How to do "cryptsetup luksOpen" and "mount" in a single command?

Question

I currently have the following script. I run this manually when I need to mount the disk described. I don't need/want this disk auto-mounted on boot:

disk1="/dev/disk/by-uuid/84ea2a10-abcd-abcd-abcd-06deabcdabcd"
sudo cryptsetup luksOpen "${disk1}" disk1-crypt
sudo mount /dev/mapper/disk1-crypt /mnt/disk1

Is it possible to set up Linux such that it knows to automatically do the luksOpen command when I try to mount this disk? If possible, also luksClose when I unmount it.

Answer 1

If you're using systemd:

2. Add the LUKS configuration to /etc/crypttab, specifying "none" as the keyfile.
3. Add the mount configuration to /etc/fstab (probably specifying noauto as option).
4. Run systemctl daemon-reload to make it pick up the changes.
5. Use systemctl start /mnt/disk1 to unlock and mount the filesystem.
6. Use systemctl stop /mnt/disk1 to unmount the filesystem, which should result in the unlocked device being also stopped as unneeded.

If you're using GNOME (or have its components installed in general):

1. Use gio mount -d /dev/disk/by-whatever to mount the filesystem directly from its locked device. This does not accept a mountpoint location – if the disk matches crypttab & fstab entries it will honor those, but otherwise it will always default to /run/media/USER/FSLABEL.
2. Use gio mount -u /run/media/ana/disk1 to unmount it.

Answer 2

@user1686 shows the "right" way to do it under systemd, but for those without systemd (or who think systemd is too many complicated scriptlets tied together with glue!), just use @Gabriel's script and stick it in /usr/local/bin/mount-my-disk:

#!/bin/bash

if [ $UID != 0 ]; exec sudo "$0" "$@"; fi

disk1="/dev/disk/by-uuid/84ea2a10-abcd-abcd-abcd-06deabcdabcd"
cryptsetup luksOpen "${disk1}" disk1-crypt
mount /dev/mapper/disk1-crypt /mnt/disk1

You probably don't want to give sudo access to all those commands or a user with sudo mount access might do something naughty: keep to the principle of least privilege.

The $UID check lets you enable sudo for only /usr/local/bin/mount-my-disk

Answer 3

Not an elegant solution, but it may serve your use case (and it's definitely how I would solve it myself).

You can create a bash script that overrides the mount command as an alias, checking the arguments and doing what you need when that exact argument is passed, falling back to the actual mount command when anything else is passed.

Have a look at this script:

#!/bin/bash

mount_disk1 () {
    disk1="/dev/disk/by-uuid/84ea2a10-abcd-abcd-abcd-06deabcdabcd"
    sudo cryptsetup luksOpen "${disk1}" disk1-crypt
    sudo mount /dev/mapper/disk1-crypt /mnt/disk1
}

[[ "$@" == "disk1" ]] && mount_disk1 \
|| mount "$@"

Here you have a function that does what you want. If the only thing you pass into it is disk1 it will execute that function, else it'll execute the original mount passing all arguments.

You can put this script in a folder and set an alias in your ~/.bashrc or ~/.zshrc using

alias mount='<path to script>'

Then if you want to use the original mount, you can run \mount in the terminal.

Hope it helps!