USB Backup mit cryptsetup verschlüsselt#

Via USB angeschlossen. Dann tail -f /var/log/syslog. Daraus /dev/sda.

# lsblk --output NAME,ID-LINK,VENDOR,MODEL,STATE,UUID /dev/sda
NAME      ID-LINK                      VENDOR   MODEL                STATE   UUID
sda       wwn-0x50014ee2076e8e18       IB-1122- WDC WD30EZRX-00AZ6B0 running
└─sda1    wwn-0x50014ee2076e8e18-part1                                       0b7b077a-e803-5b66-8a6a-5e5a12c7e596
  └─md127

Wipe (nwipe) braucht’s nicht, weil die Platte verschlüsselt ist. Passt.

Das machen wir nochmal so.

Altes RAID Volume Aushängen#

cat /proc/mdstat
mdadm --stop /dev/md127

Partitionieren#

Über gnome-disk-utility Partition gelöscht.

Weiter in https://blag.felixhummel.de/admin/raid.html#create-partitions

Note: 8309 ist LUKS, weil wir direkt ein LUKS (cryptsetup) Volume in die Partition stopfen.

gdisk /dev/sda
n
<ENTER>
<ENTER>
<ENTER>
8309
w
y

gdisk -l /dev/sda
# find partition uuids
ls -la /dev/disk/by-partuuid/ | rg sda1
ls -la /dev/disk/by-partuuid/8090c80f-fe4d-4c69-8f1b-2481ec17f6d7

Diesmal kein RAID, sondern direkt weiter bei Encryption

 # cryptsetup benchmark
# Tests are approximate using memory only (no storage IO).
PBKDF2-sha1      2920824 iterations per second for 256-bit key
PBKDF2-sha256    5991862 iterations per second for 256-bit key
PBKDF2-sha512    2396745 iterations per second for 256-bit key
PBKDF2-ripemd160 1275639 iterations per second for 256-bit key
PBKDF2-whirlpool 1134822 iterations per second for 256-bit key
argon2i       9 iterations, 1048576 memory, 4 parallel threads (CPUs) for 256-bit key (requested 2000 ms time)
argon2id      9 iterations, 1048576 memory, 4 parallel threads (CPUs) for 256-bit key (requested 2000 ms time)
#     Algorithm |       Key |      Encryption |      Decryption
        aes-cbc        128b      1985,7 MiB/s      7709,3 MiB/s
    serpent-cbc        128b       136,5 MiB/s       997,6 MiB/s
    twofish-cbc        128b       295,2 MiB/s       654,7 MiB/s
        aes-cbc        256b      1516,6 MiB/s      6274,4 MiB/s
    serpent-cbc        256b       138,6 MiB/s       998,6 MiB/s
    twofish-cbc        256b       300,3 MiB/s       656,5 MiB/s
        aes-xts        256b      6046,5 MiB/s      6058,2 MiB/s
    serpent-xts        256b       868,6 MiB/s       907,1 MiB/s
    twofish-xts        256b       605,4 MiB/s       613,9 MiB/s
        aes-xts        512b      5526,4 MiB/s      5528,7 MiB/s
    serpent-xts        512b       878,5 MiB/s       908,7 MiB/s
    twofish-xts        512b       610,2 MiB/s       613,3 MiB/s

Cipher aes-xts-plain64 ist OK für meine CPU. Siehe auch https://wiki.archlinux.org/title/Dm-crypt/Device_encryption#Encryption_options

cryptsetup --cipher aes-xts-plain64 --key-size 512 --hash sha512 --iter-time 5000 --use-random --verify-passphrase luksFormat /dev/sda1
cryptsetup luksDump /dev/sda1
cryptsetup luksOpen /dev/sda1 backup1

Create file system

mkfs.ext4 -L backup1 /dev/mapper/backup1

Mount

mount /dev/mapper/backup1 /mnt/
l /mnt

Umount and close

umount /mnt
cryptsetup close /dev/mapper/backup1

(Optional) Passwort ändern

# neues Passwort hinzufügen
cryptsetup luksAddKey /dev/sda1
# altes löschen (durch Eingabe desselben)
cryptsetup luksRemoveKey /dev/sda1

Nach Reboot Mounten#

mkdir -p /media/backup1
cryptsetup luksOpen /dev/disk/by-partuuid/8090c80f-fe4d-4c69-8f1b-2481ec17f6d7 backup1
mount /dev/mapper/backup1 /media/backup1
Uptime % to Human Readable Downtime per Year  
On this page