1

When I unmount a LUKS partition using Nautilus, it gets unmounted and locked.

Using the command-line, I have to: sudo cryptsetup luksClose encrypted_volume after unmount, otherwise, re-mounting the unlocked volume is possible.

Can I make the locking automatic when unmounted?

I wonder how the system keeps the data accessible. Where is the password stored after it is unlocked, and what does it mean to forget the password after unlocking? How can the data be available if the system forgets the password?

Improve this question
1
  • The password and the key are not the same thing. The key is a randomly chosen bit string. That key is written to disk after being encrypted by your password (actually it's encrypted by a key derived from your password, but that's a detail). So a system could use your password to decrypt the key, and then forget your password while remembering the key. I'm not a LUKS expert, so I can't swear this is the way it's done, but this is typical for similar situations. Commented Mar 6, 2016 at 19:52

1 Answer 1

Reset to default
1

cryptsetup won't automatically remember your encryption password, but when used in conjunction with Nautilus, you are given the choice to have Nautilus remember the password (which is generally VERY BAD if your home partition is not encrypted because anyone with access to it would then have full access to your "encrypted" drive).

When unmounted by Nautilus, the encrypted volume is first locked. If you chose for Nautilus to "remember" the LUKS password, it will not "forget the password after unlocking," but rather store it on your hard disk.

As for your last question of how the data can be made available if your system forgets the password, the simplest solution is also the most effective: remember it yourself (and type it into the prompt manually when going to mount the encrypted volume). If you need to have an easy-to-remember password that's secure, look up the XKCD method for secure passwords. (Or, you could be like me and memorize a 50-character random alpha-numeric-symbolic character string.)

Improve this answer

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.