Luks. Additional disk encryption with a keyfile

Links

https://gist.github.com/huyanhvn/1109822a989914ecb730383fa0f9cfad

Configuration

Install tool

dnf install -y cryptsetup

Create key-file

openssl genrsa -out /root/keys/luks-d1.key 4096

Disk encryption

cryptsetup luksFormat /dev/sda --key-file /root/keys/luks-d1.key

Encrypted disk attach

cryptsetup luksOpen /dev/sda d1 --key-file /root/keys/luks-d1.key

Create FS

mkfs.ext4 /dev/mapper/d1

Add lines for auto-mount during the boot

nano /etc/crypttab

...
d1 /dev/disk/by-uuid/f3eade79-16e4-402d-a0d8-eb6585aa8a4d /root/keys/luks-d1.key luks,nofail

nano /etc/fstab

...
/dev/mapper/d1 /mnt/d1 ext4 defaults,nofail 0 0

reboot