Arch Linux: Encrypted Removable Storage

UNDER CONSTRUCTION: The document is currently being modified!

 Back to Category:Arch Linux

Use an SD Card or USB flash drive in order to bolster your disk space is never a bad idea. It can be a great place to storage things that you need between machines (files too big for constant transfer over the network) or for just general storage. This will take you through adding one with LUKS and ext4 in order to hopefully keep your data safe and free from corruption.
First re-partition the drive, for all of the examples in this tutorial I will be using an SD Card. If I refer to something as SD Card just think of this as the drive you are using. You will also need to locate the proper device node for the drive you are using, mine just so happens to be /dev/mmcblk0. You can find the device node with lsblk.

Partitioning

Begin by partitioning the disk, for simplicity I will do a single partition scheme.

Wipe the current partition table and create a new GPT partition table with protected MBR.

# sudo sgdisk -Z -o /dev/mmcblk0

Create the necessary partition and give it a label.

# sudo sgdisk -n 1:0:-0 -t 1:8300 /dev/mmcblk0 # sudo sgdisk -c 1:"SD Card" /dev/mmcblk0

LUKS

Setup LUKS on the SD Card; confirm to erase by typing YES (take note of the caps) and then set a password.

# sudo cryptsetup luksFormat /dev/mmcblk0p1

WARNING: DO NOT forget the password to the partition or all of the data inside will be irretrievable!

Decrypt the LUKS partition, giving it a name. For the tutorial I will use sdcard.

# sudo cryptsetup luksOpen /dev/mmcblk0p1 sdcard

Format the decrypted LUKS container.

# sudo mkfs.ext4 /dev/mapper/sdcard

Tune the filesystem to remove the journal and put it into writeback mode.

# sudo tune2fs -o journal_data_writeback /dev/mapper/sdcard # sudo tune2fs -O ^has_journal /dev/mapper/sdcard # sudo e2fsck -f /dev/mapper/sdcard

Then make a folder for your drive and set your current user to the owner.

# sudo mkdir /mnt/sdcard && sudo chown kyau:users /mnt/sdcard

Keyfile

If you are already using LUKS for full system encryption you can store a keyfile on your encrypted system to auto-unlock your removable media.

Create a keyfile for the SD Card in the root folder and set the proper permissions.

# sudo dd if=/dev/urandom of=/root/keyfile bs=1024 count=4 # sudo chmod 0400 /root/keyfile

Then add the keyfile to the LUKS partition.

# sudo cryptsetup luksAddKey /dev/mmcblk0p1 /root/keyfile

Decrypt/Mount on Boot

With the partition setup, get the UUID of the partition and add a line to /etc/crypttab so that it gets decrypted on boot.

# lsblk -f # echo -e "sdcard\tUUID=XXXXUUID-LUKS-SDXX-CARD-XXXXXXXXXXXX\t/root/keyfile" | sudo tee --append /etc/crypttab

Finally add a line to /etc/fstab so that it also gets automatically mounted on boot.

# echo -e "/dev/mapper/sdcard\t/mnt/sdcard\text4\tnoatime,nodiratime,data=writeback,uid=kyau,gid=users\t0\t0" | sudo tee --append /etc/fstab