LOSETUP(8) MAINTENANCE COMMANDS LOSETUP(8) NAME losetup - set up and control loop devices SYNOPSIS losetup [ -e encryption ] [options] loop_device file losetup -F [options] loop_device [file] losetup [ -d ] loop_device losetup -a DESCRIPTION losetup is used to associate loop devices with regular files or block devices, to detach loop devices and to query the status of a loop device. If only the loop_device argument is given, the status of the corresponding loop device is shown. OPTIONS -a Show status of all loop devices. -C itercountk Runs hashed password through itercountk thousand iterations of AES-256 before using it for loop encryption. This consumes lots of CPU cycles at loop setup/mount time but not thereafter. In combi­ nation with password seed this slows down dictio­ nary attacks. Iteration is not done in multi-key mode. -d Detach the file or device associated with the spec­ ified loop device. -e encryption Enable data encryption. Following encryption types are recognized: NONE Use no encryption (default). XOR Use a simple XOR encryption. AES128 AES Use 128 bit AES encryption. Password is hashed with SHA-256 by default. AES192 Use 192 bit AES encryption. Password is hashed with SHA-384 by default. AES256 Use 256 bit AES encryption. Password is hashed with SHA-512 by default. twofish128 twofish160 twofish192 twofish256 blowfish128 blowfish160 blowfish192 blowfish256 serpent128 serpent192 serpent256 mars128 mars192 mars256 rc6-128 rc6-192 rc6-256 tripleDES These encryption types are available if they are enabled in kernel configuration or cor­ responding modules have been loaded to ker­ nel. -F Reads and uses mount options from /etc/fstab that match specified loop device, including offset= sizelimit= encryption= pseed= phash= loinit= gpgkey= gpghome= itercountk= and looped to device/file name. loop= option in /etc/fstab must match specified loop device name. Command line options take precedence in case of conflict. -G gpghome Set gpg home directory to gpghome, so that gpg uses public/private keys on gpghome directory. This is only used when gpgkey file needs to be decrypted using public/private keys. If gpgkey file is encrypted with symmetric cipher only, public/pri­ vate keys are not required and this option has no effect. -H phash Uses phash function to hash password. Available hash functions are sha256, sha384, sha512 and rmd160. unhashed1 and unhashed2 functions also exist for compatibility with some ancient implemen­ tations. -I loinit Passes a numeric value of loinit as a parameter to cipher transfer function. Cipher transfer functions are free to interpret value as they want. -K gpgkey Password is piped to gpg so that gpg can decrypt file gpgkey which contains the real keys that are used to encrypt loop device. If decryption requires public/private keys and gpghome is not specified, all users use their own gpg public/private keys to decrypt gpgkey. Decrypted gpgkey should contain either 1 or 64 keys, each key at least 20 charac­ ters and separated by newline. If decrypted gpgkey contains 64 keys, then loop device is put to multi- key mode. In multi-key mode first key is used for first sector, second key for second sector, and so on. -o offset The data start is moved offset bytes into the spec­ ified file or device. Normally offset is included in IV (initialization vector) computations. If off­ set is prefixed with @ character, then offset is not included in IV computations. @ prefix function­ ality may not be supported on some older kernels and/or loop drivers. -p passwdfd Read the passphrase from file descriptor passwdfd instead of the terminal. -r Read-only mode. -s sizelimit Size of loop device is limited to sizelimit bytes. If unspecified or set to zero, loop device size is set to maximum available (file size minus offset). This option may not be supported on some older ker­ nels and/or loop drivers. -S pseed Sets encryption password seed pseed which is appended to user supplied password before hashing. Using different seeds for different partitions makes dictionary attacks slower but does not pre­ vent them if user supplied password is guessable. Seed is not used in multi-key mode. -t timeout make the password prompt time out after timeout seconds have passed by. -T Asks password twice. -v Verbose mode. RETURN VALUE losetup returns 0 on success, nonzero on failure. When losetup displays the status of a loop device, it returns 1 if the device is not configured and 2 if an error occurred which prevented losetup from determining the status of the device. FILES /dev/loop0,/dev/loop1,... loop devices (major=7) EXAMPLE The following commands can be used as an example of using the loop device. dd if=/dev/zero of=/file bs=1k count=100 losetup -e AES128 /dev/loop0 /file Password: mkfs -t ext2 /dev/loop0 100 mount -t ext2 /dev/loop0 /mnt ... umount /dev/loop0 losetup -d /dev/loop0 RESTRICTION XOR encryption is terribly weak. AUTHORS Original version: Theodore Ts'o AES support: Jari Ruusu Linux 2003-11-21 LOSETUP(8)