You are not logged in.
I'm new to dm-crypt and trying to create/use a encrypted image file. I followed the wiki page of dm-crypt and everything works.
But in the wiki: https://wiki.archlinux.org/index.php/Dm … oop_device , an image file is first setup as a loop device using losetup. And accidentally, I find out that cryptsetup seems to be able to handle the image file directly, i.e. it's ok to do "cryptsetup open crypt.img secret". So why the wiki page instructs us to manually losetup the image before running cryptsetup? Is there any benefit of doing so? Or will letting cryptsetup handling image file as device dangerous?
Thank you!
Offline
cryptsetup auto manages a loop device when given an image file and hence its not necessary to manually manage one.
I think the documentation should be changed and the step to create and remove loop device should be removed.
Offline
Thank you for your answer! I have another question now.
After I 'cryptsetup open' the image, I can see a new device in the left panel of nautilus. I can mount the (decrypted) device and then click the eject button to unmount. I realized that the eject button not only unmount the device, it also detached the loop back device created by cryptsetup. Does this operation safely close the mapped device and detach the loop back device? Or should I manually umount and cryptsetup close them?
Thanks again!
Offline
No,after you have unmounted the volume in nautilus,you have to go back to cryptsetup and close the volume.cryptsetup will then auto remove the loop device after it has closed the volume.
If you prefer to mount and unmount the volume using nautilus,you can use disks program to unlock your luks volume and lock it back up.With disks,you first unlock your luks volume using it and then mount the volume using nautilus,when you are done accessing the volume,you unmount it using nautiful and then lock the volume using disks.These are the steps that you have to take but disks allow you to do them through a GUI window.
There is also a project called zuluCrypt[1] that automate all these steps for you,It unlocks a volume and automatically mount it,when you close/unmount the volume,it also automatically lock the volume.
You can install it from here[2]
Offline
Thank you for your reply!
I just tried again. After I click the eject button in nautilus, the loop device is no longer shown in `losetup -l`. So I suppose somehow the nautilus or something else knows the mapped device is backed by cryptsetup and close it when unmounting the mapped device. Is that right? If so, is the operation safe?
Thank you!
Offline
This is how it works.
First,you start with an image file at a path like "/home/ink/crypt.img".
Second,a loop device is attached to the file and you end up with an address like "/dev/loop0".
Third,cryptseup creates an encryption mapper in "/dev/mapper" with an address like "/dev/mapper/crypt.img"
Fourth, the file system in the encryption mapper at "/dev/mapper/luks.img" is mounted and the volume is accessed.
When done,all above steps are taken in reverse order.
First,the file system on the encryption mapper is unmounted.
Second,the encryption mapper is closed.
Third,the loop device is detached.
Fourth,you end up where you started,with a locked volume.
To check if the volume is locked,the place to look for it is in "/dev/mapper".If its encryption mapper is not there,then the volume is not open.
Its not possible to have an unlocked volume that is not baked by a loop device so if the loop device is gone,then then volume is probably also
locked so you should be safe.
I do not use GNOME so i cant test for you but if the encryption mapper is gone and the loop device is also gone when you unmount the volume,then
your volume is probably safe as somebody else auto does all the mentioned reversed steps for you.
Offline
Thank you so much for you help!
Offline