Implement Linux file system encryption with LUKS and cryptsetup

#!/usr/bin/env bash

set -euo pipefail

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m' # No Color

# Global variables
DEVICE=""
MOUNT_POINT="/mnt/secure"
MAPPER_NAME="secure_storage"
KEYFILE_PATH="/root/luks-keyfile"

# Usage function
usage() {
    echo "Usage: $0 <device>"
    echo "Example: $0 /dev/sdb1"
    echo ""
    echo "This script sets up LUKS encryption on the specified device."
    echo "WARNING: This will destroy all data on the target device!"
    exit 1
}

# Logging functions
log_info() { echo -e "${GREEN}[INFO]${NC} $1"; }
log_warn() { echo -e "${YELLOW}[WARN]${NC} $1"; }
log_error() { echo -e "${RED}[ERROR]${NC} $1"; }

# Cleanup function for rollback
cleanup() {
    log_error "Script failed. Cleaning up..."
    if mountpoint -q "$MOUNT_POINT" 2>/dev/null; then
        umount "$MOUNT_POINT" 2>/dev/null || true
    fi
    if [ -e "/dev/mapper/$MAPPER_NAME" ]; then
        cryptsetup luksClose "$MAPPER_NAME" 2>/dev/null || true
    fi
    if [ -f "$KEYFILE_PATH" ]; then
        rm -f "$KEYFILE_PATH" 2>/dev/null || true
    fi
    exit 1
}

trap cleanup ERR

# Check if running as root
check_root() {
    if [ "$EUID" -ne 0 ]; then
        log_error "This script must be run as root"
        exit 1
    fi
}

# Detect distribution and package manager
detect_distro() {
    if [ -f /etc/os-release ]; then
        . /etc/os-release
        case "$ID" in
            ubuntu|debian) 
                PKG_MGR="apt"
                PKG_INSTALL="apt install -y"
                PKG_UPDATE="apt update"
                ;;
            almalinux|rocky|centos|rhel|ol|fedora) 
                PKG_MGR="dnf"
                PKG_INSTALL="dnf install -y"
                PKG_UPDATE="dnf check-update || true"
                ;;
            amzn) 
                PKG_MGR="yum"
                PKG_INSTALL="yum install -y"
                PKG_UPDATE="yum check-update || true"
                ;;
            *) 
                log_error "Unsupported distribution: $ID"
                exit 1
                ;;
        esac
    else
        log_error "Cannot detect distribution"
        exit 1
    fi
    log_info "Detected distribution: $ID"
}

# Validate device
validate_device() {
    if [ ! -b "$DEVICE" ]; then
        log_error "Device $DEVICE does not exist or is not a block device"
        exit 1
    fi
    
    # Check if device is mounted
    if mount | grep -q "^$DEVICE"; then
        log_error "Device $DEVICE is currently mounted. Please unmount it first."
        exit 1
    fi
    
    log_warn "WARNING: This will permanently destroy all data on $DEVICE"
    read -p "Type 'YES' to continue: " confirm
    if [ "$confirm" != "YES" ]; then
        log_error "Operation cancelled"
        exit 1
    fi
}

# Install required packages
install_packages() {
    echo "[1/8] Installing cryptsetup packages..."
    
    $PKG_UPDATE
    
    case "$PKG_MGR" in
        apt)
            $PKG_INSTALL cryptsetup cryptsetup-bin
            ;;
        dnf|yum)
            $PKG_INSTALL cryptsetup
            ;;
    esac
    
    log_info "Cryptsetup installed successfully"
}

# Initialize LUKS encryption
setup_luks() {
    echo "[2/8] Setting up LUKS encryption on $DEVICE..."
    
    log_warn "You will be prompted to enter a passphrase for encryption"
    cryptsetup luksFormat "$DEVICE"
    
    log_info "LUKS encryption initialized successfully"
}

# Open encrypted volume
open_volume() {
    echo "[3/8] Opening encrypted volume..."
    
    cryptsetup luksOpen "$DEVICE" "$MAPPER_NAME"
    
    if [ ! -e "/dev/mapper/$MAPPER_NAME" ]; then
        log_error "Failed to open encrypted volume"
        exit 1
    fi
    
    log_info "Encrypted volume opened as /dev/mapper/$MAPPER_NAME"
}

# Create filesystem
create_filesystem() {
    echo "[4/8] Creating ext4 filesystem..."
    
    mkfs.ext4 -L "encrypted_data" "/dev/mapper/$MAPPER_NAME"
    
    log_info "Filesystem created successfully"
}

# Mount filesystem
mount_filesystem() {
    echo "[5/8] Mounting encrypted filesystem..."
    
    mkdir -p "$MOUNT_POINT"
    mount "/dev/mapper/$MAPPER_NAME" "$MOUNT_POINT"
    
    # Set proper ownership and permissions
    chown root:root "$MOUNT_POINT"
    chmod 755 "$MOUNT_POINT"
    
    log_info "Filesystem mounted at $MOUNT_POINT"
}

# Setup keyfile for automatic unlocking
setup_keyfile() {
    echo "[6/8] Setting up keyfile for automatic unlocking..."
    
    # Generate keyfile
    dd if=/dev/urandom of="$KEYFILE_PATH" bs=1024 count=4
    chmod 600 "$KEYFILE_PATH"
    chown root:root "$KEYFILE_PATH"
    
    log_warn "You will be prompted for the LUKS passphrase to add the keyfile"
    cryptsetup luksAddKey "$DEVICE" "$KEYFILE_PATH"
    
    log_info "Keyfile created and added to LUKS header"
}

# Configure automatic mounting
configure_automount() {
    echo "[7/8] Configuring automatic mounting..."
    
    # Add to crypttab
    if ! grep -q "$MAPPER_NAME" /etc/crypttab 2>/dev/null; then
        echo "$MAPPER_NAME $DEVICE $KEYFILE_PATH luks" >> /etc/crypttab
        log_info "Added entry to /etc/crypttab"
    fi
    
    # Add to fstab
    if ! grep -q "/dev/mapper/$MAPPER_NAME" /etc/fstab; then
        echo "/dev/mapper/$MAPPER_NAME $MOUNT_POINT ext4 defaults,noatime 0 2" >> /etc/fstab
        log_info "Added entry to /etc/fstab"
    fi
    
    log_info "Automatic mounting configured"
}

# Verify installation
verify_setup() {
    echo "[8/8] Verifying LUKS setup..."
    
    # Check LUKS status
    if cryptsetup status "$MAPPER_NAME" | grep -q "is active"; then
        log_info "✓ Encrypted volume is active"
    else
        log_error "✗ Encrypted volume is not active"
        return 1
    fi
    
    # Check mount
    if mountpoint -q "$MOUNT_POINT"; then
        log_info "✓ Filesystem is mounted"
    else
        log_error "✗ Filesystem is not mounted"
        return 1
    fi
    
    # Check keyfile permissions
    if [ -f "$KEYFILE_PATH" ] && [ "$(stat -c %a "$KEYFILE_PATH")" = "600" ]; then
        log_info "✓ Keyfile has correct permissions"
    else
        log_error "✗ Keyfile permissions incorrect"
        return 1
    fi
    
    # Test write access
    if touch "$MOUNT_POINT/test_file" 2>/dev/null; then
        rm -f "$MOUNT_POINT/test_file"
        log_info "✓ Write access confirmed"
    else
        log_error "✗ Cannot write to encrypted filesystem"
        return 1
    fi
    
    log_info "LUKS encryption setup completed successfully!"
    echo ""
    echo "Summary:"
    echo "- Encrypted device: $DEVICE"
    echo "- Mount point: $MOUNT_POINT" 
    echo "- Mapper device: /dev/mapper/$MAPPER_NAME"
    echo "- Keyfile: $KEYFILE_PATH"
    echo ""
    echo "The encrypted volume will automatically mount on boot."
    echo "Keep your passphrase safe as backup access method!"
}

# Main execution
main() {
    if [ $# -ne 1 ]; then
        usage
    fi
    
    DEVICE="$1"
    
    check_root
    detect_distro
    validate_device
    install_packages
    setup_luks
    open_volume
    create_filesystem
    mount_filesystem
    setup_keyfile
    configure_automount
    verify_setup
}

main "$@"