How to Encrypt Your File System with LUKS

 

Security and privacy are two very important subjects, and everyone of us, in a way or another, has sensitive data stored on his computer. While you can consider pretty safe your data on a home computer, on a laptop the situation is a lot different. You carry the notebook with you (that’s it’s purpose after all) and you don’t want to loose all your precious data in case it got stolen or lost for example. Here is where system encryption comes in. In this article i will show you how to full encrypt your system using two linux native tools: lvm (for partitioning) and luks (for the actual encryption). At this point you could ask why to use the command line to create this kind of setup when most of the distros installer could do it for us. Well that’s not completely true because usually the graphical installers don’t allow you to fine tune your settings (for example the type of cipher or key size you want to use), plus they don’t let you encrypt your raw disk without creating a partition table on it. Even if you don’t have these needs, it’s anyhow interesting to know how things works under the hood.  (LINUX.COM)

Prerequisites

• Linux Server
• Package "cryptsetup.x86_64" should be install on the server

yum install cryptsetup.x86_64 

• Separate disk disk for Encryption 

Procedure

Step 01: Format Partition with Luks Format

cryptsetup luksFormat /dev/sdb1

 

Note: You must to put strong password 

Step 02: Open Luks Drive

cryptsetup luksOpen /dev/sdb1 sec-drive

Step 03: Make a directory to mount encrypted file system

mkdir /secure

Step 04: Format Luks drive with Ext4. (Note: You can use any File System)

mkfs.ext4 /dev/mapper/sec-drive

Step 05: Generate a Key for encryption

dd if=/dev/urandom of=/root/secure.key bs=4096 count=1

Step 06: Add generated key to luks partition

cryptsetup luksAddKey /dev/sdb1 ./secure.key

Step 07: Add fstab entry

echo "/dev/mapper/sec-drive       /secure     ext4    defaults 0 0" >> /etc/fstab

Step 08: Add crypttab entry

echo "sec-drive /dev/sdb1 /root/secure.key" >> /etc/crypttab

Verify

Execute mount -a