12

I dual boot Fedora and Windows Vista and want them to share a partition so that I can work on the same files in both Linux and Windows, and I need everything to be encrypted.

I encrypted the shared drive with VeraCrypt since TrueCrypt is out of date. Windows can mount the volume at login with ease.

I tried to do the same in Linux but with no luck since I can't figure out how to use crypttab with the veracrypt option, or even if it has one. cryptsetup works fine since it's just necessary to add the --veracrypt option, but crypttab does not seem to have that.

cryptsetup --veracrypt open --type tcrypt /dev/sdX veracrypt-volume

How do I mount a VeraCrypt volume with crypttab? Is it possible yet?

Improve this question

1 Answer 1

Reset to default
9

I had the same problem! Turns out systemd was lacking such an option, so I have implemented it myself. It is included in systemd 232 or later. (You also need cryptsetup 1.67 or newer for the actual cryptography support, but it sounds like you have that since the manual mount works.)

The new crypttab option is tcrypt-veracrypt; it implies tcrypt so you don't need to specify that separately. For example:

#Volume name Device path Crypto key file Mounting options data /dev/sda7 /etc/volume.passwd noauto,tcrypt-veracrypt

Of course, you need to put your crypto key (with no newline) in /etc/volume.passwd. Also note that if you're trying to decrypt a system partition you need to indicate that using the tcrypt-system option, because it won't detect the different format without it. Here's an example. I'm also demonstrating the use of the UUID= volume specifier here.

 data UUID=your-uuid /etc/volume.passwd tcrypt-veracrypt,tcrypt-system

See the pull request I made for more info about tcrypt-veracrypt.

Improve this answer
2
  • 2
    The mapped device will then be available as /dev/mapper/data which you can then include in your /etc/fstab or mkdir /media/tcdata && mount /dev/mapper/data /media/tcdata Commented Oct 31, 2016 at 0:46
  • 4
    I was unable to get this working as described on Debian 10 Buster. For some reason the password file wasn't being handled correctly by cryptdisks_start (confirmed it had no new line at the end). It eventually worked with the options tcrypt,veracrypt,keyscript=/bin/cat,noearly. Not sure why passing the passphrase through /bin/cat would make a difference, nor why tcryrpt,veracrypt worked over tcrypt-veracrypt. Commented Jul 9, 2020 at 8:57

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.