Cryptography

Disk

Note: using /dev/sdX for this example

• prerequisites

apt-get install cryptsetup

• format a disk with a passphrase

cryptsetup --verbose --verify-passphrase luksFormat /dev/sdX

• open the device and format it (e.g. XFS filesystem)

cryptsetup --verbose open /dev/sdX crypt0
mkfs.xfs -L backup /dev/mapper/crypt0

• mount as any other device

mkdir -p sdX
mount /dev/mapper/crypt0 sdX

• close the device

umount sdX
cryptsetup --verbose close crypt0

• normal use

at any future use, open the device and mount it manually:

cryptsetup --verbose open /dev/sdX crypt0
mount /dev/mapper/crypt0 sdX
...
umount sdX
cryptsetup --verbose close crypt0

for an external device, you can also power off the device before unplug it:

udisksctl power-off --block-device /dev/sdX

References

https://opensource.com/article/21/3/encryption-luks