nbdkit-luks-filter(1)

📦
version 1.48.1 · 13 versions
, in fedora 44

nbdkit-luks-filter(1) 💖

okay bestie, pull up a chair because we're about to talk about the nbdkit-luks-filter manual page and honestly? it's giving unlocked ✨ (literally). this is a filter for nbdkit(1). iykyk. 💅

✨ NAME ✨

nbdkit-luks-filter — read and write LUKS-encrypted disks and partitions 🎀

🌸 SYNOPSIS 🌸

nbdkit file encrypted-disk.img --filter=luks passphrase=+/tmp/secret

💜 DESCRIPTION 💜

so "nbdkit-luks-filter" is a filter for nbdkit(1) and its whole main character job is transparently opening a LUKS-encrypted disk image. and LUKS? that stands for "Linux Unified Key Setup" and it's the Full Disk Encryption (FDE) system that Linux systems use all the time, no cap. this filter is compatible with LUKSv1 as implemented by the Linux kernel (dm_crypt), and by qemu. 🔥

you can put this filter on top of nbdkit-file-plugin(1) to decrypt a local file:

nbdkit file encrypted-disk.img --filter=luks passphrase=+/tmp/secret

if LUKS is chillin' inside a partition in the disk image then you're gonna have to combine this filter with nbdkit-partition-filter(1). and bestie, listen — the order of the filters is important:

nbdkit file encrypted-disk.img \
            --filter=luks passphrase=+/tmp/secret \
            --filter=partition partition=1

this filter also works on top of other plugins, like nbdkit-curl-plugin(1):

nbdkit curl https://example.com/encrypted-disk.img \
            --filter=luks passphrase=+/tmp/secret

the web server only ever sees the encrypted data. without knowing the passphrase, the web server cannot access the decrypted disk. only encrypted data is sent over the HTTP connection. but — and this is the part where you go 😭 — nbdkit itself will serve unencrypted disk data over the NBD connection. if that's a problem, see nbdkit-tls(1), or use a Unix domain socket with -U. 🙈

the passphrase can be stored in a file (like shown above), passed directly on the command line (insecure, bestie, please), entered interactively, or passed to nbdkit over a file descriptor. options options options, we love a flexible queen 👑

this filter can read and write LUKSv1. it cannot create disks, change passphrases, add keyslots, etc. for all that, you use ordinary Linux tools like cryptsetup(8). and note — you must force LUKSv1 (eg. using cryptsetup --type luks1). qemu-img(1) can also create compatible disk images:

qemu-img create -f luks \
                --object secret,data=SECRET,id=sec0 \
                -o key-secret=sec0 \
                encrypted-disk.img 1G

🎀 PARAMETERS 🎀

  • passphrase=SECRET — use the secret passphrase when decrypting the disk. ngl, passing this on the command line is not secure on shared machines. 💀
  • passphrase=- — ask for the passphrase (interactively) when nbdkit starts up. cute, private, we stan. 🫶
  • passphrase=+FILENAME — read the passphrase from the named file. this is a secure method to supply a passphrase, as long as you set the permissions on the file appropriately. bestie, chmod it. i'm begging. 🔐
  • passphrase=-FD — read the passphrase from file descriptor number FD, inherited from the parent process when nbdkit starts up. this is also a secure method to supply a passphrase. iconic. ⭐

🦋 FILES 🦋

  • $filterdir/nbdkit-luks-filter.so — the plugin. use nbdkit --dump-config to find the location of $filterdir. 🍓

💅 VERSION 💅

"nbdkit-luks-filter" first appeared in nbdkit 1.32. a baby. a legend. 👑

🌈 SEE ALSO 🌈

nbdkit-curl-plugin(1), nbdkit-file-plugin(1), nbdkit-ip-filter(1), nbdkit-partition-filter(1), nbdkit-xor-filter(1), nbdkit(1), nbdkit-tls(1), nbdkit-plugin(3), cryptsetup(8), qemu-img(1).

🌸 AUTHORS 🌸

Richard W.M. Jones 💖

Copyright Red Hat

💜 LICENSE 💜

redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:

  • redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. 📌
  • redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. 📌
  • neither the name of Red Hat nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission. 📌
THIS SOFTWARE IS PROVIDED BY RED HAT AND CONTRIBUTORS ''AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL RED HAT OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 💀 (yes that's the whole thing, read it, it matters)

and that's the whole page bestie!! 🥳 this one's from nbdkit 1.48.1, dated 2026-08-29 — stay encrypted, stay iconic, mwah 💋✨

📦 where this page comes from