How to encrypt linux partitions with LUKS

There are plenty of reasons why people would need to encrypt a partition. Whether they're rooted it in privacy, security, or confidentiality, setting up a basic encrypted partition on a Linux system is fairly easy. This is especially true when using LUKS, since its functionality is built directly into the kernel.

Installing Cryptsetup

Debian/Ubuntu

On both Debian and Ubuntu, the cryptsetup utility is easily available in the repositories. The same should be true for Mint or any of their other derivatives.

$ sudo apt-get install cryptsetup
````

## CentOS/Fedora

Again, the required tools are easily available in both CentOS and
Fedora. These distributions break them down into multiple packages,
but they can still be easily installed using `yum` and `dnf`
respectively.

### CentOS

yum install crypto-utils cryptsetup-luks cryptsetup-luks-devel cryptsetup-luks-libs

### Fedora

dnf install crypto-utils cryptsetup cryptsetup-luks

## OpenSUSE

OpenSUSE is more like the Debian based distributions, including
everything that you need with `cryptsetup`.

zypper in cryptsetup

## Arch Linux

Arch stays true to its "keep it simple" philosophy here as well.

pacman -S cryptsetup

## Gentoo

The main concern that Gentoo users should have when installing the
tools necessary for using LUKS is whether or not their kernel has
support. This guide is not going to cover that part, but just be
aware that kernel support is a factor. If your kernel does support
LUKS, you can just emerge the package.

emerge --ask cryptsetup

# Setting Up The Partition

*WARNING:* **The following will erase all data on the partition being
used and will make it unrecoverable. Proceed with caution.**
From here on, none of this is distribution specific. It will all work
well with any distribution.The defaults provided are actually quite
good, but they can easily be customized. If you really aren't
comfortable playing with them, don't worry. If you do know what you
want to do, feel free.

The basic options are as follows:

* --cypher:  This determines the cryptographic cypher used on the
  partition.  The default option is aes-xts-plain64
* --key-size: The length of the key used.  The default is 256
* --hash: Chooses the hash algorithm used to derive the key.  The
  default is sha256.
* --time: The time used for passphrase processing.  The default is
  2000 milliseconds.
* --use-random/--use-urandom: Determines the random number generator
  used.  The default is --use-random.

So, a basic command with no options would look like the line below.

cryptsetup luksFormat /dev/sdb1

Obviously, you'd want to use the path to whichever partition that
you're encrypting. If you do want to use options, it would look like
the following.

cryptsetup -c aes-xts-plain64 --key-size 512 --hash sha512 --time 5000 --use-urandom /dev/sdb1

`Cryptsetup` will ask for a passphrase. Choose one that is both
secure and memorable. If you forget it, your data *will be lost.*
That will probably take a few seconds to complete, but when it's
done, it will have successfully converted your partition into an
encrypted LUKS volume. 

Next, you have to open the volume onto the device mapper. This is the
stage at which you will be prompted for your passphrase. You can
choose the name that you want your partition mapped under. It doesn't
really matter what it is, so just pick something that will be easy to
remember and use.

cryptsetup open /dev/sdb1 encrypted

Once the drive is mapped, you'll have to choose a filesystem type for
you partition. Creating that filesystem is the same as it would be on
a regular partition.

mkfs.ext4 /dev/mapper/encrypted

The one difference between creating the filesystem on a regular
partition and an encrypted one is that you will use the path to the
mapped name instead of the actual partition location. Wait for the
filesystem to be created. Then, the drive will be ready for use.

# Mounting and Unmounting

Manually mounting and unmounting encrypted partitions is almost the
same as doing so with normal partitions. There is one more step in
each direction, though. First, to manually mount an encrypted
partition, run the command below.

cryptsetup --type luks open /dev/sdb1 encrypted

mount -t ext4 /dev/mapper/encrypted /place/to/mount

Unmounting the partition is the same as a normal one, but you have to
close the mapped device too.

umount /place/to/mount

cryptsetup close encrypted

```

Closing

There's plenty more, but when talking about security and encryption, things run rather deep. This guide provides the basis for encrypting and using encrypted partitions, which is an important first step that shouldn't be discounted. There will definitely be more coming in this area, so be sure to check back, if you're interested in going a bit deeper.


Source linuxconfig