I wanted a small encrypted part of my hard disk, and I found http://www.debian-administration.org/articles/469 (which uses LVM as an example, which was a bit of a pain, as I'm not using LVM), and http://www.saout.de/ (which doesn't use LVM, but skips a few details at the end) both to be very useful.

Both articles are far better than this, at explaining why you do each step; I just didn't find the actual syntax required to be so very clear. This article aims to fill the gap.

It took a while to sort out the exact syntax necessary to get it running on boot. So here it is:

Partition to be encrypted	/dev/sda8
Mountpoint	/crypto

---

1 (Optional): Wipe out the current contents:

# dd if=/dev/urandom of=/dev/sda8

2: Create encrypted partition

Replace the "passphrase_goes_here" with the passphrase you'll enter every time you want to mount the filesystem (on boot, or afterwards).

# cryptsetup luksFormat /dev/sda8

WARNING!
========
This will overwrite data on /dev/sda8 irrevocably.

Are you sure? (Type uppercase yes): YES
Enter LUKS passphrase: passphrase_goes_here
Verify passphrase: passphrase_goes_here
Command successful.
# cryptsetup luksOpen /dev/sda8 crypto
Enter LUKS passphrase: passphrase_goes_here
key slot 0 unlocked.
Command successful.

You have made an encrypted partition, known as /dev/mapper/crypto (instead of /dev/sda8, which is now useless to the normal tools - mount /dev/sda8, for example, will no longer work.)

3: Create a filesytem

# mkfs.ext3 /dev/mapper/crypto
mke2fs 1.40.2 (12-Jul-2007)
Filesystem label=
OS type: Linux
Block size=4096 (log=2)
Fragment size=4096 (log=2)
973440 inodes, 1945736 blocks
97286 blocks (5.00%) reserved for the super user
First data block=0
Maximum filesystem blocks=1996488704
60 block groups
32768 blocks per group, 32768 fragments per group
16224 inodes per group
Superblock backups stored on blocks: 
	32768, 98304, 163840, 229376, 294912, 819200, 884736, 1605632

Writing inode tables: done
Creating journal (32768 blocks): done
Writing superblocks and filesystem accounting information: done

This filesystem will be automatically checked every 34 mounts or
180 days, whichever comes first.  Use tune2fs -c or -i to override.

4: Set it to mount on boot

You'll need an entry in /etc/crypttab, and also in /etc/fstab:

# echo "crypto /dev/sda8 none luks,check=ext2,retry=1" >> /etc/crypttab
# echo "/dev/mapper/crypto /crypto ext3 defaults 1 2" >> /etc/fstab
# mkdir /crypto

... you'll also need to remove (or comment-out) any existing /dev/sda8 entries in /etc/fstab

5: Configure initramfs

I'm not sure if this is needed; for a non-root filesystem, I doubt it.

# update-initramfs -u -k all
update-initramfs: Generating /boot/initrd.img-2.6.22-2-686
update-initramfs: Generating /boot/initrd.img-2.6.18-5-686

6: Use it!

You should be prompted for the passphrase when the system boots - just before it mounts the filesystems. If you enter the right one, it will mount it; otherwise, the encrypted filesystem will not be mounted.

If you later want to mount it, then you can do this:

# cryptsetup luksOpen /dev/sda8 crypto
Enter LUKS passphrase: passphrase_goes_here
key slot 0 unlocked.
Command successful.
# mount /dev/mapper/crypto /crypto

Or you can unmount it, and make it so that it can't be remounted (without the passphrase), like this:

# umount /crypto
# cryptsetup luksClose crypto

This can all be embodied into a wrapper script:

#!/bin/sh

case $1 in
  start)
	cryptsetup luksOpen /dev/sda8 crypto
	echo "Mounting /crytpo..."
	mount /dev/mapper/crypto /crypto
	;;
  stop)
	echo "Unmounting /crytpo..."
	umount /crypto
	cryptsetup luksClose crypto
	;;
  *)
	echo "Usage: crypt [ start | stop ]"
	;;
esac