How to mount a LUKS encrypted partition on boot

In order to automatically mount a LUKS encrypted partition on boot you have to find out its universally unique identifier (UUID) first. Open a root shell and enter
$ blkid
The program lists all mounted volumes and their UUIDs. If your LUKS partition is not listed, mount it and enter
$ blkid
again to find out the UUID. The output should look something like this:

/dev/mapper/enc-ext-hdd: UUID="faa852f5-7c53-4656-ac06-00144f0e5e76" TYPE="crypto_LUKS"
/dev/mapper/luks-faa852f5-7c53-4656-ac06-00144f0e5e76: UUID="111413ad-f7f9-4c36-85a9-ef47b10a7b3d" TYPE="ext4"

What you need is the UUID of the crypto_LUKS partition you want to mount automatically, e.g. faa852f5-7c53-4656-ac06-00144f0e5e76. The mapper name of the decrypted partition, e.g. luks-faa852f5-7c53-4656-ac06-00144f0e5e76, is generated automatically.
To mount the LUKS partition on boot, edit the file /etc/crypttab and add the mapper name and UUID of the encrypted partition. By default, the mapper name is luks-<UUID>, but you can give it any name you like. The partition will appear as a device in /dev/mapper/<mapper name>.
Entries in /etc/crypttab are of the form

<mapper name> UUID=<UUID>

so the line to add should look like this:

dec-ext-hdd UUID=faa852f5-7c53-4656-ac06-00144f0e5e76

For more information on /etc/crypttab, see $ man crypttab.

When this is done, create the folder where you want the encrypted partition to be mounted, i.e. /media/ext-hdd and set access rights to your needs. Finally, edit the file /etc/fstab and add mapper name, mount point, file system type and mount options.
The line to add should look like this:

/dev/mapper/dec-ext-hdd /media/ext-hdd ext4 defaults 1 2

The next time you boot your system you will be prompted for the passphrase and the partition will be mounted to the given mount point. The output of $ blkid should now contain

/dev/mapper/enc-ext-hdd: UUID="faa852f5-7c53-4656-ac06-00144f0e5e76" TYPE="crypto_LUKS"
/dev/mapper/dec-ext-hdd: UUID="111413ad-f7f9-4c36-85a9-ef47b10a7b3d" TYPE="ext4"

About h0nk3ym0nk3y

Yeah, whatever, never mind

Posted on October 22, 2012, in Command-Line, Configure, Cryptography, Security and tagged , , , . Bookmark the permalink. 7 Comments.

  1. How to mount encrypted partition? There is no filesystem detected for it. It cannot be mounted because it is encrypted.

    sudo mount /dev/sdc3 tmpmountdir/
    mount: you must specify the filesystem type

  2. Ok. As i see blkid works for partitions created as LUKS by “cryptsetup luksFormat”, but not created by “cryptsetup create “.

    • “cryptsetup create” does not create an encrypted partition. It creates a mapping. Have a look at the man page of cryptsetup to get more details. Try to verify whether your device (/dev/sdc3) is really an encrypted LUKS-partition or not. You can use “cryptsetup isLuks /dev/sdc3”. It’ll return true (in my case nothing), if the device is a valid LUKS partition. If the device is not a valid LUKS-device, it’ll print the folloing message “Device /dev/sdc3 is not a valid LUKS device.”

  3. I followed your steps but after the reboot the partition is not mounted.
    I asked the same question with more details in SO
    Any idea?


  1. Pingback: crypttab not working

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

%d bloggers like this: