I'm trying to setup a partition and I'm trying to put the luks header on a USB device so I use the argument --header /path/to/usb-device, however I am still able to decrypt the device without the usb-device being mounted. How to stop cryptsetup from creating the luks header on the encrypted device ?
How to stop cryptsetup luksFormat from creating the luks header on the encrypted device?
luks;cryptsetup
You must have used a wrong command somewhere... cryptsetup does not wantonly create LUKS headers all over the place... it only does what you tell it to and it usually asks for confirmation before doing so.Example:# truncate -s 8M luksheader luksdevice# cryptsetup luksFormat --header luksheader luksdeviceWARNING!========This will overwrite data on luksheader irrevocably.Are you sure? (Type uppercase yes): YESEnter passphrase: Verify passphrase: # file -s luks*luksdevice: dataluksheader: LUKS encrypted file, ver 1 [aes, xts-plain64, sha256] UUID: As you can see, there is no LUKS header on the luksdevice afterwards. If there is one then it was already there before.You can also just luksFormat the external device/file directly without ever specifying the encrypted device (that only really matters on luksOpen).Simplified example:# cryptsetup luksFormat luksheaderThis is almost equivalent to the more complicated command above, the only difference is in the Payload offset you can see in luksDump. If the header was created as external header in the first place this offset should be 0,  otherwise it's something like 4096 (2 MiB) thereabouts.Any LUKS header works as external header if you so desire, and leaving the Payload offset intact has its advantages. If you ever decide to change your setup you could just put the external header back onto the original device (or vice versa, switch to external header for an existing device).