When scripting virtual machine provisioning for test environments, we often need to automate LUKS encrypted volume creation without manual passphrase entry. The standard cryptsetup luksFormat command expects interactive passphrase input, which breaks automation workflows.

There are three reliable methods to supply passphrases non-interactively:

# Method 1: Using --key-file with echo
echo -n "mysecurepassphrase" | cryptsetup luksFormat /dev/sdb1 --key-file=-

# Method 2: Using process substitution
cryptsetup luksFormat /dev/sdb1 <(echo -n "mysecurepassphrase")

# Method 3: Using a temporary file (least secure but useful in some cases)
echo -n "mysecurepassphrase" > /tmp/luks.key
cryptsetup luksFormat /dev/sdb1 --key-file=/tmp/luks.key
rm -f /tmp/luks.key

Here's a complete bash function for secure passphrase handling:

function setup_luks_volume() {
    local device=$1
    local passphrase=$2

    # Validate inputs
    [[ -b "$device" ]] || { echo "Invalid block device"; return 1; }
    [[ -z "$passphrase" ]] && { echo "Empty passphrase"; return 1; }

    # Format with LUKS using the passphrase
    if ! echo -n "$passphrase" | cryptsetup luksFormat "$device" --key-file=- --batch-mode; then
        echo "LUKS formatting failed" >&2
        return 1
    fi

    # Additional setup steps...
    echo "Successfully created LUKS volume on $device"
}

# Usage example:
setup_luks_volume "/dev/sdb1" "testvm_passphrase_123"

While these methods work, remember:

• Command-line arguments may appear in process listings
• Shell history might store sensitive commands
• For production, consider using keyfiles instead of passphrases
• Always clean up temporary files immediately

For complex automation, Python provides better control over subprocesses:

import subprocess

def luks_format(device, passphrase):
    try:
        proc = subprocess.Popen(
            ['cryptsetup', 'luksFormat', device, '--key-file=-'],
            stdin=subprocess.PIPE,
            stdout=subprocess.PIPE,
            stderr=subprocess.PIPE
        )
        proc.communicate(input=passphrase.encode())
        if proc.returncode != 0:
            raise RuntimeError("LUKS format failed")
    except Exception as e:
        print(f"Error: {str(e)}")
        return False
    return True

When automating virtual machine provisioning for testing environments, we often need to configure encrypted storage without user interaction. The standard cryptsetup luksFormat command expects interactive passphrase input, which breaks automation workflows.

The most reliable method involves passing the passphrase through a temporary key file:

# Create a temporary file with your passphrase
echo -n "my_test_passphrase" > /tmp/luks_key

# Format the partition non-interactively
cryptsetup luksFormat /dev/sdX --key-file /tmp/luks_key

# Securely remove the temporary file
shred -u /tmp/luks_key

For simpler scripts, you can pipe the passphrase directly:

echo -n "my_test_passphrase" | cryptsetup luksFormat /dev/sdX -

Note: This method might show the passphrase in process lists temporarily.

Here's a more robust implementation with error handling:

#!/bin/bash

DEVICE="/dev/sdb1"
PASSPHRASE="test_vm_encryption_key"

# Validate device exists
if [ ! -b "$DEVICE" ]; then
    echo "Error: Device $DEVICE not found" >&2
    exit 1
fi

# Create temporary key file safely
TMP_KEY=$(mktemp)
trap 'rm -f "$TMP_KEY"' EXIT
echo -n "$PASSPHRASE" > "$TMP_KEY"

# Format LUKS partition
if ! cryptsetup luksFormat "$DEVICE" --key-file "$TMP_KEY"; then
    echo "LUKS formatting failed" >&2
    exit 1
fi

echo "Successfully formatted $DEVICE with LUKS encryption"

While this approach works well for test environments, consider these precautions for production:

• Use mktemp for secure temporary file creation
• Set strict permissions on temporary files (600)
• Clean up sensitive data immediately after use
• Consider using keyfiles instead of passphrases for automation

If you encounter problems:

• Verify the passphrase doesn't contain trailing newlines
• Check device permissions (run as root)
• Ensure cryptsetup version supports --key-file with passphrases
• Test with simple passphrases first