Name

       pmt-ehd - create an encrypted disk image

Syntax

       pmt-ehd  [-DFx] [-c fscipher] [-h hash] [-k fscipher_keybits] [-t fstype] [-H header_path]
       -f container_path -s size_in_mb

Options

       Mandatory options that are absent are inquired interactively, and  pmt-ehd  will  exit  if
       stdin is not a terminal.

       -D     Turn on debugging strings.

       -F     Force  operation that would otherwise ask for interactive confirmation. Multiple -F
              can be specified to apply more force.

       -c cipher
              The  cipher  to  be  used  for  the  filesystem.  This  can  take  any  value  that
              cryptsetup(8)   recognizes,   usually   in   the  form  of  "cipher-mode[-extras]".
              Recommended are aes-cbc-essiv:sha256 (this is the default) or aes-xts-essiv:sha256.

       -f path
              Store the new disk image at path. If the file already exists, pmt-ehd  will  prompt
              before  overwriting  unless  -F is given. If path refers to a symlink, pmt-ehd will
              act even more cautious.

       -H path
              Store a detached (separate) metadata file with a new LUKS header at  path.  If  the
              file already exists, pmt-ehd will prompt before overwriting unless -F is given.  If
              path refers to a symlink, pmt-ehd will act even more cautious. The  default  is  to
              not use a detached header. Correlates with the `cryptsetup --header` option.

       -h hash
              Message  digest/hash  used  for  key derivation in the PBKDF2 stage. The default is
              sha512.

       -i cipher
              (This option had been removed in pam_mount/pmt_ehd 2.11.)

       -k keybits
              The keysize for the  cipher  specified  with  -c.  Some  ciphers  support  multiple
              keysizes,  AES  for  example  is  available with at least the keysizes 192 and 256.
              Defaults to 256 (to match aes-cbc-essiv). Note that XTS uses two  keys,  but  drawn
              from  the  same key material, so aes-cbc-256 is equivalent to aes-xts-512, and aes-
              cbc-128 is to aes-xts-256.

       -p path
              (This option had been removed in pam_mount/pmt_ehd 2.11.)

       -s size
              The initial size of the encrypted filesystem, in megabytes. This option is  ignored
              when the filesystem is created on a block device.

       -t fstype
              Filesystem to use for the encrypted filesystem. Defaults to xfs.

       -u user
              Give  the container and fskey files to user (because the program is usually runs as
              root, and the files would otherwise retain root ownership).

       -x     Do not initialize the container with random bytes. This may impact secrecy.

   Description
       pmt-ehd can be used to create a new encrypted container, and replaces the  previous  mkehd
       script  as  well as any HOWTOs that explain how to do it manually.  Without any arguments,
       pmt-ehd will interactively ask for all missing parameters. To create a  container  with  a
       size of 256 MB, use:

       pmt-ehd -f /home/user.cont -s 256