1

I have / and swap area of Ubuntu 14.04 LTS (and Linux Mint 17.1 LTS) encrypted in dm-crypt/LUKS. / and swap area reside in /dev/mapper/UUID_1 and /dev/mapper/UUID_2. Is it possible to recreate the /dev/mapper/UUID (e.g. on the different hard drive) (with the same UUID of course)? It would make recovery of the system with TAR possible in case of disaster. As you know, TAR records UUID of copied partition. Furthermore, grub.cfg, /etc/fstab and initframs contains the number as well.

sudo tune2fs /dev/mapper/UUID ‐U UUID

command doesn't work.

cryptsetup luksUUID /device/ --UUID

can change only UUID of external container.

Thank you for responses.

0

You have two UUID's for each encrypted partition.

UUID of file system

Used in /etc/fstab and by GRUB (so don't forget use sudo update-grub after change). Could be changed with:

sudo tune2fs ‐U "<fsUUID>" /dev/mapper/<luksUUID>

...where is UUID of corresponding LUKS partition (could look for it in /etc/crypttab) and <fsUUID> is file system UUID need to be set. For example:

sudo tune2fs ‐U "81db8bc2-6cc1-4272-beab-8c1d667cfa93" /dev/mapper/310919c2-aec9-4641-b3d2-6d523395db34

UUID of LUKS partition

Used in /etc/crypttab. Could be changed with:

sudo cryptsetup luksUUID --uuid "<luksUUID>" /dev/sdxX

...where is UUID of the LUKS partition need to be set and /dev/sdxX is LUKS-encrypted device name. For example:

sudo cryptsetup luksUUID --uuid "310919c2-aec9-4641-b3d2-6d523395db34" /dev/sda1

But it's much better to restore the whole LUKS header (if you're not going to change encryption key). LUKS header does not stores partition size so it could be used to restore to virtually any partition size. Also restoring header is enough for recreation LUKS partition formatting (i.e. luksFormat is not required in this case). Could be done with luksHeaderRestore (backup is done with the pretty same way with luksHeaderBackup):

sudo cryptsetup luksHeaderRestore --header-backup-file "<HeaderBackupFile>" /dev/sdxX

...where is UUID of the LUKS partition need to be set. For example:

sudo cryptsetup luksHeaderRestore --header-backup-file "/home/user/MyLuksHeader.Backup" /dev/sda1

Summary

So the restore steps are:

  1. Create new partition.
  2. Restore LUKS header.
  3. Unlock LUKS partition
  4. Restore file system using any of these:
    • Restore file system image (e.g. use partclone).
    • Recreate file system:
      1. Format new device.
      2. Untar backup.
      3. Restore file system UUID, if required.

Also

Please note, that using labels for LUKS and file system instead of UUID's could simplify configuration and make it more readable.

  • 2 better ideas : 1) DO NOT USE /dev/mapper/sdXY in /etc/fstab OR /etc/crypttab use a line like this: UUID=<fs_UUID> <UUID> <fs> <options> this is much more robust especially in the case of moving drive partitions / disk.... 2) look into cryptsetup-reencrypt and run with the --uuid switch (this set a user-defined uuid for the re-encrypted bits) ---this is in-place reencrypt so if this is on the system drive run this from a live media or other OS... – linuxdev2013 Sep 21 '15 at 14:54
  • Thanx, but actually 1) /dev/mapper devices was used only with tune2fs utility (it requires device file pathname), assuming we don't need to change anything in system settings, and 2) original question is about backup, not change luksUUID in-place (by the way, luksUUID can be changed without LUKS-volume re-encryption - using cryptsetup luksUUID) – dess Sep 22 '15 at 14:34
0

To recreate the cryptluks partition with a given UUID, type analogically:

sudo cryptsetup luksFormat --verify-passphrase --uuid dec95850-23ad-4f54-b5c2-4f13ea48c571 /dev/sdb4

(to encrypt /dev/sdb4 partition with cryptluks),

sudo cryptsetup open --type luks /dev/sdb4 sdb4_crypt

(to open luks container and attach it as /dev/mapper/sdb4_crypt),

sudo mke2fs -v -t ext4 -U f65aa2cb-d7a3-4e45-858b-2b12a50e1b45 /dev/mapper/sdb4_crypt

(to format luks container as ext4 filesystem and assign a given UUID),

mount /dev/mapper/sdb4_crypt /media/<user>/f65aa2cb-d7a3-4e45-858b-2b12a50e1b45

(to mount luks container under a given path.)

When job is finished, we can unmount the container and close the container:

sudo umount /media/<user>/f65aa2cb-d7a3-4e45-858b-2b12a50e1b45
sudo cryptsetup luksClose sdb4_crypt

To recreate the swap partition with a given UUID:

sudo cryptsetup luksFormat --verify-passphrase --uuid e1baa59a-f24f-450c-a5a8-67f9d2f3338e /dev/sdc2
sudo cryptsetup open --type luks /dev/sdc2 sdc2_crypt
sudo mkswap -U 5313264e-6212-46f5-936d-f903eb2a2231 /dev/mapper/sdc2_crypt

Container can be closed with the command:

cryptsetup luksClose sdc2_crypt

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.