How to check that an encrypted disk was previously open using cryptsetup? - shell

Question

I am writing a shell script (meant to work with Ubuntu only) that assumes that a disk has been previously open (using the command below) to make operations on it (resize2fs, lvcreate, ...). However, this might not always be the case, and when the disk is closed, the user of the script has to run this line before running the script, asking for his/her passphrase:
sudo cryptsetup luksOpen /dev/sdaX sdaX_crypt
Ideally, the script should start with this command, simplifying the user sequence. However, if the disk was indeed already opened, the script will fail because an encrypted disk cannot be opened twice.
How can I check if the disk was previously open? Is checking that /dev/mapper/sdX_crypt exists a valid solution / enough? If not or not possible, is there a way to make the command run only if necessary?

Answer 1

I'd also suggest lsblk - but since I came here to find some relevant info I did find and thought I'd post here the following command as well:
#: cryptsetup status <device> | grep -qi active
Cheers

Answer 2

You can use the lsblk command.
If the disk is already unlocked, it will display two lines: the device and the mapped device, where the mapped device should be of type crypt.
# lsblk -l -n /dev/sdaX
sdaX 253:11 0 2G 0 part
sdaX_crypt (dm-6) 253:11 0 2G 0 crypt
If the disk is not yet unlocked, it will only show the device.
# lsblk -l -n /dev/sdaX
sdaX 253:11 0 2G 0 part

Answer 3

Since I could not find a better solution, I went ahead and chose the "check if the device exists" one.
The encrypted disk embeds a specific Volume Group (called my-vg for the example), so my working solution is:
if [ ! -b /dev/my-vg ]; then
sudo cryptsetup luksOpen /dev/sdaX sdaX_crypt
fi
I check that /dev/my-vg exists instead of /dev/mapper/sda_cryptX because every other command in my script uses the first one as an argument so I kept it for consistency, but I reckon that this solution below looks more encapsulated:
if [ ! -b /dev/mapper/sdaX_crypt ]; then
sudo cryptsetup luksOpen /dev/sdaX sdaX_crypt
fi
Although the solution I described above works for me, is there a good reason I should switch to the latter one or it doesn't matter?

Answer 4

cryptsetup status volumeName
echo $? # Exit status should be 0 (success).
If you want to avoid displaying cryptsetup output, you can redirect it to /dev/null.
cryptsetup status volumeName > /dev/null
echo $? # Exit status should be 0 (success).
This is a snippet from a script I wrote last night to take daily snapshots.
DEVICE=/dev/sdx
HEADER=/root/luks/arch/sdx-header.img
KEY_FILE=/root/luks/arch/sdx-key.bin
VOLUME=luksHome
MOUNTPOINT=/home
SUBVOLUME=#home
# Ensure encrypted device is active.
cryptsetup status "${VOLUME}" > /dev/null
IS_ACTIVE=$?
while [[ $IS_ACTIVE -ne 0 ]]; do
printf "Volume '%s' does not seem to be active. Activate? [y/N]\n" $VOLUME
read -N 1 -r -s
if [[ $REPLY =~ ^[Yy]$ ]]; then
cryptsetup open --header="${HEADER}" --key-file="${KEY_FILE}" "${DEVICE}" "${VOLUME}"
IS_ACTIVE=$?
else
exit 0
fi
done