Encryption of data on volumes (whole disks or partitions) is nothing new. Past versions of Linux required the administrator and users to jump through hoops to implement. With Red Hat 5, encrypting volumes is simple and straightforeward. The cryptsetup command performs all the required tasks of initializing a encrypted volume, managing the keys necessary to access the volume, and opening & closing encrypted volumes for use.

Background

Encrypted volumes build upon the device-mapper package in Linux. A partition, disk or LVM volume is first initialized. This initialization involves writing a special header at the beginning of the volume and assigning a key that is used to encrypt and decrypt the data. Once initialized, the volume is opened. Opening a volume involves specifying the volume and a name device-mapper system should use when mapping the volume to a device file. The key used to encrypt and decrypt the data is used during the opening process. Once a volume is opened and assigned a device file, it can be used like any other volume (formatted and mounted for use.)

Requirements & Installation

The system must be running Red Hat 5. The following packages must be installed:

• libgpg-error
• libgcrypt
• device-mapper
• cryptsetup-luks

These packages provide the necessary libraries and commands needed to use encrypted volumes. There are additional dependencies but they are generally satisfied with our standard install of Red Hat. Simply use Red Hat Network to install just the "cryptsetup-luks" package and the dependency tracking will take care of pulling in any missing packages for you.

Initializing Volumes

Initializing a volume prepares it to hold encrypted data. This process is destructive to the underlying volume meaning any existing data will be destroyed. During initialization, a key needs to be provided. This can be a password typed in by the user initializing the volume or it can be a non-zero length file containing arbitrary data. Regardless of which is used, it must be recorded. Loss of the password or key file will result in being unable to decrypt the data. To guard against key loss, multiple keys can be used if the volume is initialized with LUKS key management.
When initializing a volume, you specify the backing volume device file. This can be a whole disk (eg. /dev/sda), a disk partition (eg. /dev/hda5) or a LVM volume (eg. /dev/VolGroup01/lvol02.) During this phase, you will be prompted to enter a password unless you provided a key file on the command line. You should follow the guidelines for good password selection (at least 10 characters, composed of mixed-case letters, numbers and special characters like $%*@(:.) The following example initializes the /dev/hdb1 partition as a LUKS-enabled encrypted volume. Since a key file was not specified, it prompts for a password.
Initializing a volume will leave that volume in an open state.

Opening & Closing Volumes

Until an encrypted volume is opened, it cannot be used. The same cryptsetup command is used to open volumes. You provide the encrypted volume device file and supply a name to be used as the device-mapper device file name. If the volume was encrypted with a key file, you can specify it on the command line, otherwise, it will prompt you to enter a password. In the following example, cryptsetup opens the /dev/hdb1 encrypted volume and assigns the opened volume to the name CRYPT, which is manifested as the /dev/mapper/CRYPT device file:
Once a volume is no longer in use, it should be closed. Before closing the volume, all services should be stopped that use files stored on the volume and the file system should be unmounted. After that, use the luksClose option to cryptsetup to close the volume, which removes the key from the kernel structures. In the following example, the /dev/mapper/CRYPT volume is mounted to /mnt/one:

Mounting and Unmounting Volumes

If you successfully opened an encrypted volume, you'll have a new device file in /dev/mapper that you can use like any other storage. You can create any file system on it, mount it and use it like any other, as the following examples show:

Encrypted Volume Management

Encrypted volumes require no special handling other than opening the volume before use and closing the volume after it has been unmounted. The cryptsetup command has some additional options that may prove useful when working with encrypted volumes. The first is the isLuks option:
Another option is the luksDump, which displays the LUKS header:

Key Management

There are two types of encrypted volumes supported by the cryptsetup command, LUKS and non-LUKS. The primary difference is LUKS allows for multiple keys to be used to encrypt and decrypt the data while the non-LUKS uses a single key which, if lost, means you cannot recover the data. It is lost forever unless it was backed up while mounted.
LUKS headers have 8 slots to hold keys. During initialization, slot 0 is used. After initialization, additional keys can be added with the luksAddKey option to cryptsetup. When adding a key, you must use an existing key to unlock the volume header, as this example shows:
The new key has now been added and doing a luksDump on the volume shows two key slots occupied: