In this video, you'll learn about LUX disk encryption.
So what is the purpose?
The purpose is to ensure that if somebody finds your laptop and doesn't know your password,
they don't just connect the laptop to their system and read all files on the disk.
So how can you create a LUX encrypted partition?
Well, first you create a partition.
Then you use Cryptsetup LUX format, which will format the partition as a LUX device.
Next, Cryptsetup LUX open will open it and create a device mapper name.
And then you can mount the resulting device mapper name.
If you want to automate the Cryptsetup LUX open process, you can use ETC Crypt tab.
And in ETC Crypt tab, you can specify different parameters on what exactly to do.
Without ETC Crypt tab, you need to manually do a Cryptsetup LUX open.
I will show you how to do it manually, because if you do have an ETC Crypt tab, you will
be prompted for a LUX passphrase, unless you are going to set up a LUX authentication server,
which is beyond the scope of Linux+.
I don't want to have an ETC Crypt tab because I don't want to enter my passphrase every
single time I'm rebooting.
Now to automate mounting the volume, obviously, you use ETC FS tab.
Let me show you.
So to do this, I need a new partition.
Let's start using LSB-LK.
I think I still have logical partitions on NVMe 0 and 1.
There we have partition 2, which is an extended partition.
I can see that by the size of 1K, you only have that in an MBR extended partition.
And we only have one gig in there.
So I'm going to use fdisk on dev NVMe 0 and 1.
Next I'm using N and it's telling me it's creating a logical partition.
That is okay.
And I make it two gigabytes using W. And now I have NVMe 0 and 1 P6.
So I'm going to format the crypto layer.
Script setup LUX format on dev NVMe 0 and 1 P6.
And yes, I'm sure I want to do that.
And next I need to enter my passphrase.
This passphrase should be reasonable secure, otherwise you get an error message and you
may try it again.
So don't try password or anything obvious like that.
So now the crypto layer has been formatted.
And I can use script setup LUX open on dev NVMe 0 and 1 P6.
And when I use LUX open, I also need to give it a device name.
So I'm creating the device secret.
Oh no, I'm doing it the wrong way around.
You first need the device and then the device name.
So that is asking for my passphrase.
And once the device is open, I should see it in dev mapper directory.
And there you can see dev mapper secret.
That is my LUX device.
And this is where I'm going to use mkfs.ext4 on dev mapper secret.
And as I was mentioning, either you put it in fstab, but then you also need a crypt tab
or you don't.
And that's what I'm going to do.
I don't need a crypt tab because I don't want to be entering this passphrase every time I'm booting.