How to setup an encrypted USB-disk software-RAID-1 on Debian GNU/Linux using mdadm and cryptsetup

This is what I set up for backups recently using a cheap USB-enclosure which can house 2 SATA disks and shows them as 2 USB mass-storage devices to my system (using only one USB cable). Without any further introduction, here goes the HOWTO:

First, create one big partition on each of the two disks (/dev/sdc and /dev/sdd in my case) of the exact same size. The cfdisk details are omitted here.

  $ cfdisk /dev/sdc
  $ cfdisk /dev/sdd

Then, create a new RAID array using the mdadm utility:

  $ mdadm --create /dev/md0 --level=1 --raid-devices=2 /dev/sdc1 /dev/sdd1

The array is named md0, consists of the two devices (--raid-devices=2) /dev/sdc1 and /dev/sdd1, and it's a RAID-1 array, i.e. data is simply mirrored on both disks so if one of them fails you don't lose data (--level=1). After this has been done the array will be synchronized so that both disks contain the same data (this process will take a long time). You can watch the current status via:

  $ cat /proc/mdstat
  Personalities : [raid1]
  md0 : active raid1 sdd1[1] sdc1[0]
        1465135869 blocks super 1.1 [2/2] [UU]
        [>....................]  resync =  0.0% (70016/1465135869) finish=2440.6min speed=10002K/sec
  unused devices: 

Some more info is also available from mdadm:

  $ mdadm --detail --scan
  ARRAY /dev/md0 metadata=1.01 name=foobar:0 UUID=1234578:1234578:1234578:1234578

  $ mdadm --detail /dev/md0
  /dev/md0:
          Version : 1.01
    Creation Time : Sat Feb  6 23:58:51 2010
       Raid Level : raid1
       Array Size : 1465135869 (1397.26 GiB 1500.30 GB)
    Used Dev Size : 1465135869 (1397.26 GiB 1500.30 GB)
     Raid Devices : 2
    Total Devices : 2
      Persistence : Superblock is persistent
      Update Time : Sun Feb  7 00:03:21 2010
            State : active, resyncing
   Active Devices : 2
  Working Devices : 2
   Failed Devices : 0
    Spare Devices : 0
   Rebuild Status : 0% complete
             Name : foobar:0  (local to host foobar)
             UUID : 1234578:1234578:1234578:1234578
           Events : 1
      Number   Major   Minor   RaidDevice State
         0       8       33        0      active sync   /dev/sdc1
         1       8       49        1      active sync   /dev/sdd1

Next, you'll want to create a big partition on the RAID device (cfdisk details omitted)...

  $ cfdisk /dev/md0

...and then encrypt all the (future) data on the device using dm-crypt+LUKS and cryptsetup:

  $ cryptsetup --verbose --verify-passphrase luksFormat /dev/md0p1
  Enter your desired pasphrase here (twice)
  $ cryptsetup luksOpen /dev/md0p1 myraid

After opening the encrypted container with cryptsetup luksOpen you can create a filesystem on it (ext3 in my case):

  $ mkfs.ext3 -j -m 0 /dev/mapper/myraid

That's about it. In future you can access the RAID data by using the steps below.

Starting the RAID and mouting the drive:

  $ mdadm --assemble /dev/md0 /dev/sdc1 /dev/sdd1
  $ cryptsetup luksOpen /dev/md0p1 myraid
  $ mount -t ext3 /dev/mapper/myraid /mnt

Shutting down the RAID:

  $ umount /mnt
  $ cryptsetup luksClose myraid
  $ mdadm --stop /dev/md0

That's all. Performance is shitty due to all the data being shoved out over one USB cable (and USB itself being too slow for these amounts of data), but I don't care too much about that as this setup is meant for backups, not performance-critical stuff.

Update 04/2011: Thanks to Bohdan Zograf there's a Belorussian translation of this article now!

Comments

Comment viewing options

Select your preferred way to display the comments and click "Save settings" to activate your changes.

auto mount what to change in /etc/fstab and /etc/cryptab file

After reboot my auto-mounting of encrypted does not come up.

df -k
# df -k
Filesystem 1K-blocks Used Available Use% Mounted on
/dev/sda1 151780516 3026000 141044464 3% /
none 1016108 664 1015444 1% /dev
none 1025900 184 1025716 1% /dev/shm
none 1025900 116 1025784 1% /var/run
none 1025900 0 1025900 0% /var/lock
/dev/mapper/BACKUP 480716864 202664 475630384 1% /backup

But after reboot the /backup disappears.

/etc/fstab
/dev/mapper/BACKUP /backup ext4 defaults 1 2

/etc# more crypttab
#
backup /dev/mapper/BACKUP none luks

Please help.

Helped me building my own NAS

Very comprehensive page, thanks a lot!
I've planned to build my own NAS server with a beagle board (www.beagleboard.org) and I found all required informations here (using a 2.6.35 kernel on debian). Everything worked out of the box - surprisingly!

Alex.

tech

So much technical details and explanation of this thing is almost impossible to find somewhere else. I would like to say that you are really doing a great job, thanks for sharing it with us!

Partitions on RAID?

Hey,

just wondering, why do you create a single partition on the RAID and encrypt it afterwards? Couldn't you go with the plain "device" directly? (Same applies to the whole disks too, but there one is at least used to see a partition...)

Regards
Evgeni

Partitions on RAID

Hm, true. I didn't really think much about this. Using the plain /dev/sdc and /dev/sdd should work equally fine, yes.

Uwe.