Last active
May 24, 2022 15:56
-
-
Save daks/a7834169fc1a483b85bc to your computer and use it in GitHub Desktop.
Autofs script to automount LUKS encrypted disks. Based on http://msqr.us/m2/archives/2009/07/configuring-automount-for-luks.html
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#!/bin/bash | |
# This file must be executable to work! chmod 755! | |
# | |
# The LUKS key must exist as a file at /etc/.keys/${device}.key | |
# Protect this directory: root as user/group, 400 as permissions | |
# | |
# Edit your autofs master file to include something like | |
# /mnt/crypt /etc/auto.luks --timeout=600 | |
# | |
# Then you can access your LUKS encrypted disk with | |
# cd /mnt/crypt/<device> | |
# | |
# Combine it with udev rules to have meaningful device name | |
# | |
# /!\ This crypt does not handle LUKS unmapping, see the other file | |
device=$1 | |
device_crypt=${device}_autocrypt | |
CRYPTSETUP=/sbin/cryptsetup | |
mountopts="-fstype=ext4,defaults,noatime,nodiratime" | |
# map the LUKS device, if not already done | |
$CRYPTSETUP luksOpen /dev/${device} ${device_crypt} -d=/etc/.keys/${device}.key 2>/dev/null | |
echo $mountopts :/dev/mapper/${device_crypt} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#!/bin/bash | |
# This file must be executable to work! chmod 755! | |
# | |
# This script will close LUKS filesystem if not in use | |
# | |
# Install in cron to run regularly | |
CRYPTSETUP=/sbin/cryptsetup | |
shopt -s nullglob | |
for dev in /dev/mapper/*_autocrypt | |
do | |
match=`mount|grep $dev` | |
if [ -z "$match" ]; then | |
# fs is not mounted, LUKS fs can be closed | |
dm_file=${dev##*/} | |
$CRYPTSETUP luksClose $dm_file | |
fi | |
done |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Is it possible to identify device by UUID?