Why do I feel like I've done this before and it's gone wrong? Anway. This was shamelessly copied from
somewhere else on the 'net, in which place a comment was present saying trucrypt was a more secure approach.
Do some searching. For now, this is a private note.
$ sudo apt-get install cryptsetup
$ sudo fdisk /dev/sdf
d 2 # delete partition 2
d 1 # delete partition 1
w # write changes.
sudo fdisk /dev/sdf
n new
1 partition number
default first sector = 2048 (not 34 as is available)
default last sector = 15628053133
Created a new partition 1 of type 'Linux filesystem' and of size 7.3TiB
that should have been 8tB. Grrr.
w write.
/dev/sdf now present.
/dev/sdf1 now present.
sudo modprobe dm-crypt
I don't think this was needed.
nice indication of disks attached:
lsblk
$ sudo cryptsetup -v -y -c aes-xts-plain64 -s 512 -h sha512 -i 5000 --use-random luksFormat /dev/sdf1
-v = verbose
-y = verify passphrase, ask twice, and complain if they don’t match
-c = specify the cipher used
-s = specify the key size used
-h = specify the hash used
-i = number of milliseconds to spend passphrase processing (if using anything more than sha1, must be great than 1000)
–use-random = which random number generator to use
luksFormat = to initialize the partition and set a passphrase
/dev/sdf1 = the partition to encrypt
check the configuration of the luks header:
sudo cryptsetup luksDump /dev/sdf1
LUKS header information for /dev/sdf1
Version: 1
Cipher name: aes
Cipher mode: xts-plain64
Hash spec: sha512
Payload offset: 65535
MK bits: 512Key Slot 0: ENABLED
Iterations: 1367519
Salt: xx xx xx xx xx xx
xx xx xx xx xx xx
Key material offset: 8
AF stripes: 4000
Key Slot 1: DISABLED
Key Slot 2: DISABLED
Key Slot 3: DISABLED
Key Slot 4: DISABLED
Key Slot 5: DISABLED
Key Slot 6: DISABLED
Key Slot 7: DISABLED
Back up the header:
sudo cryptsetup luksHeaderBackup --header-backup-file /home/me/luksHeaderBackupFile8TB.img /dev/sdf1
open the container and mount at /dev/mapper/volume01:
sudo cryptsetup luksOpen /dev/sdf1 volume01
create the ext4 filesystem.
sudo mkfs.ext4 /dev/mapper/volume01
mount it
sudo mkdir -p /mnt/drive01
sudo mount /dev/mapper/volume01 /mnt/drive01
unmount and close the container.
sudo umount /mnt/drive01
sudo cryptsetup luksClose /dev/mapper/volume01
Latter mounting/unmounting:
sudo cryptsetup luksOpen /dev/sdf1 volume01
sudo mount /dev/mapper/volume01 /home/ms/mnt/drive01
##DO YOUR WORK HERE##
sudo umount /home/ms/mnt/drive01
sudo cryptsetup luksClose /dev/mapper/volume01