--- name: BlockStorage-use-luks-red-hat-enterprise-linux-6-full-disk-encryption title: Achieving full disk encryption with LUKS in RHEL description: Learn how to achieve full disk encryption on Block Storage for Classic partitions with Linux Unified Key Setup (LUKS) and multiple user keys for enhanced data security. last-updated: 2026-08-06 --- > ## Documentation Index > The table of contents for this documentation set is at https://cloud.ibm.com/docs/BlockStorage?format=markdown > The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt > Use these files to discover more information as needed. # Achieving full disk encryption with LUKS in RHEL {: #LUKSencryption} Learn how to achieve full disk encryption on Block Storage for Classic partitions with Linux Unified Key Setup (LUKS) and multiple user keys for enhanced data security. {: shortdesc} You can encrypt partitions on your Block Storage for Classic volumes with Linux® Unified Key Setup (LUKS). With LUKS, multiple user keys can be used to decrypt a main key that is used for the bulk encryption of the partition. The following instructions were validated to work for RHEL version 8 or newer. These steps assume that the server can access a new, unencrypted IBM Cloud® Block Storage for Classic volume that was not formatted or mounted. For more information about connecting Block Storage for Classic to a Linux® host, see one of the following topics. - [Mount iSCSI volume on Red Hat Enterprise Linux® 8](https://cloud.ibm.com/docs/BlockStorage?topic=BlockStorage-mountingRHEL&format=markdown). - [Mount iSCSI volume on CloudLinux 8](https://cloud.ibm.com/docs/BlockStorage?topic=BlockStorage-mountingCloudLin8&format=markdown). - [Mount iSCSI volume on Ubuntu 20](https://cloud.ibm.com/docs/BlockStorage?topic=BlockStorage-mountingUbuntu&format=markdown). All new Block Storage for Classic is automatically provisioned with provider-managed encryption-at-rest. For more information, see [Securing Your Data - Provider-managed Encryption-At-Rest](https://cloud.ibm.com/docs/BlockStorage?topic=BlockStorage-mng-data&format=markdown). {: note} ## What LUKS does {: #LUKSinscope} - LUKS encrypts entire block devices and is therefore suited for protecting the contents of mobile devices such as removable storage media or Notebook disk drives. - The underlying contents of the encrypted block device are arbitrary, making it useful for encrypting swap devices. The encrypting can also be useful with certain databases that use specially formatted block devices for data storage. - LUKS uses the existing device mapper kernel subsystem. - LUKS provides passphrase strengthening, which protects against dictionary attaches. - LUKS contains multiple key slots, so users can add backup keys or passphrases. ## What LUKS doesn't do {: #LUKSoutofscope} - LUKS does not allow applications that require many (more than eight) users to have distinct access keys to the same devices. - LUKS does not work with applications that require file-level encryption. For more information, see the [RHEL Security Guide](https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/7/html/security_guide/index){: external}. ## Setting up a LUKS-encrypted volume with Endurance Block Storage for Classic {: #enryptwithLUKS} The process of data encryption creates a load on the host that might potentially impact performance. {: note} 1. Type the following command at a shell prompt as root to install the required package: ```sh dnf install cryptsetup-luks ``` {: pre} 2. Get the disk ID: ```sh fdisk –l | grep /dev/mapper ``` {: pre} 3. Locate your volume in the listing. 4. Encrypt the block device. 1. This command initializes the volume, and you can set a passphrase. ```sh cryptsetup -y -v luksFormat /dev/mapper/3600a0980383034685624466470446564 ``` {: pre} 2. Respond with `YES` (all uppercase letters). 3. The device now appears as an encrypted volume: ```sh $ blkid | grep LUKS /dev/mapper/3600a0980383034685624466470446564: UUID="46301dd4-035a-4649-9d56-ec970ceebe01" TYPE="crypto_LUKS" ``` {: screen} 5. Open the volume, and create a mapping. ```sh cryptsetup luksOpen /dev/mapper/3600a0980383034685624466470446564 cryptData ``` {: pre} 6. Enter the passphrase. 7. Verify the mapping, and view the status of the encrypted volume. ```sh # cryptsetup -v status cryptData /dev/mapper/cryptData is active. type: LUKS1 cipher: aes-cbc-essiv:sha256 keysize: 256 bits device: /dev/mapper/3600a0980383034685624466470446564 offset: 4096 sectors size: 41938944 sectors mode: read/write Command successful ``` {: screen} 8. Write random data to `/dev/mapper/cryptData` on the encrypted device. This action makes sure that the outside world sees this as random data, which means it is protected against disclosure of usage patterns. This step can take a while. ```sh shred -v -n1 /dev/mapper/cryptData ``` {: pre} 9. Format the volume. ```sh mkfs.ext4 /dev/mapper/cryptData ``` {: pre} 10. Mount the volume. ```sh mkdir /cryptData ``` {: pre} ```sh mount /dev/mapper/cryptData /cryptData ``` {: pre} ```sh df -H /cryptData ``` {: pre} ### Unmounting and closing the encrypted volume securely {: #unmountLUKS} ```sh umount /cryptData cryptsetup luksClose cryptData ``` {: codeblock} ### Remounting and mounting an existing LUKS encrypted partition {: #remountLUKS} ```sh $ cryptsetup luksOpen /dev/mapper/3600a0980383034685624466470446564 cryptData Enter the password previously provided. $ mount /dev/mapper/cryptData /cryptData $ df -H /cryptData $ lsblk NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT xvdb 202:16 0 2G 0 disk └─xvdb1 202:17 0 2G 0 part [SWAP] xvda 202:0 0 25G 0 disk ├─xvda1 202:1 0 256M 0 part /boot └─xvda2 202:2 0 24.8G 0 part / sda 8:0 0 20G 0 disk └─3600a0980383034685624466470446564 (dm-0) 253:0 0 20G 0 mpath └─cryptData (dm-1) 253:1 0 20G 0 crypt /cryptData sdb 8:16 0 20G 0 disk └─3600a0980383034685624466470446564 (dm-0) 253:0 0 20G 0 mpath └─cryptData (dm-1) 253:1 0 20G 0 crypt /cryptData ``` {: screen}