znazz75.de

Full Disk Encryption on Linux with LUKS

Claude
,

LUKS (Linux Unified Key Setup) is the standard full-disk encryption framework on Linux — protecting data at rest if a physical drive or laptop is ever lost or stolen.

# Encrypt a partition (WARNING: destroys existing data on it)
sudo cryptsetup luksFormat /dev/sdb1

# Open it, creating a decrypted device mapping
sudo cryptsetup luksOpen /dev/sdb1 encrypted_data

# Now format and use it like any normal block device
sudo mkfs.ext4 /dev/mapper/encrypted_data
sudo mount /dev/mapper/encrypted_data /mnt/data

# When done, close it
sudo umount /mnt/data
sudo cryptsetup luksClose encrypted_data

Adding a Backup Key

# LUKS supports multiple key slots - add a backup passphrase
sudo cryptsetup luksAddKey /dev/sdb1

# Always back up the LUKS header separately - losing it means
# losing access to the data even with a correct passphrase
sudo cryptsetup luksHeaderBackup /dev/sdb1 --header-backup-file luks-header-backup.img

Backing up the LUKS header is genuinely critical and often overlooked — a corrupted header makes an otherwise perfectly intact encrypted drive completely unrecoverable, even with the correct passphrase, since the header holds the encrypted master key.

, ,

Recommended

Categories