Configure Linux file encryption with LUKS and cryptsetup for data protection

#!/usr/bin/env bash

set -euo pipefail

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m' # No Color

# Script configuration
SCRIPT_NAME="$(basename "$0")"
DEVICE=""
MOUNT_POINT="/mnt/encrypted"
MAPPER_NAME="encrypted_data"
KEYFILE="/root/luks-keyfile"

# Usage function
usage() {
    echo "Usage: $SCRIPT_NAME <device>"
    echo "Example: $SCRIPT_NAME /dev/sdb1"
    echo ""
    echo "WARNING: ALL DATA ON THE TARGET DEVICE WILL BE DESTROYED"
    exit 1
}

# Logging functions
log_info() {
    echo -e "${GREEN}[INFO]${NC} $1"
}

log_warn() {
    echo -e "${YELLOW}[WARNING]${NC} $1"
}

log_error() {
    echo -e "${RED}[ERROR]${NC} $1" >&2
}

# Cleanup function for error handling
cleanup() {
    log_error "Installation failed. Performing cleanup..."
    if mountpoint -q "$MOUNT_POINT" 2>/dev/null; then
        umount "$MOUNT_POINT" || true
    fi
    if [ -e "/dev/mapper/$MAPPER_NAME" ]; then
        cryptsetup luksClose "$MAPPER_NAME" || true
    fi
    exit 1
}

# Set up error trap
trap cleanup ERR

# Check if running as root
if [ "$EUID" -ne 0 ]; then
    log_error "This script must be run as root"
    exit 1
fi

# Parse arguments
if [ $# -ne 1 ]; then
    usage
fi

DEVICE="$1"

# Validate device exists
if [ ! -b "$DEVICE" ]; then
    log_error "Device $DEVICE does not exist or is not a block device"
    exit 1
fi

# Auto-detect distribution
if [ -f /etc/os-release ]; then
    . /etc/os-release
    case "$ID" in
        ubuntu|debian)
            PKG_MGR="apt"
            PKG_UPDATE="apt update && apt upgrade -y"
            PKG_INSTALL="apt install -y"
            ;;
        almalinux|rocky|centos|rhel|ol|fedora)
            PKG_MGR="dnf"
            PKG_UPDATE="dnf update -y"
            PKG_INSTALL="dnf install -y"
            ;;
        amzn)
            PKG_MGR="yum"
            PKG_UPDATE="yum update -y"
            PKG_INSTALL="yum install -y"
            ;;
        *)
            log_error "Unsupported distribution: $ID"
            exit 1
            ;;
    esac
else
    log_error "Cannot detect distribution. /etc/os-release not found"
    exit 1
fi

log_warn "This will DESTROY ALL DATA on $DEVICE"
read -p "Type 'YES' to continue: " -r
if [ "$REPLY" != "YES" ]; then
    log_info "Operation cancelled"
    exit 0
fi

echo "[1/10] Updating system packages..."
$PKG_UPDATE

echo "[2/10] Installing LUKS encryption tools..."
case "$PKG_MGR" in
    apt)
        $PKG_INSTALL cryptsetup cryptsetup-bin
        ;;
    dnf|yum)
        $PKG_INSTALL cryptsetup util-linux
        ;;
esac

echo "[3/10] Checking if device is already encrypted..."
if cryptsetup isLuks "$DEVICE" 2>/dev/null; then
    log_warn "Device $DEVICE is already LUKS encrypted"
    read -p "Continue with existing encryption? (y/N): " -r
    if [[ ! $REPLY =~ ^[Yy]$ ]]; then
        exit 0
    fi
    ALREADY_ENCRYPTED=true
else
    ALREADY_ENCRYPTED=false
fi

if [ "$ALREADY_ENCRYPTED" = false ]; then
    echo "[4/10] Initializing LUKS encryption on $DEVICE..."
    log_warn "You will need to enter a strong passphrase"
    cryptsetup luksFormat "$DEVICE"
else
    echo "[4/10] Skipping LUKS format (already encrypted)"
fi

echo "[5/10] Opening encrypted volume..."
log_info "Enter the passphrase for $DEVICE"
cryptsetup luksOpen "$DEVICE" "$MAPPER_NAME"

if [ "$ALREADY_ENCRYPTED" = false ]; then
    echo "[6/10] Creating ext4 filesystem on encrypted volume..."
    mkfs.ext4 "/dev/mapper/$MAPPER_NAME"
else
    echo "[6/10] Skipping filesystem creation (already exists)"
fi

echo "[7/10] Creating mount point and mounting encrypted volume..."
mkdir -p "$MOUNT_POINT"
mount "/dev/mapper/$MAPPER_NAME" "$MOUNT_POINT"

# Set proper ownership and permissions
chown root:root "$MOUNT_POINT"
chmod 755 "$MOUNT_POINT"

echo "[8/10] Creating keyfile for automated mounting..."
if [ ! -f "$KEYFILE" ]; then
    dd if=/dev/urandom of="$KEYFILE" bs=1024 count=4
    chmod 600 "$KEYFILE"
    log_info "Adding keyfile to LUKS header..."
    cryptsetup luksAddKey "$DEVICE" "$KEYFILE"
else
    log_warn "Keyfile already exists at $KEYFILE"
fi

echo "[9/10] Configuring automatic mounting..."
# Configure crypttab
CRYPTTAB_ENTRY="$MAPPER_NAME $DEVICE $KEYFILE luks"
if ! grep -q "^$MAPPER_NAME " /etc/crypttab 2>/dev/null; then
    echo "$CRYPTTAB_ENTRY" >> /etc/crypttab
    log_info "Added entry to /etc/crypttab"
else
    log_warn "Entry already exists in /etc/crypttab"
fi

# Configure fstab
FSTAB_ENTRY="/dev/mapper/$MAPPER_NAME $MOUNT_POINT ext4 defaults 0 2"
if ! grep -q "^/dev/mapper/$MAPPER_NAME " /etc/fstab; then
    echo "$FSTAB_ENTRY" >> /etc/fstab
    log_info "Added entry to /etc/fstab"
else
    log_warn "Entry already exists in /etc/fstab"
fi

echo "[10/10] Verifying installation..."
# Test that the encrypted volume is working
if mountpoint -q "$MOUNT_POINT"; then
    log_info "✓ Encrypted volume is mounted at $MOUNT_POINT"
else
    log_error "✗ Mount verification failed"
    exit 1
fi

# Test write permissions
TEST_FILE="$MOUNT_POINT/test_write"
if echo "test" > "$TEST_FILE" 2>/dev/null && [ -f "$TEST_FILE" ]; then
    rm -f "$TEST_FILE"
    log_info "✓ Write test successful"
else
    log_error "✗ Write test failed"
    exit 1
fi

# Verify LUKS header
if cryptsetup luksDump "$DEVICE" > /dev/null 2>&1; then
    log_info "✓ LUKS header is valid"
else
    log_error "✗ LUKS header verification failed"
    exit 1
fi

# Clear trap since we completed successfully
trap - ERR

log_info "LUKS encryption setup completed successfully!"
log_info "Device: $DEVICE"
log_info "Mount point: $MOUNT_POINT"
log_info "Mapper name: $MAPPER_NAME"
log_info "Keyfile: $KEYFILE"
log_warn "IMPORTANT: Backup your LUKS header with: cryptsetup luksHeaderBackup $DEVICE --header-backup-file luks-header-backup"
log_warn "Store the backup in a secure location separate from the encrypted device"