pmt-ehd(8)

💖 pmt-ehd — the pmt-ehd(8) era 💖

okay bestie, sit down, we're making an encrypted disk image and it's gonna be so cute. this is a page from the pam_mount</> manual set, and it's about to be your new fave 🫶

✨ Name ✨

pmt-ehd — create an encrypted disk image 🔐💅

✨ Syntax ✨

pmt-ehd [-DFx] [-c fscipher] [-h hash] [-k fscipher_keybits] [-t fstype]
[-H header_path] -f container_path -s size_in_mb

✨ Options ✨

so here's the tea ☕: any mandatory option you forget? it gets asked interactively. but if stdin is not a terminal, pmt-ehd just dips and exits. no vibes, no questions. 😭

• -D — turn on debugging strings. lil peek behind the curtain for when you need to see what's actually going on 🔍
• -F — force an operation that would otherwise hit you with an interactive confirmation. and like, you can stack multiple -Fs to apply more force 💪 (yes, that's real, more -F = more force)
• -c cipher — the cipher for the filesystem, bestie. this takes any value cryptsetup(8) recognizes, usually shaped like "cipher-mode[-extras]". the recommended ones are aes-cbc-essiv:sha256 (this is the default ✨) or aes-xts-essiv:sha256.
• -f path — store the new disk image at path. if that file already exists, pmt-ehd will prompt before overwriting, unless you gave it -F. and if path is a symlink? it gets even more cautious 👀 act accordingly.
• -H path — store a detached (separate) metadata file with a new LUKS header at path. same deal: if the file exists it prompts before overwriting unless -F is given, and a symlink makes it extra cautious again. default is to not use a detached header. this one correlates with the cryptsetup --header option 🔗
• -h hash — the message digest/hash used for key derivation in the PBKDF2 stage. default is sha512.
• -i cipher — (this option had been removed in pam_mount/pmt_ehd 2.11.) rip bozo 💀
• -k keybits — the keysize for the cipher you picked with -c. some ciphers support multiple keysizes — AES for example comes in at least the keysizes 192 and 256. defaults to 256 (to match aes-cbc-essiv). and note this, it's a whole thing: XTS uses two keys, but they're drawn from the same key material, so aes-cbc-256 is equivalent to aes-xts-512, and aes-cbc-128 is to aes-xts-256. math ate 💅
• -p path — (this option had been removed in pam_mount/pmt_ehd 2.11.) also rip 💀
• -s size — the initial size of the encrypted filesystem, in megabytes. heads up: this option is ignored when the filesystem is created on a block device. 📏
• -t fstype — the filesystem to use for the encrypted filesystem. defaults to xfs. 🗂️
• -u user — give the container and fskey files to user. why? because the program is usually run as root, and without this the files would otherwise keep root ownership. sharing is caring 🫶
• -x — do not initialize the container with random bytes. ⚠️ this may impact secrecy. like, actually. be careful.

✨ Description ✨

pmt-ehd can be used to create a new encrypted container, and it replaces the previous mkehd script as well as any HOWTOs that explain how to do it manually. so iconic of it, honestly 👑

without any arguments, pmt-ehd will interactively ask for all missing parameters. no thoughts, just questions 🎀

to create a container with a size of 256 MB, use:

pmt-ehd -f /home/user.cont -s 256

and that's the whole page, bestie 🦋 this one's from the pam_mount</> fam, dated 2011-Aug-05 — yeah she's a vintage queen and she still slays ✨💖 periodt.