Encrypting data partitions using LUKS
To encrypt a Linux partition using Linux Unified Key Setup (LUKS).
Install the cryptsetup-luks package. This package contains cryptsetup utility
used for setting up encrypted file systems. To install cryptsetup-luks, follow these
On RHEL or Cent OS, run:
# yum install cryptsetup-luks
On Ubuntu or Debian, run:
# apt-get install cryptsetup
Configure LUKS partition.
Get the list of all the partitions using following command:
# fdisk -l # blkid
Use the cryptsetup luksFormat command to set up the partition for
encryption. The example below uses the cryptsetup luksFormat command to encrypt
# cryptsetup -y -v luksFormat /dev/xvdcNote: The above command will remove all data on the partition that you are encrypting.
Create a logical device-mapper device, mounted to the LUKS-encrypted partition. In the example
backup2is the user given name of the mapping name for the opened LUKS partition.
# cryptsetup luksOpen /dev/xvdc backup2 Enter passphrase for /dev/xvdc:Note: This command initializes the volume, and sets an initial key or passphrase. Please note that the passphrase is not recoverable.
You can use the following command to view the mapping details:
# ls -l /dev/mapper/backup2 lrwxrwxrwx 1 root root 7 Oct 19 19:37 /dev/mapper/backup2 -> ../dm-0
You can use the following command to view the status of the mapping:
# cryptsetup -v status backup2 /dev/mapper/backup2 is active. type: LUKS1 cipher: aes-cbc-essiv:sha256 keysize: 256 bits device: /dev/xvdc offset: 4096 sectors size: 419426304 sectors mode: read/write Command successful.
Use the cryptsetup luksDump command to check that the device has been
formatted for encryption successfully:
# cryptsetup luksDump /dev/xvdc
- Get the list of all the partitions using following command:
Format LUKS partition.
Write zeros to the LUKS-encrypted partition using the following command:
# dd if=/dev/zero of=/dev/mapper/backup2This command will allocate block data with zeros. This ensures that outside world will see this as random data i.e. it protect against disclosure of usage patterns.Note: The dd command may take many hours to complete. It is recommended that you use pv command to monitor the progress:
# pv -tpreb /dev/zero | dd of=/dev/mapper/backup2 bs=128M
Format the new partition with your favorite file system. The following example used the ext4
# mkfs.ext4 /dev/mapper/backup2
Mount the new file system. The example below mounts the new file system at
# mkdir /backup2 # mount /dev/mapper/backup2 /backup2 # df -H # cd /backup2 # ls -l
- Write zeros to the LUKS-encrypted partition using the following command: