Disk Encryption

Permissions and mount options protect a running system, but they are meaningless once the disk is out of the operating system’s hands. Pull the drive, plug it into another machine, and every file is readable regardless of its mode bits. Disk encryption closes that gap: without the key, the stored bytes are indistinguishable from noise. On Linux the standard mechanism is LUKS (Linux Unified Key Setup), a layer on top of the kernel’s dm-crypt that adds a header, multiple key slots, and metadata so the format is self-describing. This page sits alongside Mount Options (limiting what a filesystem allows) and Integrity Monitoring (detecting change), and covers a threat those two do not: loss of physical control.

What it does and does not protect against

Being precise about the threat boundary matters, because encryption is easy to over-trust.

Scenario	Protected?	Why
Laptop stolen while powered off	Yes	Key is not in memory; disk is ciphertext
Disk decommissioned, resold, or RMA’d	Yes	Data is unrecoverable without the passphrase
Attacker with root on the running system	No	The volume is already unlocked and mounted
Malware running under your account	No	It reads plaintext through the mounted filesystem
Machine seized while running (suspended)	No	The key lives in RAM and can be extracted

The rule of thumb: LUKS protects data at rest (powered off, disk detached). It does nothing for a live, unlocked system. That is exactly why you still need mount options and integrity monitoring.

LUKS key slots

A LUKS device has a header containing up to eight key slots. Each slot holds an encrypted copy of the single master key, unlockable by a different passphrase or key file. This is what lets you rotate a passphrase without re-encrypting the disk, or give a server both an interactive passphrase (slot 0) and a key file for automated unlock (slot 1). Erasing the header (or all slots) makes the data permanently unrecoverable, which is also the fastest way to securely wipe a disk.

Hands-on: encrypting a volume

On the lab VM, attach a spare disk or create a loop-backed file to practise on so you never touch the boot disk.

# Create a 512MB file and back it with a loop device
truncate -s 512M /tmp/luks.img
sudo losetup -f --show /tmp/luks.img

Expected output:

/dev/loop8

Format it as LUKS. luksFormat writes the header and creates the first key slot.

sudo cryptsetup luksFormat /dev/loop8

Expected output:

WARNING!
========
This will overwrite data on /dev/loop8 irrevocably.

Are you sure? (Type 'yes' in capital letters): YES
Enter passphrase for /dev/loop8:
Verify passphrase:

Open (unlock) the device, which creates a mapping under /dev/mapper, then make a filesystem and mount it.

sudo cryptsetup open /dev/loop8 securedata
sudo mkfs.ext4 /dev/mapper/securedata
sudo mkdir -p /mnt/secure && sudo mount /dev/mapper/securedata /mnt/secure
lsblk -o NAME,TYPE,MOUNTPOINT /dev/loop8

Expected output:

NAME          TYPE  MOUNTPOINT
loop8         loop
`-securedata  crypt /mnt/secure

Inspect the header to see slot usage.

sudo cryptsetup luksDump /dev/loop8 | grep -A1 Keyslots

Expected output:

Keyslots:
  0: luks2

Add a second passphrase (slot 1), then close the device when done.

sudo cryptsetup luksAddKey /dev/loop8       # prompts for existing then new passphrase
sudo umount /mnt/secure
sudo cryptsetup close securedata
sudo losetup -d /dev/loop8

Expected output:

Enter any existing passphrase:
Enter new passphrase for key slot:
Verify passphrase:

Encrypted volumes for specific data

You do not have to encrypt the whole disk to benefit. A dedicated encrypted volume for a database directory, backups, or a secrets store limits the blast radius and keeps the boot path simple. For unattended servers, store the key file on a separate protected medium and reference it in /etc/crypttab so the volume unlocks at boot without an interactive prompt. Full-disk encryption (including the root filesystem) is set up at install time on Ubuntu via the LVM-on-LUKS option and is the right default for laptops.

Practical Guidance

1. Encrypt any disk that could leave your physical control: laptops always, and any drive you intend to decommission, resell, or return under warranty.
2. Be clear that LUKS protects only powered-off or detached disks; a running unlocked system still needs mount options and integrity monitoring.
3. Back up the LUKS header (cryptsetup luksHeaderBackup) and store it separately, since a corrupted header renders the data unrecoverable.
4. Use separate key slots for passphrase rotation and for key-file automation rather than reusing one secret everywhere.
5. Practise the full create, open, mount, and close cycle on a loop device or spare disk before touching a real boot volume.
6. For quick secure erasure of an encrypted disk, destroy the header slots rather than overwriting every block.