\section{Using an Encrypted Partition}
\begin{frame}
   {Using an Encrypted Partition}

   \begin{itemize}
      \item

      Provide previously created partition
      (\verb?/dev/sdc12?) to \textbf{LUKS}:
      \begin{cmd}
$ sudo cryptsetup luksFormat /dev/sdc12 
      \end{cmd}
      \item
      If your kernel does not support the default encryption
      method used by \textbf{cryptsetup}, examine
      \filelink{/proc/crypto} and use a supported method:
      \begin{cmd}
$ sudo cryptsetup luksFormat --cipher aes /dev/sdc12
      \end{cmd}
      \item
      Make encrypted volume available:
      \begin{cmd}
$ sudo cryptsetup --verbose luksOpen /dev/sdc12 SECRET
      \end{cmd}
      \item
      Format, mount, use and unmount the partition as in:
      \begin{cmd}
$ sudo mkfs.ext4  /dev/mapper/SECRET
$ sudo mount /dev/mapper/SECRET /mnt
....
$ sudo umount /mnt
      \end{cmd}
      \item
      Remove the association for now:
      \begin{cmd}
$ sudo cryptsetup --verbose luksClose SECRET
      \end{cmd}
   \end{itemize}
\end{frame}

\cprotect\note{

   If the partition \filelink{/dev/sdc12}
   already exists, the following commands will set up
   encryption, make it available to \textbf{LUKS}, format
   it, mount it, use it, and unmount it.  First we need to
   give the partition to \textbf{LUKS}:
   \begin{cmd}
$ sudo cryptsetup luksFormat /dev/sdc12
   \end{cmd}
   You will be prompted for a passphrase that will need to
   open use of the encrypted volume later.  Note you only
   have to do this step once, when setting up encryption.
   Your kernel may not support \textbf{cryptsetup}'s default
   encryption method.  In that case you can examine
   \filelink{/proc/crypto} to see the methods your system
   supports, and then you can supply a method as in:
   \begin{cmd}
$ sudo cryptsetup luksFormat --cipher aes /dev/sdc12
   \end{cmd}
   You can make the volume available any time with:
   \begin{cmd}
$ sudo cryptsetup --verbose luksOpen /dev/sdc12 SECRET
   \end{cmd}
   where you will be prompted to supply the passphrase.  You
   can format and then mount the partition:
   \begin{cmd}
$ sudo mkfs.ext4  /dev/mapper/SECRET
$ sudo mount /dev/mapper/SECRET /mnt
   \end{cmd}
   and then use to your heart's content just as if it were
   an unencrypted partition. When you are done, unmount
   and then remove the association with:
   \begin{cmd}
$ sudo umount /mnt
$ sudo cryptsetup --verbose luksClose SECRET
   \end{cmd}
   %%   partition will always be available for later use:
   %%   with:

}
\section{Mounting at Boot}
\begin{frame}
   {Mounting at Boot}

   \begin{itemize}
      \item
      Can mount an encrypted partition at boot if there are
      appropriate entries in:
      \begin{itemize}
         \item
         \filelink{/etc/fstab}
         \item
         \filelink{/etc/crypttab}
      \end{itemize}
      \item
      The entry in \filelink{/etc/crypttab} can be as simple
      as:
      \begin{kcode}
SECRET /dev/sdc12 
      \end{kcode}
      \item
      Can also specify the password (a \textbf{bad idea}) in this
      entry and other options.

      \item
      The entry in \filelink{/etc/fstab} can be as simple as:
      \begin{kcode}
/dev/mapper/SECRET /mnt ext4 defaults 0 0
      \end{kcode}

   \end{itemize}

\end{frame}

\cprotect\note{

   To mount an encrypted partition at boot two conditions
   have to be satisfied:
   \begin{enumerate}
      \item
      Make an appropriate entry in \filelink{/etc/fstab}.
      There is nothing special about this and it does not
      refer to encryption in any way.
      \item
      Add an entry to \filelink{/etc/crypttab}.  This can be
      as simple as:
      \begin{kcode}
SECRET /dev/sdc12
      \end{kcode}
      \begin{dontdothis}
         You can do more in this file, such as specifying the
         password if you do not want to be prompted at boot
         (which seems counterproductive security-wise).  See
         \verb?man crypttab?  to find out what you can do with
         this file.
      \end{dontdothis}
   \end{enumerate}
}
