35,54,55],{},"Enough free disk space to store the encrypted image file",[35,57,58],{},"The passphrase you want to use to encrypt the image",[24,60,62],{"id":61},"create-the-image-file","Create the Image File",[20,64,65,66,69],{},"First, we need to create a file that will be used for our encrypted volume. The ",[39,67,68],{},"dd"," command makes this easy. Let's create a 1GB image file:",[44,71,74],{"className":72,"code":73,"language":49},[47],"dd if=\u002Fdev\u002Fzero of=secret.img bs=1M count=1024\n",[39,75,73],{"__ignoreMap":52},[20,77,78,79,82],{},"This creates a file called ",[39,80,81],{},"secret.img"," filled with 1GB of null bytes to use as the container for our encrypted filesystem.",[24,84,86],{"id":85},"initialise-encryption","Initialise Encryption",[20,88,89,90,92,93,96],{},"With our image file created, we can now set up encryption on it using ",[39,91,41],{},". The ",[39,94,95],{},"luksFormat"," option initialises the encryption parameters:",[44,98,101],{"className":99,"code":100,"language":49},[47],"sudo cryptsetup -y luksFormat secret.img\n",[39,102,100],{"__ignoreMap":52},[20,104,105],{},"You'll be prompted to enter and confirm a passphrase. This passphrase will be required to unlock and access the contents of the image in the future. You can also specify the cipher and key size if desired.",[24,107,109],{"id":108},"open-the-encrypted-device","Open the Encrypted Device",[20,111,112],{},"Next, we need to \"open\" the encrypted image which maps it to a logical device mapper node. This allows accessing the encrypted volume similar to a normal block device:",[44,114,117],{"className":115,"code":116,"language":49},[47],"sudo cryptsetup luksOpen secret.img secret\n",[39,118,116],{"__ignoreMap":52},[20,120,121],{},"Enter the passphrase when prompted to unlock the device.",[24,123,125],{"id":124},"format-the-mapped-device","Format the Mapped Device",[20,127,128],{},"Now that the crypt device is unlocked and mapped, we can format it with a filesystem:",[44,130,133],{"className":131,"code":132,"language":49},[47],"sudo mkfs.ext4 \u002Fdev\u002Fmapper\u002Fsecret\n",[39,134,132],{"__ignoreMap":52},[20,136,137,138,141],{},"This formats the mapped device ",[39,139,140],{},"\u002Fdev\u002Fmapper\u002Fsecret"," with the ext4 filesystem.",[24,143,145],{"id":144},"mount-the-image","Mount the Image",[20,147,148],{},"With the device formatted, we can now mount it to access the encrypted contents! First create a mount point and then mount the device:",[44,150,153],{"className":151,"code":152,"language":49},[47],"sudo mkdir \u002Fmnt\u002Fsecret\nsudo mount \u002Fdev\u002Fmapper\u002Fsecret \u002Fmnt\u002Fsecret\n",[39,154,152],{"__ignoreMap":52},[20,156,157,158,161],{},"You can now read and write files under ",[39,159,160],{},"\u002Fmnt\u002Fsecret"," normally and they will be securely stored encrypted.",[24,163,165],{"id":164},"unmount-and-close-the-device","Unmount and Close the Device",[20,167,168],{},"To finish using the encrypted volume for now, first unmount it:",[44,170,173],{"className":171,"code":172,"language":49},[47],"sudo umount \u002Fmnt\u002Fsecret\n",[39,174,172],{"__ignoreMap":52},[20,176,177],{},"Then close the device mapping:",[44,179,182],{"className":180,"code":181,"language":49},[47],"sudo cryptsetup luksClose secret\n",[39,183,181],{"__ignoreMap":52},[20,185,186],{},"This will close the mapped device and shut down access to the encrypted volume. You'll have to unlock it again later to mount it.",[20,188,189],{},"At this point the image contents are safely encrypted at rest when not in use. To access the files again, repeat steps 3-5 to unlock, map, mount and use the image.",[20,191,192],{},"That covers the basics of setting up disk encryption using Linux's built-in Cryptsetup tool on Debian 12. With a few simple commands, you can create encrypted containers to keep your data secure and private. The encrypted data is inaccessible without the passphrase, providing effective defence against unauthorised access.",[20,194,195,196,199],{},"There are many other options available with Cryptsetup like keyfiles, multiple key encryption, and resizing images. Be sure to read ",[39,197,198],{},"man cryptsetup"," for more details on these advanced features.",{"title":52,"searchDepth":201,"depth":201,"links":202},2,[203,204,205,206,207,208,209],{"id":26,"depth":201,"text":27},{"id":61,"depth":201,"text":62},{"id":85,"depth":201,"text":86},{"id":108,"depth":201,"text":109},{"id":124,"depth":201,"text":125},{"id":144,"depth":201,"text":145},{"id":164,"depth":201,"text":165},"2023-09-10","md",{"type":213,"layout":214},"post","blog_page",true,"\u002Fblog\u002F2023-09-10-encrypting-disk-image",{"title":12,"description":22},"blog\u002F2023-09-10-encrypting-disk-image",[220,221,222],"debian","sysadmin","devops","ZYObvQgCancVwi0gziZRYB-OiYYDGjq7Q6ScIgriQUA",[225,230],{"title":226,"path":227,"stem":228,"date":229,"children":-1},"Optional Chaining in JavaScript","\u002Fblog\u002F2023-09-01-optional-chaining-in-javascript","blog\u002F2023-09-01-optional-chaining-in-javascript","2023-09-01",{"title":231,"path":232,"stem":233,"date":234,"children":-1},"Using git reset","\u002Fblog\u002F2023-10-03-using-git-reset","blog\u002F2023-10-03-using-git-reset","2023-10-03",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":236},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"m12 19l-7-7l7-7m7 7H5\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":238},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M11.017 2.814a1 1 0 0 1 1.966 0l1.051 5.558a2 2 0 0 0 1.594 1.594l5.558 1.051a1 1 0 0 1 0 1.966l-5.558 1.051a2 2 0 0 0-1.594 1.594l-1.051 5.558a1 1 0 0 1-1.966 0l-1.051-5.558a2 2 0 0 0-1.594-1.594l-5.558-1.051a1 1 0 0 1 0-1.966l5.558-1.051a2 2 0 0 0 1.594-1.594zM20 2v4m2-2h-4\"\u002F>\u003Ccircle cx=\"4\" cy=\"20\" r=\"2\"\u002F>\u003C\u002Fg>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":240},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M19 21v-2a4 4 0 0 0-4-4H9a4 4 0 0 0-4 4v2\"\u002F>\u003Ccircle cx=\"12\" cy=\"7\" r=\"4\"\u002F>\u003C\u002Fg>",1783616165469]