linux-disk-encryption.md

pwgen -1 -n 40 --secure | head -c 40 > /root/foo.key
cryptsetup --verbose --cipher "aes-cbc-essiv:sha256" --key-size 256 --key-file /root/foo.key luksFormat /dev/mapper/foo-enc
cryptsetup open --type luks --key-file /root/foo.key /dev/mapper/foo-enc foo
cryptsetup close foo

luks.sh

#!/usr/bin/env bash
set -e

# apt-get install cryptsetup

KEYFILE=/var/local/foo/luks.key
ENC_VOLUME=/dev/hostvg/foo-enc
VOLUME=foo

COMMAND=$1
shift

case "$COMMAND" in

  'setup')
    set -x
    exec cryptsetup --verbose --cipher aes-cbc-essiv:sha256 \
      --key-size 256 --key-file $KEYFILE luksFormat $ENC_VOLUME
    ;;

  'open')
    set -x
    exec cryptsetup open --type luks --key-file $KEYFILE $ENC_VOLUME $VOLUME
    ;;

  'close')
    set -x
    exec cryptsetup close $VOLUME
    ;;

  *)
    echo "Unknown command $COMMAND"
    ;;

esac