Automated LUKS Open and Close with Cron

[SEAL62]

Hi there

I have a LUKS encrypted drive in my Linux server and am syncing data to it every X amount of time. However I would like to decrypt my drive before every sync and then again encrypt it when the sync process is finished.

Is there any way how I could do that with a script and maybe a keyfile for unlocking and that would work in Cron?

Thanks in advance

[Egbert]

If you did that it seems like you'd need to store all the details needed to decrypt it in the (non-encrypted) script.

 

Wouldn't it be safer just to decrypt it at startup?

(Entering the encryption key during/after boot)

 

[Kilrah]

Why the heck would you do that? It would literally rewrite the entire drive twice each time, and require defeating the purpose of the encryption by storing the key in the script. 

[SEAL62]

Just now, Egbert said:

If you did that it seems like you'd need to store all the details needed to decrypt it in the (non-encrypted) script.

 

Wouldn't it be safer just to decrypt it at startup?

(Entering the encryption key during/after boot)

 

@Egbert

The problem is that it is a server so it usually doesn't get rebootet all that often and during it's running time I would like to have the drive encrypted while there is no syncing going on.

[SEAL62]

2 minutes ago, Kilrah said:

Why the heck would you do that? It would literally rewrite the entire drive twice each time, and require defeating the purpose of the encryption by storing the key in the script. 

@Kilrah

Why should it rewrite the entire drive twice?

Let's say I want my data synced to the drive once a day at 3 am.

Then the drive should be locked throughout the day and get unlocked right before the syncing process starts and locked again as soon as it stops.

 

[Kilrah]

OK then you mean unlock/lock, not decrypt/encrypt.

Still has the issue of storing the key to unlock.

[SEAL62]

2 minutes ago, Kilrah said:

OK then you mean unlock/lock, not decrypt/encrypt.

Still has the issue of storing the key to unlock.

@Kilrah

Sorry for the wrong terminology

Yeah well thats kind of my question

hwo do I store the key and how can I use it in my unlock command.

I know it is not the safest approach but better than leaving the drive unlocked all the time.

[Kilrah]

This might help:

https://unix.stackexchange.com/questions/188553/mounting-luks-from-the-command-line

[SEAL62]

@Kilrah Thanks that looks promising