{"id":638,"date":"2019-04-13T05:15:00","date_gmt":"2019-04-13T12:15:00","guid":{"rendered":"https:\/\/kb.terabyteunlimited.com\/kb-articles\/using-luks-encryption-with-image-for-linux\/"},"modified":"2021-09-07T15:04:38","modified_gmt":"2021-09-07T22:04:38","slug":"using-luks-encryption-with-image-for-linux","status":"publish","type":"lsvr_kba","link":"https:\/\/www.terabyteunlimited.com\/kb\/kb-articles\/using-luks-encryption-with-image-for-linux\/","title":{"rendered":"Using LUKS Encryption with Image for Linux"},"content":{"rendered":"

Introduction<\/strong><\/font><\/p>\r\n

Image for Linux contains the cryptsetup utility, which is the standard Linux command line utility to access (mount) LUKS containers. Methods of backing up LUKS encrypted partitions for several common scenarios are covered in this article. For all methods, the file system on the LUKS partition should not be mounted when the backup is created. General knowledge of using LUKS and LVM (if applicable) is assumed.<\/p>\r\n

 <\/p>\r\n

Method A: Normal LUKS encrypted partitions<\/strong><\/font> <\/p>\r\n

For the purpose of this article, a normal LUKS encrypted partition is one that is accessible by Image for Linux in both its encrypted and decrypted states and, as such, can be backed up in either state.<\/p>\r\n

To back up in the encrypted state, perform a normal backup of the encrypted partition (or volume). This type of backup will be the same size as the partition (encrypted data will not compress) and will not be accessible using TBIView.<\/p>\r\n

To back up in the decrypted stated, the partition must be opened first using the cryptsetup<\/strong> utility. For example, if the the LUKS partition is on \/dev\/sdb1<\/strong> and you want the decrypted device name to be Ext4LUKS<\/strong> you would run the following command from a Terminal or Command Prompt:<\/p>\r\n

cryptsetup luksOpen \/dev\/sdb1 Ext4LUKS<\/strong><\/font><\/p>\r\n

Enter the password when prompted. The device will now be available as \/dev\/mapper\/Ext4LUKS<\/strong><\/font> in Image for Linux to back up decrypted.<\/p>\r\n

 <\/p>\r\n

Method B: LVM volumes on a LUKS encrypted partition<\/strong><\/font> <\/p>\r\n

If the LVM volumes to back up are located on a LUKS encrypted partition you can run the luks-lvm<\/strong> script from a Terminal or Command Prompt. This menu driven utility will create symlinks in \/dev\/mapper that should make the LUKS LVM volumes visible in Image for Linux. Each LUKS LVM volume name appearing in Image for Linux will begin with a prefix of "lvm_pv_" followed by the actual volume name. These volumes can then be backed up normally.<\/p>\r\n

 <\/p>\r\n

Method C: LUKS encrypted LVM volume<\/strong><\/font> <\/p>\r\n

Backing up in the encrypted state<\/strong><\/p>\r\n

To back up a LUKS encrypted LVM volume in its encrypted state the following steps are required:<\/p>\r\n

    \r\n
  1. From a Terminal or Command Prompt, start LVM by running the following script:
    \r\n start-lvm<\/strong><\/font>
    \r\n
    \r\n <\/li>\r\n
  2. Run Image for Linux and select the desired LVM volume. It will only be available as an entire drive type of backup (the partition can't be seen due to the encryption).
    \r\n
    \r\n <\/li>\r\n
  3. In Backup Options, select the Backup Unused Sectors<\/strong> option. If this option is not selected Image for Linux will not find anything to back up.<\/li>\r\n <\/ol>\r\n

    Backing up in the decrypted state<\/strong><\/p>\r\n

    To back up a LUKS encrypted LVM volume in its decrypted state, several steps are required to make it accessible. First, LVM needs to be started. Second, the LUKS partition needs to be opened with a name that includes "lvm_pv_" (the partition will not be visible to Image for Linux without this). An example is shown below:<\/p>\r\n

      \r\n
    1. From a Terminal or Command Prompt, start LVM by running the following script:
      \r\n start-lvm<\/strong><\/font>\r\n
      \r\n
      \r\n <\/li>\r\n
    2. Run lvdisplay<\/strong>, "fdisk -l<\/strong>" or your preferred command to determine the LVM name of the desired partition. In this example \/dev\/ubuntu-mate-vg-vol_LUKS<\/strong><\/font> will be used.
      \r\n
      \r\n <\/li>\r\n
    3. Open the volume, making sure sure to use a name that includes "lvm_pv_" (e.g. use it as a prefix).
      \r\n cryptsetup luksOpen \/dev\/ubuntu-mate-vg-vol_LUKS lvm_pv_Ext4LUKS<\/strong><\/font>
      \r\n
      \r\n <\/li>\r\n
    4. Enter the password when prompted. The device will now be available as \/dev\/mapper\/lvm_pv_Ext4LUKS<\/strong><\/font> in Image for Windows to back up decrypted.
      \r\n <\/li>\r\n <\/ol>\r\n

       <\/p>\r\n

      Restoring a LUKS encrypted partition<\/strong><\/font> <\/p>\r\n

      LUKS partitions can be restored back to their original locations or to alternate locations. When restoring to the original location it will need to be available as it was when the backup image was created. For example, if you used Method C to back up a decrypted LUKS LVM volume you would need to follow the same steps to make the destination available for the restore.<\/p>\r\n

       <\/p>

      \r\n

      For more information on using LVM with Image for Linux, refer to the lvm.txt help file included in the Image for Linux download.<\/p>","protected":false},"excerpt":{"rendered":"

      Introduction Image for Linux contains the cryptsetup utility, which is the standard Linux command line utility to access (mount) LUKS containers. Methods of backing up LUKS encrypted partitions for several common scenarios are covered in this article. For all methods, the file system on the LUKS partition should not be mounted when the backup is […]<\/p>\n","protected":false},"author":5,"featured_media":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"lsvr_kba_cat":[1815],"lsvr_kba_tag":[2123],"class_list":["post-638","lsvr_kba","type-lsvr_kba","status-publish","hentry","lsvr_kba_cat-general-information-image-for-linux","lsvr_kba_tag-image-for-linux"],"_links":{"self":[{"href":"https:\/\/www.terabyteunlimited.com\/kb\/wp-json\/wp\/v2\/lsvr_kba\/638","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.terabyteunlimited.com\/kb\/wp-json\/wp\/v2\/lsvr_kba"}],"about":[{"href":"https:\/\/www.terabyteunlimited.com\/kb\/wp-json\/wp\/v2\/types\/lsvr_kba"}],"author":[{"embeddable":true,"href":"https:\/\/www.terabyteunlimited.com\/kb\/wp-json\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"https:\/\/www.terabyteunlimited.com\/kb\/wp-json\/wp\/v2\/comments?post=638"}],"version-history":[{"count":1,"href":"https:\/\/www.terabyteunlimited.com\/kb\/wp-json\/wp\/v2\/lsvr_kba\/638\/revisions"}],"predecessor-version":[{"id":6321,"href":"https:\/\/www.terabyteunlimited.com\/kb\/wp-json\/wp\/v2\/lsvr_kba\/638\/revisions\/6321"}],"wp:attachment":[{"href":"https:\/\/www.terabyteunlimited.com\/kb\/wp-json\/wp\/v2\/media?parent=638"}],"wp:term":[{"taxonomy":"lsvr_kba_cat","embeddable":true,"href":"https:\/\/www.terabyteunlimited.com\/kb\/wp-json\/wp\/v2\/lsvr_kba_cat?post=638"},{"taxonomy":"lsvr_kba_tag","embeddable":true,"href":"https:\/\/www.terabyteunlimited.com\/kb\/wp-json\/wp\/v2\/lsvr_kba_tag?post=638"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}