Create an encrypted file vault on Linux

Recently, I demonstrated methods to implement full-drive encryption on Linux with LUKS and the cryptsetup command. While encrypting a complete drive is helpful in lots of instances, there are causes you won’t need to encode a complete drive. For occasion, you would possibly require a drive to work throughout a number of platforms, a few of which can not have Linux Unified Key Setup (LUKS) integration. Furthermore, it is the 21st century, the cloud exists, and also you might not be utilizing a bodily drive for all of your knowledge.

Several years in the past, there was a system referred to as TrueCrypt that allowed customers to create encrypted file “vaults,” which could possibly be decrypted by TrueCrypt to offer learn/write entry. It was a helpful approach and primarily supplied a digital moveable and absolutely encrypted drive the place you possibly can retailer necessary knowledge. TrueCrypt closed down, however it serves as an fascinating mannequin.

Fortunately, LUKS is a versatile system, and you should use it and cryptsetup to create an encrypted vault as a self-contained file, which it can save you on a bodily drive or in cloud storage.

Here’s methods to do it.

1. Create an empty file

First, you could create an empty file of a predetermined measurement. This serves as a form of vault or protected in which you’ll be able to retailer different recordsdata. The command you employ for that is fallocate, from the util-linux bundle:

$ fallocate --length 512M vaultfile.img

This instance creates a 512MB file, however you can also make yours any measurement you need.

2. Create a LUKS quantity

Next, create a LUKS quantity throughout the empty file:

$ cryptsetup --verify-passphrase 
luksFormat vaultfile.img

three. Open the LUKS quantity

So which you could create a filesystem prepared for file storage, you could open the LUKS quantity and mount it in your pc first:

$ sudo cryptsetup open 
--type luks vaultfile.img myvault
$ ls /dev/mapper
myvault

four. Create a filesystem

Make a filesystem in your open vault:

$ sudo mkfs.ext4 -L myvault /dev/mapper/myvault

If you do not want it for something proper now, you may shut it:

$ sudo cryptsetup shut myvault

5. Start utilizing your encrypted vault

Now that it is all arrange, you should use your encrypted file vault every time it’s worthwhile to retailer or entry personal knowledge. To entry your vault, you could mount it as a usable filesystem:

$ sudo cryptsetup open 
--type luks vaultfile.img myvault
$ ls /dev/mapper
myvault
$ sudo mkdir /myvault
$ sudo mount /dev/mapper/myvault /myvault

This instance opens the vault with cryptsetup after which mounts the vault from /dev/mapper to a brand new listing referred to as /myvault. As with any quantity on Linux, you may mount the LUKS quantity wherever you need, so as an alternative of /myvault, you should use /mnt or ~/myvault or no matter you like.

While it is mounted, your LUKS quantity is decrypted. You can learn and write recordsdata to it simply as if it had been a bodily drive.

When you are completed utilizing your encrypted vault, unmount and shut it:

$ sudo umount /myvault
$ sudo cryptsetup shut myvault

Encrypted file vaults

An picture file you encrypt with LUKS is as moveable as some other file, so you may retailer your vault in your laborious drive, an exterior drive, and even on the web. As lengthy as you’ve LUKS accessible, you may decrypt, mount, and use it to maintain your knowledge protected. It’s simple encryption for improved knowledge security, so give it a strive.