Cryptmount – A Utility to Create Encrypted Filesystems in Linux

Cryptmount is a Linux utility that allows you to create encrypted filesystems. With cryptmount, you can create an encrypted container that can be mounted as a virtual drive, and any data stored in that container will be automatically encrypted and decrypted as needed. This can help you keep your sensitive data safe and secure, even if your computer is lost or stolen. In this blog post, we'll take a closer look at cryptmount and how to use it to create encrypted filesystems in Linux.

What is Cryptmount?

Cryptmount works by creating a virtual block device that can be mounted as a regular filesystem. The data stored on this virtual device is encrypted using a cipher, and a key is required to decrypt the data. This key is stored in a keyfile, which is itself encrypted using a passphrase.

Cryptmount uses the Linux kernel's dm-crypt module to provide encryption. This module is a device-mapper target that allows you to create encrypted block devices on top of existing block devices. Cryptmount uses dm-crypt to create an encrypted block device and then mounts it as a regular filesystem.

Why Use Cryptmount?

There are several reasons why you might want to use cryptmount to create encrypted filesystems. First and foremost, it provides an additional layer of security for your sensitive data. If your computer is lost or stolen, the encrypted data on your encrypted filesystem will be inaccessible to anyone who doesn't have the keyfile and passphrase.

Another reason to use cryptmount is that it allows you to create encrypted backups of your data. You can create an encrypted container and store your backups in that container. This will ensure that your backups are safe and secure, even if they are stored on an untrusted medium such as a cloud storage service.

Cryptmount also allows you to create encrypted filesystems on removable media such as USB drives. This can be useful if you need to transport sensitive data between different computers.

Getting Started with Cryptmount

To get started with cryptmount, you'll need to install it on your Linux system. Cryptmount is available in most Linux distributions' repositories, so you can install it using your distribution's package manager. For example, if you're using Ubuntu or Debian, you can install cryptmount using the following command −

sudo apt-get install cryptmount

Once cryptmount is installed, you can use it to create encrypted filesystems.

Creating an Encrypted Filesystem with Cryptmount

To create an encrypted filesystem with cryptmount, you'll need to perform the following steps −

• Create a container file for the encrypted filesystem.

• Format the container file with a filesystem.

• Create a keyfile and encrypt it with a passphrase.

• Mount the encrypted filesystem using cryptmount.

Step 1: Create a Container File

The first step in creating an encrypted filesystem with cryptmount is to create a container file. This file will be used to store the encrypted data. You can create a container file using the dd command. For example, to create a 1 GB container file, you can use the following command −

dd if=/dev/zero of=/path/to/container bs=1M count=1024

This command will create a 1 GB container file at /path/to/container.

Step 2: Format the Container File

Once you've created the container file, you'll need to format it with a filesystem. You can use any filesystem that's supported by Linux, but ext4 is a good choice. To format the container file with ext4, you can use the following command −

sudo mkfs.ext4 /path/to/container

This command will format the container file with ext4.

Step 3: Create a Keyfile

The next step is to create a keyfile and encrypt it with a passphrase. The keyfile will be used to encrypt and decrypt the data in the container file. You can create a keyfile using the following command −

sudo dd if=/dev/urandom of=/path/to/keyfile bs=1 count=256

This command will create a 256-byte keyfile at /path/to/keyfile. You can change the size of the keyfile by adjusting the count parameter.

Once you've created the keyfile, you'll need to encrypt it with a passphrase. You can do this using the following command −

sudo cryptmount --keyfile /path/to/keyfile --generate-key

This command will prompt you to enter a passphrase to encrypt the keyfile. Make sure to choose a strong passphrase and store it in a safe place.

Step 4: Mount the Encrypted Filesystem

Now that you've created the container file, formatted it with a filesystem, and created a keyfile and encrypted it with a passphrase, you're ready to mount the encrypted filesystem. You can do this using the following command −

sudo cryptmount -m mymount /path/to/container

This command will mount the encrypted filesystem at /mnt/mymount. You can choose any mountpoint you like.

When you run this command, cryptmount will prompt you for the passphrase that you used to encrypt the keyfile. Once you enter the passphrase, cryptmount will decrypt the keyfile and use it to mount the encrypted filesystem.

You can now use the mounted filesystem just like any other filesystem. Any data that you write to the filesystem will be automatically encrypted, and any data that you read from the filesystem will be automatically decrypted.

Unmounting the Encrypted Filesystem

When you're done using the encrypted filesystem, you can unmount it using the following command −

sudo cryptmount -u mymount

This command will unmount the encrypted filesystem and remove it from the system.

Advanced Cryptmount Usage

In addition to the basic usage described above, cryptmount has several advanced features that can be useful in certain situations.

Using a Keyfile on a Smart Card

Cryptmount can be configured to use a keyfile stored on a smart card. This can be useful if you need to store your keyfile in a secure location, such as a smart card reader. To use a keyfile on a smart card, you'll need to perform the following steps −

• Create a keyfile on the smart card.

• Configure cryptmount to use the keyfile on the smart card.

To create a keyfile on a smart card, you can use the following command −

sudo cryptmount --keyfile /dev/smartcard --generate-key

This command will prompt you to enter a passphrase to encrypt the keyfile. Once you've entered the passphrase, cryptmount will write the keyfile to the smart card.

To configure cryptmount to use the keyfile on the smart card, you'll need to add the following line to your /etc/cryptmount/cmtab file −

mymount /path/to/container cryptsetup keyfile=/dev/smartcard

This line tells cryptmount to use the keyfile stored on the smart card to mount the encrypted filesystem.

Using a Keyfile on a Remote Server

Cryptmount can also be configured to use a keyfile stored on a remote server. This can be useful if you need to store your keyfile in a secure location that's accessible from multiple computers. To use a keyfile on a remote server, you'll need to perform the following steps −

• Copy the keyfile to the remote server.

• Configure cryptmount to use the keyfile on the remote server.

To copy the keyfile to the remote server, you can use the following command −

scp /path/to/keyfile user@remote-server:/path/to/keyfile

This command will copy the keyfile to the remote server.

To configure cryptmount to use the keyfile on the remote server, you'll need to add the following line to your /etc/cryptmount/cmtab file −

mymount /path/to/container cryptsetup keyfile=/path/to/keyfile@remote-server

This line tells cryptmount to use the keyfile stored on the remote server to mount the encrypted filesystem.

Using Inotifywait with a Cryptmount encrypted filesystem

Inotifywait is a utility that can be used to monitor a filesystem for changes and execute commands when those changes occur. This can be useful when working with encrypted filesystems, as it allows you to automatically unmount the filesystem when it's no longer in use.

To use inotifywait with a cryptmount encrypted filesystem, you can create a script that unmounts the filesystem when it's no longer in use. Here's an example script −

#!/bin/bash

mountpoint=/mnt/mymount

while inotifywait -q -e close_write "$mountpoint"; do
   if [ ! -f "$mountpoint/file" ]; then
      cryptmount -u mymount
      exit
   fi
done

This script uses inotifywait to monitor the /mnt/mymount directory for changes. When a file is closed for writing in this directory, the script checks to see if the file exists. If the file doesn't exist, it means that the filesystem is no longer in use, so the script unmounts the encrypted filesystem and exits.

To use this script, you'll need to make it executable and run it as root −

sudo chmod +x unmount.sh
sudo ./unmount.sh

Common Use Cases for Conditional Job Execution

Cryptmount is a versatile utility that offers many features for creating and managing encrypted filesystems in Linux. One of its most useful features is the ability to automate tasks using conditional job execution. Here are some common use cases for conditional job execution with Cryptmount −

• Backups − With Cryptmount, you can create encrypted backups of important files or directories. You can use conditional job execution to automate backups by creating a cron job that runs at a certain time, but only creates a backup if a certain file has been modified since the last backup. This ensures that your backups are always up to date without wasting system resources on unnecessary backups.

• Remote Access − Cryptmount can be used to create encrypted filesystems that are accessible over a network. You can use conditional job execution to automatically mount and unmount these filesystems when a remote user connects or disconnects. This ensures that sensitive data is protected when not in use and makes it easy for remote users to access encrypted data.

• Security − Cryptmount can be used to store sensitive data in an encrypted container file. You can use conditional job execution to automate security tasks, such as checking for updates or monitoring logs for suspicious activity. For example, you might create a cron job that runs every day and checks for software updates. If updates are available, the job might execute a script that installs the updates and restarts the system. This ensures that your system is always up to date with the latest security patches.

In addition to conditional job execution, Cryptmount also offers other useful features such as support for smart cards and keyfiles stored on remote servers. These features provide additional layers of security and make it easy to manage encrypted filesystems in a variety of environments.

Conclusion

Cryptmount is a powerful utility for creating and managing encrypted filesystems in Linux. Its ability to automate tasks using conditional job execution is just one of many features that make it a valuable tool for securing sensitive data. By automating tasks such as backups, remote access, and security monitoring, you can ensure that your encrypted filesystems are always up to date and that your data is protected from unauthorized access. With support for smart cards and keyfiles stored on remote servers, Cryptmount is a versatile tool that can be used in a variety of environments. If you are looking for a reliable and easy-to-use utility for creating encrypted filesystems in Linux, Cryptmount is definitely worth considering.