{"id":2432,"date":"2024-01-13T22:18:43","date_gmt":"2024-01-13T16:48:43","guid":{"rendered":"https:\/\/www.veeble.org\/kb\/?p=2432"},"modified":"2025-04-15T12:19:58","modified_gmt":"2025-04-15T06:49:58","slug":"encrypt-disk-ubuntu-cli","status":"publish","type":"post","link":"https:\/\/www.veeble.com\/kb\/encrypt-disk-ubuntu-cli\/","title":{"rendered":"How to Encrypt Disk in Ubuntu via CLI"},"content":{"rendered":"\n

Learn how to boost your data security by encrypting your disk in Ubuntu using the Command Line Interface (CLI). This guide is designed for users of all technical levels, especially those who are new to disk encryption.<\/p>\n\n\n\n

\n
\"How<\/a><\/figure>\n<\/figure>\n\n\n\n

<\/p>\n\n\n

Preparing Ubuntu for Encryption<\/h4>\n\n\n
General Precaution:<\/strong> It's important to make a complete backup of your data before encrypting it. Eventhough you'll need to format the disk during encryption, erasing all existing data. There's also a risk of mistakenly encrypting the wrong disk or partition, potentially making important data inaccessible, especially if the encryption password is forgotten.<\/em><\/pre>\n\n\n\n
Verify the Disk Space:<\/strong> Make sure your disk has adequate room for encryption. As it organizes and protects your data, the procedure can require more space. To check disk space, use the below command:<\/p>\n\n\n\n
df -h<\/code><\/pre>\n\n\n\n
\n
\"Checking<\/a><\/figure>\n<\/figure>\n\n\n\n
<\/p>\n\n\n
Install the Utility for Encryption<\/h4>\n\n\n
The main encryption method we’re using is LUKS (Linux Unified Key Setup)<\/strong> and the software tool we use to set up encryption with LUKS is cryptsetup<\/strong>. 
Check out more on this encryption from the link: https:\/\/en.wikipedia.org\/wiki\/Linux_Unified_Key_Setup<\/a><\/p>\n\n\n\n
To install the tool cryptsetup, open the Terminal and type:<\/p>\n\n\n\n
sudo apt-get install cryptsetup<\/code><\/pre>\n\n\n\n
This installs the necessary tools for encryption. You’re now ready to move on to the next step!<\/p>\n\n\n\n
<\/p>\n\n\n
Identify your Disk<\/h4>\n\n\n
Type sudo fdisk -l<\/code> in Terminal to see all your disks. Pick the one you want to encrypt:<\/p>\n\n\n\n
sudo fdisk -l<\/code><\/pre>\n\n\n\n
In this guide, we’ll use \/dev\/vda3<\/code> as the example disk partition for encryption. However, when you follow these steps, remember to replace \/dev\/vda3<\/code> with the name of the disk partition you want to encrypt.<\/em><\/p>\n\n\n\n
\"fdisk<\/a><\/figure>\n\n\n\n
Disk identification has been completed. We are now unmounting that disk partition and proceeding to the encryption phase with the command:<\/p>\n\n\n\n
umount \/dev\/vda3<\/code><\/pre>\n\n\n\n
<\/p>\n\n\n
Encrypt with LUKS<\/h4>\n\n\n
Initialize Encryption:<\/strong><\/p>\n\n\n\n
sudo cryptsetup luksFormat \/dev\/vda3<\/code><\/pre>\n\n\n\n
Replace \/dev\/vda3<\/code> with the actual partition, you want to encrypt.<\/em><\/p>\n\n\n\n
This command initializes the encryption process. You will receive a warning that this action will erase all data on the partition. Confirm by typing YES<\/code> in capital letters. After confirmation, you’ll be prompted to enter a passphrase. Choose a strong, memorable passphrase, as this will be required to unlock the encrypted data.<\/p>\n\n\n\n
<\/p>\n\n\n\n
Open Encrypted Disk:<\/strong><\/p>\n\n\n\n
cryptsetup open \/dev\/vda3 my_secret_data<\/code><\/pre>\n\n\n\n
Again, replace \/dev\/vda3<\/code> with your partition. my_secret_data<\/code> is an arbitrary name you give to the encrypted device mapper. This name can be anything, but it will be used to identify the encrypted volume in \/dev\/mapper\/<\/code>.<\/em><\/p>\n\n\n\n
\n
\"Encryption<\/a><\/figure>\n<\/figure>\n\n\n\n
 After this step, the encrypted partition is accessible via a new device-mapper entry located at \/dev\/mapper\/my_secret_data<\/code><\/code>.<\/p>\n\n\n\n
<\/p>\n\n\n
Create a Filesystem for the Encrypted Disk <\/h4>\n\n\n
Format the Disk:<\/strong><\/p>\n\n\n\n
sudo mkfs.ext4 \/dev\/mapper\/my_secret_data<\/code><\/pre>\n\n\n\n
This command formats the newly created mapped device with an ext4 filesystem. Remember that \/dev\/mapper\/my_secret_data<\/code> is the name you assigned in the previous step.<\/p>\n\n\n\n
\n
\"Formatting<\/a><\/figure>\n<\/figure>\n\n\n\n
<\/p>\n\n\n\n
Mount the Disk<\/strong>:<\/p>\n\n\n\n
sudo mount \/dev\/mapper\/my_secret_data \/mnt<\/code><\/pre>\n\n\n\n
Here, you’re mounting the encrypted volume to a directory (in this case, \/mnt<\/code>). This directory is where you’ll access the files stored in the encrypted partition. Ensure that \/mnt<\/code> is not already in use or choose a different mount point.<\/p>\n\n\n\n
<\/p>\n\n\n\n
Automounting the Disk:<\/strong><\/p>\n\n\n\n
To mount encrypted volumes automatically at boot in a Linux system, you typically need to make entries in both \/etc\/fstab<\/code> and \/etc\/crypttab<\/code>. If this is not done, the file system will be unmounted when the system reboots. To automatically mount at boot, first you need to identify the UUID of the disks. This can be a bit complex, as it involves identifying the UUID of your encrypted volume and properly configuring the mount options.

To identify the UUID of disks, execute the following command in the terminal:<\/p>\n\n\n\n
sudo blkid<\/code><\/pre>\n\n\n\n
This will list all the block devices along with their UUIDs and other information.  Look for the entry corresponding to \/dev\/mapper\/my_secret_data<\/code>. It should look something like this:<\/p>\n\n\n\n
\n
\"\"<\/a><\/figure>\n<\/figure>\n\n\n\n
The UUID will be the string inside the quotes after UUID=<\/code>. You can then use this UUID of \/dev\/vda3<\/code> in your \/etc\/crypttab<\/code> and UUID of \/dev\/mapper\/my_secret_data<\/code> in \/etc\/fstab<\/code>.<\/p>\n\n\n\n
To edit those files you can use editors such as VI<\/a> or Nano<\/a>.<\/p>\n\n\n\n
<\/p>\n\n\n\n
An example entry for \/etc\/crypttab<\/code> using your UUID:<\/p>\n\n\n\n
\n
\"entry<\/a><\/figure>\n<\/figure>\n\n\n\n
This tells the system to ask for a passphrase on boot to unlock the partition with UUID a74b33ea-ea47-4da2-8e61-3623fe7a94b6<\/code>, and make it available as \/dev\/mapper\/my_secret_data<\/code>. Replace the entries such as UUID and arbitary name of encrypted device (my_secret_data<\/code>) with your actual values in your files.<\/p>\n\n\n\n
<\/p>\n\n\n\n
An example entry for \/etc\/fstab<\/code> using your UUID:<\/p>\n\n\n\n
\n
\"Adding<\/a><\/figure>\n<\/figure>\n\n\n\n
This mounts the decrypted filesystem (with UUID 9731af3e-848d-4811-87cd-5405b7ab6fd9<\/code> from \/dev\/mapper\/my_secret_data<\/code>) to \/mnt<\/code> (replace \/mnt<\/code> and UUID with your actual desired mount point and UUID).<\/p>\n\n\n\n
By setting up both files correctly, during the booting process of your system, the system will prompt the passphrase to unlock the encrypted partition as per the \/etc\/crypttab<\/code> configuration. Once unlocked, the system will then automatically mount the filesystem according to the \/etc\/fstab<\/code> configuration and ensure that your encrypted data is readily accessible.<\/p>\n\n\n\n
Editing \/etc\/fstab<\/code> and \/etc\/crypttab<\/code> requires care, as incorrect entries can cause boot problems. It’s recommended to have a good understanding of these files or seek guidance if you’re unsure.<\/em><\/p>\n\n\n\n
\n\n\n\n
Congratulations! We have successfully encrypted the disk. \ud83e\udd73<\/p>\n\n\n\n
<\/div>\n\n\n\n
Get started with your own VPS today!<\/h3>
Our VPS hosting plans are perfect for businesses and individuals who need a powerful and reliable server to host their website or application.<\/p><\/div>
Order now<\/path><\/svg><\/a><\/div><\/div>\n","protected":false},"excerpt":{"rendered":"
Learn how to boost your data security by encrypting your disk in Ubuntu using the Command Line Interface (CLI). This guide is designed for […]<\/p>\n","protected":false},"author":7,"featured_media":8591,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_uag_custom_page_level_css":"","site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"set","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[9,5],"tags":[],"class_list":["post-2432","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-firewallsecurity","category-linux"],"uagb_featured_image_src":{"full":["https:\/\/www.veeble.com\/kb\/wp-content\/uploads\/2024\/01\/How-to-Encrypt-Disk-in-Ubuntu-via-CLI.jpg",1536,1024,false],"thumbnail":["https:\/\/www.veeble.com\/kb\/wp-content\/uploads\/2024\/01\/How-to-Encrypt-Disk-in-Ubuntu-via-CLI-150x150.jpg",150,150,true],"medium":["https:\/\/www.veeble.com\/kb\/wp-content\/uploads\/2024\/01\/How-to-Encrypt-Disk-in-Ubuntu-via-CLI-300x200.jpg",300,200,true],"medium_large":["https:\/\/www.veeble.com\/kb\/wp-content\/uploads\/2024\/01\/How-to-Encrypt-Disk-in-Ubuntu-via-CLI-768x512.jpg",768,512,true],"large":["https:\/\/www.veeble.com\/kb\/wp-content\/uploads\/2024\/01\/How-to-Encrypt-Disk-in-Ubuntu-via-CLI-1024x683.jpg",1024,683,true],"1536x1536":["https:\/\/www.veeble.com\/kb\/wp-content\/uploads\/2024\/01\/How-to-Encrypt-Disk-in-Ubuntu-via-CLI.jpg",1536,1024,false],"2048x2048":["https:\/\/www.veeble.com\/kb\/wp-content\/uploads\/2024\/01\/How-to-Encrypt-Disk-in-Ubuntu-via-CLI.jpg",1536,1024,false]},"uagb_author_info":{"display_name":"Adrian Antony","author_link":"https:\/\/www.veeble.com\/kb\/author\/adrian\/"},"uagb_comment_info":0,"uagb_excerpt":"Learn how to boost your data security by encrypting your disk in Ubuntu using the Command Line Interface (CLI). This guide is designed for […]","_links":{"self":[{"href":"https:\/\/www.veeble.com\/kb\/wp-json\/wp\/v2\/posts\/2432","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.veeble.com\/kb\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.veeble.com\/kb\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.veeble.com\/kb\/wp-json\/wp\/v2\/users\/7"}],"replies":[{"embeddable":true,"href":"https:\/\/www.veeble.com\/kb\/wp-json\/wp\/v2\/comments?post=2432"}],"version-history":[{"count":10,"href":"https:\/\/www.veeble.com\/kb\/wp-json\/wp\/v2\/posts\/2432\/revisions"}],"predecessor-version":[{"id":7367,"href":"https:\/\/www.veeble.com\/kb\/wp-json\/wp\/v2\/posts\/2432\/revisions\/7367"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.veeble.com\/kb\/wp-json\/wp\/v2\/media\/8591"}],"wp:attachment":[{"href":"https:\/\/www.veeble.com\/kb\/wp-json\/wp\/v2\/media?parent=2432"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.veeble.com\/kb\/wp-json\/wp\/v2\/categories?post=2432"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.veeble.com\/kb\/wp-json\/wp\/v2\/tags?post=2432"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}