Version 5.6
This bash script is designed to simplify the creation and management of LUKS containers / images via cryptsetup.
Working with LUKS encrypted images was always a cumbersome process with lots of typing so this scripts aims to make LUKS management easier in cli environments. Many github scripts already exist for handling LUKS encrypted partitions but there are hardly any for encrypted LUKS images, hence the reason for writing this script.
So why use LUKS, when other file encryption software is available? Because it's a known, reliable, flexible, secure encryption standard with strong defaults. No need to worry about selecting 'The Best™️' encryption settings. Just create and forget about it. Plus multiple keys (and keyfiles) can be used.
Of course, the single most important security factor is the strength of the password so USE A STRONG PASSWORD!
Only LUKS container files can be created (.bin). Partitions are NOT supported. This script can work with multiple LUKS file containers.
The only requirements are systems with hardware to support modern encryption and decryption, cryptsetup and associated packages. Arch, Manjaro and Debian-based distros (ubuntu, mint, popOS, debian etc) are supported.
Android / iOS are not supported even if you can run cryptsetup. These distros are severely locked-down so mounting containers in userspace (FUSE) is basically not possible without gaining root access to the device.
Make executable and run:
chmod +x /luks-container-management-script-v4.x.sh
sudo ./luks-container-management-script-v4.x.sh
-
Binary images use base-10 numbers. Final container size will be smaller when measured in GB. So creating a 1000 MB container will actually result in a final size of 0.97 GB (eg. 1 GB = 1024 MB). Take this into consideration when creating the target image size.
-
Resizing LUKS containers is inherently risky. Especially when truncating.
ALWAYS create a backup before proceeding with any changes!
When shrinking, a minimum size guide offers size suggestions based on the filesystem (resize2fs) with practical calculations. Please remember that these are only approximations. Data corruption is possible when containers are truncated below the filesystem and close to the underlying existing data. It is also important to note that filesystem fragmentation may require more space.
-
Keyfiles can be used in addition to (or as a replacement of) existing keys in the container. Since they act just like physical keys you need to be extra careful about storing them in a secure way. It is highly recommended to keep keyfiles completely offline (eg. a detached usb drive). Security can also be improved by create LUKS containers on a LiveCD/USB OS (RAM-only).
-
Be very careful with erasing LUKS container headers. The biggest advantage of removing the header from the container is that it is IMPOSSIBLE to crack, since there is no key to brute-force. This is ideal for users requiring anti-forensics protection. The disadvantage is without a header backup there is NO DATA RECOVERY, even if the password is known! Consider the implications carefully.
Use only if you know what you are doing and decide if it is worth the risk of keeping a headless LUKS container.
These default settings are completely fine for most users. As already mentioned, password strength is the most important security factor. Encryption parameters only matter when the password is weak!
- Cipher: aes-xts-plain64
- Key Size: 512 bits
- Header Hashing: sha256
- Passphrase Derivation: argon2id
- Random Number Generator: /dev/urandom
https://www.strongdm.com/blog/nist-password-guidelines
Please review this bash script carefully. NEVER run a script blindly without understanding what it could do. Don't trust me. Google around to find out more. Please research, research, research.
Please note that by downloading and running this script you acknowledge that I am not responsible or liable for any damages or losses arising from your use or inability to use the script and or software used under this script. You are solely responsible for your use of this script. If you harm someone or get into a dispute with a 3rd party, you consent to me waiving any involvement.