In a LINK-TO-LUKS-ARTICLE[previous article], I demonstrated how to implement full-drive encryption on Linux with LUKS and the `cryptsetup` command.
While encrypting a whole drive is useful in many cases, there are many reasons you might not want to encode an entire drive.
For instance, you might require a drive to work across several platforms, some of which may not have LUKS integration.
Furthermore, it's the 21st century, the Cloud exists, and you may not be using a physical drive for all of your data.
Several years ago, there was a system called Truecrypt that allowed users to create encrypted file "vaults", which could be decrypted by Truecrypt to provide read and write access.
It was a useful technique, and provided, essentially, a virtual portable and fully-encrypted drive where you could store important data.
Truecrypt closed down, but it serves as an interesting model.
LUKS is a flexible system, fortunately.
You can use LUKS and `cryptsetup` to create an encrypted vault as a self-contained file, which you can save on a physical drive or in cloud storage.
== 1. Create an empty file
First, you must create an empty file of a predetermined size.
This serves as a kind of vault or safe in which you can store other files.
The command you use for this is `fallocate`, from the *util-linux* package:
If you don't need it for anything right now, you can close it:
[source,bash]
----
$ sudo cryptsetup close myvault
----
== How to use your encrypted vault
Now that it's all set up, you can use your encrypted file vault whenever you need to store or access private data.
To access your vault, you must mount it as a usable file system:
[source,bash]
----
$ sudo cryptsetup open \
--type luks vaultfile.img myvault
$ ls /dev/mapper
myvault
$ sudo mkdir /myvault
$ sudo mount /dev/mapper/myvault /myvault
----
In this example, I open the vault with `cryptsetup`, and then mount the vault from `/dev/mapper` to a new directory called `/myvault`.
As with any volume on Linux, you can mount the LUKS volume anywhere you want, so instead of `/myvault` you can use `/mnt` or `~/myvault` or whatever you prefer.
While it's mounted, your LUKS volume is decrypted.
You can read and write files to it just as if it itself were a physical drive.
When you're finished using your encrypted vault, unmount and close it:
The image file you encrypt with LUKS is as portable as any other file, so you can store your vault on your hard drive, or an external drive, or even on the Internet.
As long as you have LUKS available, you can decrypt, mount, and use it to keep your data safe.
It's easy encryption for improved data safety, so give it a try.
