-------------------------------------------
  * **encryption** 
  * **Jonathan Haack**
  * **Haack's Networking**
  * **netcmnd@jonathanhaack.com** 

-------------------------------------------

To use pam_mount to mount a LUKS crypt and map it to your home partition. Note: make sure the crypt password matches your user login password.

  sudo apt-get install cryptsetup libpam-mount rsync
  rsync -av /home /backup
  umount /home/
  cryptsetup luksFormat /dev/sdaX
  cryptsetup luksOpen /dev/sdaX home
  mkfs.xfs -L home /dev/mapper/home
  mount /dev/mapper/home /home/
  rsync -av /backup/home/ /home
  sudo nano /etc/security/pam_mount.conf.xml
  <volume user="username" fstype="crypt" path="/dev/disk/by-uuid/21sdsd" mountpoint="/home" options="noatime,exec,fsck,nodev,nosuid"/>
  
To use pam_mount to mount a LUKS crypt to a non-home directory partition, then adjust as follows:

  cryptsetup luksFormat /dev/sdaX
  cryptsetup luksOpen /dev/sdaX vault
  mkfs.xfs -L vault /dev/mapper/vault
  mkdir /mnt/vault
  mount /dev/mapper/vault /mnt/vault
  sudo nano /etc/security/pam_mount.conf.xml
  <volume user="username" fstype="crypt" path="/dev/disk/by-uuid/21sdsd" mountpoint="/mnt/vault" options="noatime,exec,fsck,nodev,nosuid"/>
  
You may optionally mount the LUKS crypt manually as well. To do so, create a mount point, and then map the LUKS partion to your mount point.
  
  mkdir /mnt/vault
  mount /dev/mapper/vault /mnt/vault

After you reboot, the crypt will no longer be open, but your mount point will still be there, so you just need to open the LUKS crypt and then map the LUKS partition to your mount point again as follows:

  cryptsetup luksOpen /dev/sdaX vault
  mount /dev/mapper/vault /mnt/vault 

Users might also to prefer to use crypttab and fstab to handle the mounting and mapping. To do so, let's create a keyfile in a secure location that you can use to unlock the crypt.

  sudo dd if=/dev/urandom of=/path/to/secure/location/vaultkey bs=512 count=8

Add the keyfile to the LUKS crypt so that it can be used to open the crypt:

  sudo cryptsetup -v luksAddKey /dev/sdaX /path/to/secure/location/vaultkey
  
After adding the key to the crypt, let's now grab the UUID of the crypt.

  sudo cryptsetup luksDump /dev/sdaX | grep "UUID"
  
Now that we have the UUID of the crypt, we can add a reliable crypttab entry for the crypt.
  
  sudo nano /etc/crypttab
  <sdaX_crypt UUID=7b8975bg-5902-733c-a7b8-fbeb18945c85 /etc/lukskeys/vaultkey luks>
  
Now that crypttab is setup, this means you you can open the crypt as follows.

  sudo cryptdisks_start sdaX_crypt
  
If you want, however, the crypt to mount on its own, then add an entry to fstab as well.

  sudo nano /etc/fstab
  </dev/mapper/sdaX_crypt /media/vault     xfs    defaults      0     2>
  
Okay, your LUKS crypt should now be open and mapped to your mount point at boot. Since Debian 12, there's an error that states "HXproc_run_async: pmvarrun: No such file or directory." This is caused by regular users' shell not having /usr/sbin in their path. To fix this, add the following to your config:

  sudo nano /etc/security/pam_mount.conf.xml
  <pmvarrun>/usr/sbin/pmvarrun -u %(USER)</pmvarrun>

 --- //[[jonathan@haacksnetworking.org|oemb1905]] 2024/01/29 18:01//