====== Dm-crypt ======
This tutorial is about how to set up a crypted partition on linux using dmcrypt. \\
Of course, you can use either fisical partitions or files using a loopback device.

===== Loopback or partition? =====
A loopback means that you have a file that is on a partition that you then mount using a special device called a loopback. The loop device then acts as a normal block device transforming your file into just another hard disk :)

This is useful if for example you wish to store all your ssh keys safely but don't want to have to make another partition for it! 

===== Configuring the kernel =====
You will need a kernel configuration similar to this in order of use dmcrypt:

You must first enable the device mapper (dm): 
<code>
Device Drivers --> 
 [*] Multiple devices driver support (RAID and LVM)
  <*> Device mapper support
  <*> Crypt target support
</code>

Then you must enable the cipher (aes):
<code>
 Cryptographic API --> 
  <*> AES cipher algorithims (i586)
</code>

If you're going to be using dmcrypt on a loopback file, not a partition:
<code>
 Device Drivers --> Block Devices -->
 <*> Loopback device support # Remember, cryptoloop is not dmcrypt
</code>

===== Installing needed tools =====
You need cryptsetup in order to create ciphered partition. The exact package name could change on different distros: \\
  * **Gentoo:** sys-fs/cryptsetup
  * **Debian:** cryptsetup

===== Creating ciphered file =====
==== ..on a partition ====

If you wish to use dmcrypt on a partition then read this, otherwise see below for information on using it with a loopback device.

First we create a device mapper device called 'mycrypt' on a partition, say /dev/hda7 (we will use that throughout the guide)
<code>
cryptsetup -y create mycrypt /dev/hda7
</code>

Has it worked?
<code>
dmsetup ls
</code>

It should display 'mycrypt'

Now create a filesystem (replace mke2fs with whatever your filesystem creation tool is):
<code>
mke2fs /dev/mapper/mycrypt
</code>

Now mount it:
<code>
mount /dev/mapper/mycrypt /mnt/point
</code>

Test it worked, congratulations!

To bring it down:
<code>
umount /mnt/point
cryptsetup remove mycrypt
</code>

==== ..on a file using loopback device ====
This is for using dmcrypt with a loopback device; see above for using it with a partition.

First, create our file:
<code>
touch protected
shred -n1 -s50M protected
</code>

This creates a file called 'protected' in your current directory of 50MB. By prefilling it with random data,
it's impossible to see afterwards how much has been used.

Now let's set a loopback device to use this file. First find the name of the first unused loop device :
<code>
losetup -f
</code>

Use this loop device to set a loopback (in this case /dev/loop0 is available)
<code>
losetup /dev/loop0 /path/to/protected
</code>

Now lets create an encrypted device mapper device using cryptsetup :
<code>
cryptsetup -y create mycrypt /dev/loop0
</code>

Check it worked:
<code>
dmsetup ls
</code>

You should see 'mycrypt' listed

Now create a filesystem (replace mke2fs with whatever your filesystem creation tool is) :
<code>
mke2fs /dev/mapper/mycrypt
</code>

Now mount it:
<code>
mount /dev/mapper/mycrypt /mount/point
</code>
Check it works for a while, and be happy, then continue reading :)

To unmount it:
<code>
umount /mount/point
cryptsetup remove mycrypt
losetup -d /dev/loop0
</code>

To automate this process you could write your own script (see below)
or try the tool [[http://www.freshmeat.net/projects/cryptmount|cryptmount]].

=== umount/mount Scripts ===

<code |Mount>
#!/bin/bash
losetup /dev/loop0 /Your/Container
sleep 1
cryptsetup create Container /dev/loop0 
sleep 1
mount /dev/mapper/Container /mnt/Container
</code>

replace Container with your file, save it under /usr/bin/something and chmod +x /usr/bin/something

<code |Umount>
#!/bin/bash
umount /dev/mapper/Container
cryptsetup remove Container
losetup -d /dev/loop0
</code>

Replace ''Container'' with your file, save it under /usr/bin/somethingother and chmod +x /usr/bin/somethingother

===== Related Pages =====
  * [[linux/sysadmin/luks|LUKS howto]]

===== See Also =====
  * [[http://gentoo-wiki.com/SECURITY_dmcrypt|Gentoo-wiki dmcrypt page]]
  * [[http://www.saout.de/tikiwiki/tiki-index.php|Wiki Site]]
  * [[http://www.saout.de/misc/dm-crypt/|Home Site]]