Lab activity

Encrypted Storage with LUKS

Learn how to secure Linux storage using LUKS encryption, manage passphrases and key slots, mount encrypted volumes, and configure key-file-based unlocking.

Login to Launch Exercise
Previous

Overview

In this lab, you will learn how to create and manage encrypted storage on Linux using LUKS (Linux Unified Key Setup) and cryptsetup. You will create a virtual disk image, initialize it as a LUKS container, unlock it through a device mapper, and format it with an ext4 filesystem. You will then mount the encrypted volume, create and verify a file, manage additional passphrases and key slots, and configure key-file-based unlocking. Finally, you will close the encrypted container and clean up the lab environment.

Learning Outcomes

  • Install and use cryptsetup to manage LUKS-encrypted storage.
  • Create a virtual disk image and attach it as a loop device.
  • Initialize a device with LUKS encryption and inspect its metadata using cryptsetup luksFormat and cryptsetup luksDump.
  • Open and close an encrypted container using cryptsetup luksOpen and cryptsetup luksClose.
  • Format the unlocked device with ext4, mount it, and verify stored data.
  • Add an additional passphrase and inspect LUKS key-slot information.
  • Create a protected key file and use it to unlock the encrypted container.

Key Concepts

  • LUKS encryption: Protect data at rest by encrypting a storage device or disk image.
  • Device mapper: Access an unlocked encrypted container through a mapped device such as /dev/mapper/labcrypt.
  • Passphrases and key slots: Manage multiple credentials that can unlock the same encrypted container.
  • Key-file authentication: Use a protected key file as an alternative method for unlocking encrypted storage.
  • Filesystem integration: Create an ext4 filesystem on an unlocked encrypted device and mount it to access data.
  • Encrypted storage lifecycle: Understand the process of formatting, opening, mounting, unmounting, closing, and detaching encrypted storage.

Why Needed?

  • LUKS helps protect sensitive data when storage devices or files are accessed without authorization.
  • Understanding passphrases and key slots helps administrators manage access to encrypted storage.
  • Key-file-based unlocking is useful for automated workflows when configured with appropriate security controls.
  • These practical exercises build storage security and Linux administration skills relevant to LFCS preparation and real-world environments.