Chapter 12. Encrypting block devices using LUKS

Procedure

1. Unmount all file systems on the device that you plan to encrypt. For example:

   # umount /dev/sdb1

2. Make free space for storing a LUKS header. Choose one of the following options that suits your scenario:

   • In the case of encrypting a logical volume, you can extend the logical volume without resizing the file system. For example:

     # lvextend -L+32M vg00/lv00

   • Extend the partition using partition management tools, such as parted.
   • Shrink the file system on the device. You can use the resize2fs utility for the ext2, ext3, or ext4 file systems. Note that you cannot shrink the XFS file system.

3. Initialize the encryption. For example:

   # cryptsetup reencrypt \
                --encrypt \
                --init-only \
                --reduce-device-size 32M \
                /dev/sdb1 sdb1_encrypted

   The command asks you for a passphrase and starts the encryption process.

4. Mount the device:

   # mount /dev/mapper/sdb1_encrypted /mnt/sdb1_encrypted

5. Start the online encryption:

   # cryptsetup reencrypt --resume-only /dev/sdb1

Procedure

1. Unmount all file systems on the device. For example:

   # umount /dev/sdb1

2. Initialize the encryption:

   # cryptsetup reencrypt \
                --encrypt \
                --init-only \
                --header /path/to/header \
                /dev/sdb1 sdb1_encrypted

   Replace /path/to/header with a path to the file with a detached LUKS header. The detached LUKS header has to be accessible so that the encrypted device can be unlocked later.

   The command asks you for a passphrase and starts the encryption process.

3. Mount the device:

   # mount /dev/mapper/sdb1_encrypted /mnt/sdb1_encrypted

4. Start the online encryption:

   # cryptsetup reencrypt --resume-only --header /path/to/header /dev/sdb1

Procedure

1. Setup a partition as an encrypted LUKS partition:

   # cryptsetup luksFormat /dev/sdb1

2. Open an encrypted LUKS partition:

   # cryptsetup open /dev/sdb1 sdb1_encrypted

   This unlocks the partition and maps it to a new device using the device mapper. This alerts kernel that device is an encrypted device and should be addressed through LUKS using the /dev/mapper/device_mapped_name so as not to overwrite the encrypted data.

3. To write encrypted data to the partition, it must be accessed through the device mapped name. To do this, you must create a file system. For example:

   # mkfs -t ext4 /dev/mapper/sdb1_encrypted

4. Mount the device:

   # mount /dev/mapper/sdb1_encrypted mount-point

Procedure

1. Create a new playbook.yml file with the following content:

   - hosts: all
     vars:
       storage_volumes:
         - name: barefs
           type: disk
           disks:
            - sdb
           fs_type: xfs
           fs_label: label-name
           mount_point: /mnt/data
           encryption: true
           encryption_password: your-password
     roles:
      - rhel-system-roles.storage

2. Optional: Verify playbook syntax:

   # ansible-playbook --syntax-check playbook.yml

3. Run the playbook on your inventory file:

   # ansible-playbook -i inventory.file /path/to/file/playbook.yml