From Gentoo Linux Wiki

[edit] Introduction

This howto will show you the steps to install Truecrypt, an open-source cross-platform software that allows you to manage encrypted disks. Main features are:

• creation of virtual encrypted disks
• encryption of entire partitions
• two different security levels available:
  • hidden volume (see the official website for details)
  • normal volume

[edit] Requirements

Truecrypt needs a 2.6.5 kernel (or higher/compatible) with both device mapper and loop device enabled. Make sure that the kernel is configured as follows:

Device Drivers --> Multi-device support (RAID and LVM)  --->
 [*] Multiple devices driver support (RAID and LVM)
  <*> Device mapper support
  <*> Crypt target support

Device Drivers --> Block Devices -->
 <*> Loopback device support

Next, recompile and reboot into the new kernel (or just install the new modules if you marked all as modules).

[edit] Install

To install truecrypt just type as root: emerge -av truecrypt.

[edit] Usage

[edit] Configure a secure volume

Simply follow the truecrypt assistant:

# truecrypt -c

Create a linux filesystem on your volume (ext2 used as an example):

# truecrypt -N 1 /path/to/created/volume
# export MKE2FS_SYNC=1
# mkfs.ext2 /dev/mapper/truecrypt1
# truecrypt -d /path/to/created/volume

Mount your volume, this will ask for the password:

# truecrypt /path/to/created/volume /mnt/mountpoint

You can also set the mount options, for example to set the ownership to a specific user/group:

# truecrypt /path/to/created/volume /mnt/mountpoint -M uid=joe,gid=users

Unmount the volume (-d parameter without any other argument will dismount any mounted volume):

# truecrypt -d /path/to/created/volume

or:

# truecrypt -d /mnt/mountpoint

[edit] Mount volumes as a normal user

Truecrypt needs root privileges to work: this procedure will allow normal users to use it, also giving writing permissions to mounted volumes.

First of all, you must have sudo installed. If not, just type:

# emerge app-admin/sudo

Now we have to create a new group called truecrypt and give it the necessary permissions. Any users that will belong to that group, will be able to use truecrypt.

# groupadd truecrypt
# visudo

Use the just opened editor to attach the following lines at the bottom of the configuration file:

# Users in the truecrypt group are allowed to run truecrypt as root.
%truecrypt ALL=(root) NOPASSWD:/usr/bin/truecrypt

Before adding our users to the truecrypt group we still have to do something in order to make mounted volumes writable from normal users. To do this just open the system-wide bashrc file:

# nano /etc/bash/bashrc

And add this few lines to it:

alias tc='sudo truecrypt'
alias tcm='tc -M uid=$(id -u),gid=$(id -g)'

You can now add your users to the truecrypt group:

# gpasswd -a USER_1 truecrypt
# gpasswd -a USER_2 truecrypt
...

Use the tc alias to generically use truecrypt, (i.e. tc -d [volume] if you want to dismount a volume) and tcm to mount an encrypted volume.

# truecrypt /dev/volume_name /mnt/mount_point
# chown user_name /mnt/mount_point/
# chgrp group_name /mnt/mount_point/

[edit] Tips

If the transfer speeds are low, try using the noatime option on mount

# truecrypt /dev/volume_name  /mnt/mount_point  -M noatime

Assuming you have set up NTFS-3G, to read-write to an NTFS formatted truecrypt encrypted drive use the filesystem option

# truecrypt --filesystem ntfs-3g /dev/volume_name  /mnt/mount_point

[edit] Safely unmount and unmap truecrypt volumes on shutdown

add this lines to

/usr/bin/truecrypt -d

[edit] Mount TrueCrypt volume via fstab

Create the following file in /sbin

#!/bin/sh

OPTIONS="`echo $* |  sed 's/-o /--fs-options=/g'`"

sudo truecrypt $OPTIONS

Then you can mount your truecrypt device via the following line in fstab

/dev/sdb3 /daten          truecrypt defaults,noauto,user        0       2

By adding

Defaults env_keep=DISPLAY
Defaults env_keep+=XAUTHORITY

# Reset environment by default
Defaults        env_reset

when running visudo you also get graphical feedback in truecrypt-5.1a

[edit] Troubleshooting

If TrueCrypt gives you an error when mounting a NTFS encrypted volume even though ntfs-3g is installed that the module ntfs was not found, you need to specify the file system manually: truecrypt --filesystem=ntfs-3g volume /mnt/mountpoint.

[edit] See also

Internal references:

• Kernel

External:

• Truecrypt home page
• SUDO Main Page
• HOWTO Truecrypt - Italian translation