Mastodon

Schlagwort: GnuPG

simple mounting of encrypted partitions with encrypted keyfiles

Source: www.clipartlogo.com

My external HDDs are encrypted with LUKS. The keyfiles to decrypt these partitions are encrypted by GnuPG with a private key which is stored on a smartcard.

To easily mount my external HDDs I use this small bash script:

#!/bin/bash
gpg -d /media/usbstick/.secret/luks.key.enc | sudo pmount -p - $1 $2

Tutorial

Thats a quite simple tutorial. Most steps have been described in others howtos. Feel free to link them in the comments.

Setup

  1. Create a PGP keypair
  2. Generate a keyfile for the LUKS partition
  3. Make a copy  of your PGP keyring and the LUKS keyfile and safe them in a safe location
  4. Move your keys to your smartcard and replace your private keys by stubs
  5. Create your LUKS partition
  6. Add the keyfile to a LUKS key slot
  7. Encrypt the LUKS keyfile
  8. Move the encrypted keyfile to an USB stick
  9. Add the script from above to your USB stick

Usage

  1. Insert your smartcard, USB stick and the LUKS encrypted harddisk
  2. Call the script from above from your USB stick
  3. Enter your smartcard pin
  4. Enjoy!

Have fun!