Description:
LUKS (Linux Unified Key Setup) is the standard disk encryption specification for Linux. It uses dm-crypt as the underlying encryption engine and provides full-disk encryption for block devices such as hard drives and SSDs. LUKS encrypts the entire partition using AES-256 encryption, ensuring all data at rest is protected from unauthorized access. On Ubuntu, LUKS is set up during installation; this guide enables it by reinstalling Ubuntu with encryption turned on.
Rationale:
Without disk encryption, data stored on a Linux device is fully accessible to anyone with physical access to the drive. LUKS ensures that even if a device is lost, stolen, or decommissioned, the data remains unreadable without the correct passphrase. This is a fundamental security control for protecting sensitive organizational data on Linux systems and is required for compliance with standards such as HIPAA, PCI DSS, ISO 27001, and SOC 2.
Impact:
All data on encrypted partitions is protected from unauthorized physical access.
Protects data if the device is lost, stolen, or decommissioned.
Meets compliance requirements for data protection (HIPAA, PCI DSS, ISO 27001, SOC 2).
Uses AES-256 encryption for strong data protection.
A disk passphrase must be entered on every boot — losing it means losing access to all data.
Enabling encryption requires reinstalling Ubuntu, which erases the disk. A full backup and restore of your data is needed, and the process can take a few hours.
Default Value:
By default, LUKS disk encryption is NOT enabled on Linux unless selected during the OS installation. Standard Ubuntu installations do not encrypt the disk unless the user explicitly selects the encryption option in the installer (“Use LVM and encryption” on Ubuntu 24.04, or “Encrypt the new Ubuntu installation for security” on Ubuntu 20.04/22.04). Existing installations must be reinstalled to enable it.
Pre-Requisite:
Ubuntu 24.04 LTS (the installer screens in this guide are from Ubuntu 24.04; for Ubuntu 20.04/22.04, see the note in Step 2).
Administrator (sudo) privileges on the device.
A complete backup of all important data on an external drive.
An Ubuntu installation USB (bootable media) and an external USB drive or HDD with enough free space for your backup.
IMPORTANT: Back up all data before proceeding — reinstalling Ubuntu erases the entire disk.
Remediation:
Test Plan:
Pre-Implementation Check (run before making any changes)
Open a Terminal and run the following command to check if your disks are currently encrypted:
What this does: Lists all disk partitions. Look for crypto_LUKS in the FSTYPE column — this confirms LUKS encryption is active on that partition.
Look for entries with FSTYPE = "crypto_LUKS". If none exist, your disks are not encrypted.
Alternatively, run:
What this does: Lists only encrypted (LUKS) devices. If LUKS is active, an entry appears (for example dm_crypt-0 on Ubuntu 24.04, or sda3_crypt on older versions). If it prints “No devices found”, LUKS is not active.
Expected output example (system with LUKS enabled):
Screenshot: lsblk output showing sda3 with FSTYPE = crypto_LUKS — disk encryption is active.
How to read the output:
• If FSTYPE shows crypto_LUKS (e.g., sda3 above) — your disk is already encrypted. No further action needed.
• If no crypto_LUKS entry appears — your disk is not encrypted. Proceed to the Implementation Steps below.
Note: The /boot partition (sda2 here) and the EFI partition (if present, shown as vfat) are never encrypted — this is normal. Only the main data partition needs to be crypto_LUKS. Disk names vary by device: NVMe drives show partitions as nvme0n1p1, nvme0n1p2, nvme0n1p3 instead of sda1, sda2, sda3.
Example output — Disk NOT encrypted (non-compliant):
Screenshot: lsblk output showing sda2 as ext4 with no crypto_LUKS entry — disk encryption is NOT enabled.
• No crypto_LUKS entry anywhere — this system is not encrypted and is non-compliant.
• sda2 is mounted as ext4 directly — there is no encryption layer.
• If your output looks like this, proceed to the Implementation Steps to back up your data and reinstall with encryption.
Post-Implementation Check (run after completing the Implementation Steps)
Confirm the partition is now encrypted and active:
What this does: Checks LUKS encryption status. If it shows "active and is in use" with type LUKS2 — your disk is encrypted and working. If inactive, repeat Implementation Step 2.
Expected output: /dev/mapper/dm_crypt-0 is active and is in use. type: LUKS2
Expected output example (system with LUKS active):
Screenshot: cryptsetup status output confirming LUKS2 encryption is active on /dev/sda3.
How to read the output:
• is active and is in use — encryption is running correctly.
• type: LUKS2 — using the latest and most secure LUKS version.
• cipher: aes-xts-plain64 / keysize: 512 bits — AES-256 encryption (industry standard).
• device: /dev/sda3 — the encrypted partition on your disk.
• mode: read/write — the encrypted volume is accessible and working.
What this does: Confirms LUKS is active. Look for crypto_LUKS in the FSTYPE column next to your main partition (e.g. sda3).
Expected: FSTYPE shows crypto_LUKS for the encrypted partition.
Implementation Steps:
Step 1: Back Up Your Data (Before Reinstalling)
Before reinstalling Ubuntu, you MUST back up all important data to an external drive (USB drive or external HDD). Reinstalling Ubuntu will completely wipe the entire disk — including any backup stored on the same disk. Only data saved to an external drive will be safe.
Why backup is critical:
• Reinstalling Ubuntu with LUKS encryption will WIPE the entire disk — including any files, folders or backups stored on it.
• DO NOT store the backup on the same disk you are reinstalling — it will be permanently deleted.
• Always verify your backup is complete and accessible on the external drive before proceeding to reinstall.
MANDATORY: Connect your external USB drive or external HDD before proceeding. The backup MUST be stored on an external drive — NOT on the same disk as Ubuntu.
Which drive format to use: Check the FSTYPE column for your external drive (see Step 1a). ext4 is recommended. If the drive shows vfat (FAT32), it cannot store any single file larger than 4 GB and cannot keep Linux file permissions — rsync will show “failed to set permissions” messages, which are expected and do not stop your files from being copied. If you have files larger than 4 GB, reformat the drive to ext4 or exFAT using the Disks app first (reformatting erases the external drive).
Step 1a: Check available drives before backup
Open Terminal and run the following command to see all connected drives and available space:
What this does: Shows disk space usage in human-readable format (GB/MB). Check that your USB drive has enough free space before backing up.
Screenshot: df -h output showing current disk usage. After connecting your external drive, run this command again — your external drive will appear as a new entry under /media/username/. Make sure it has enough free space for your backup.
• Look for your external drive in the list — it will appear under /media/username/
• Ensure the external drive has enough free space to hold your backup.
• In this example, /dev/sda2 is the main disk with 9.4G used — the external drive must have at least this much free space.
To confirm your external USB drive is detected, also run:
What this does: Confirms your USB drive is detected. Look for an entry mounted under /media/username/ — that is your external drive.
Screenshot: lsblk output confirming the external USB drive is connected and mounted — sdb1 (59G, vfat) is mounted at /media/test/6063-0305. The main disk (sda2, ext4) shows no crypto_LUKS, confirming it is not yet encrypted.
Option A: Backup using rsync (Recommended)
First, find your USB drive label by running:
What this does: Lists all drives mounted under your username. The name shown (e.g. 6063-0305) is your USB drive label — use it to replace DRIVE-LABEL below.
Then run the following command to back up your entire home folder to the USB drive:
What this does: Copies your home folder (including hidden settings files) to the USB drive. -a copies all files and folders and keeps their dates and permissions, -v shows files being copied, --progress shows transfer progress.
Screenshot — rsync starting (files being copied):
Screenshot: rsync copying files with progress — showing filename, size, speed and files remaining (to-chk=X/224).
Screenshot — rsync completed (summary):
Screenshot: rsync completion summary — "sent 384,755 bytes... speedup is 35.75" confirms all files were backed up successfully.
• to-chk=0/224 — all 224 files checked and transferred.
• speedup is 35.75 — rsync only transfers changed files, making re-runs faster.
Note: Replace DRIVE-LABEL with your actual USB drive label (e.g. 6063-0305) found using ls /media/$(whoami)/ above. $(whoami) fills in your username automatically — leave it as is.
Option B: Backup using tar
What this does: Creates one compressed backup file of your home folder on the USB drive. -c = create, -z = compress, -v = show files, -f = output file name, -C = the folder to back up, and the final dot (.) means everything inside it. Replace DRIVE-LABEL with your USB label. On a FAT32 (vfat) drive this single file cannot be larger than 4 GB — use Option A (rsync) for larger home folders.
Check that backup.tar.gz appears on the drive:
Screenshot — Backup verification:
Screenshot: Files app showing the "backup" folder created on the external USB drive (63 GB Volume) — confirms backup was saved to external drive, not the internal disk.
Screenshot: Inside the backup folder on the external USB drive — Desktop, Documents, Downloads (4 items), Music, Pictures, and Videos are all backed up. Confirm all your important folders appear here before proceeding.
• All important folders are present in the backup — backup is complete and verified.
• Do NOT proceed to reinstall until you see all your important folders listed here.
Your data is now safely backed up. Proceed to Step 2 to reinstall Ubuntu with LUKS encryption.
IMPORTANT: Do NOT proceed to Step 2 until you have confirmed your backup is complete, all files are visible on the external drive, and the external drive is safely ejected and disconnected. Once you reinstall Ubuntu, all data on the disk will be permanently deleted.
Step 2: Reinstall Ubuntu with LUKS Encryption
Before starting the reinstall: safely eject and disconnect the external drive from the device.
To safely eject in Ubuntu: open Files → right-click external drive → Eject. Or run:
What this does: Safely disconnects the USB drive. Always run this before unplugging — removing without it can corrupt your backup.
Once your data is backed up, reinstall Ubuntu with encryption enabled:
Note for Ubuntu 20.04 / 22.04: The screens below are from Ubuntu 24.04. On Ubuntu 20.04 or 22.04, on the “Installation type” screen select “Erase disk and install Ubuntu”, click “Advanced features...”, select “Use LVM with the new Ubuntu installation”, tick “Encrypt the new Ubuntu installation for security”, click OK, then set your passphrase on the next screen. Then continue from point 7 below.
1. Boot your device from Ubuntu USB installation media.
2. Choose your language, keyboard layout and network, then select “Install Ubuntu” when asked “What do you want to do with Ubuntu?”.
3. Select “Interactive installation” for a guided step-by-step setup, then “Default selection” for applications, and choose your preference on the third-party software screen.
4. On the "Disk setup" screen, select "Erase disk and install Ubuntu".
Screenshot: "Disk setup" — "Erase disk and install Ubuntu" selected. Click "Advanced features..." to enable encryption.
5. Click "Advanced features..." → Select "Use LVM and encryption" → Click OK.
Screenshot: "Advanced features" dialog — select "Use LVM and encryption" then click OK.
Screenshot: "LVM and encryption selected" confirmed next to the Advanced features button — LUKS encryption is enabled.
6. Click Next → On the "Disk passphrase" screen, enter a strong passphrase and confirm it.
Screenshot: "Disk passphrase" screen — enter and confirm a strong passphrase. This passphrase is required every time the device boots.
7. IMPORTANT: Store your passphrase securely — losing it means PERMANENT data loss with no recovery option.
8. Review your choices — confirm "Disk encryption: LUKS (LVM)" is shown under "Security & more" → Click Install.
Screenshot: "Review your choices" — "Disk encryption: LUKS (LVM)" confirmed under Security & more. Click Install to begin.
9. Wait for installation to complete → Click "Restart now".
Screenshot: "Installation complete" — Ubuntu 24.04.4 LTS installed with LUKS encryption. Click "Restart now".
10. On reboot, enter your passphrase when prompted "Please unlock disk dm_crypt-0:" — LUKS requires this passphrase on every boot to decrypt the disk.
Screenshot: LUKS passphrase prompt at boot — "Please unlock disk dm_crypt-0:" appears on every startup. Enter your passphrase to decrypt the disk and boot Ubuntu.
Step 3: Restore Your Data
After reinstalling Ubuntu with LUKS, connect your external USB drive to the device, then restore your backed-up data using the steps below. Tip: create the same username as before during installation, so your files go back to the same place.
Step 3a: Find your USB drive label
Connect your external USB drive to the device. Then open a Terminal and run the following command to see all mounted drives and find your USB drive label:
What this does: Lists all drives mounted under your username. Note the USB drive label (e.g. 6063-0305) — use it to replace DRIVE-LABEL in the restore commands below.
Also run lsblk to confirm that LUKS encryption is active on your new installation and your USB drive is recognized:
What this does: Shows all partitions and filesystem types. After reinstalling with LUKS, sda3 should show crypto_LUKS and your USB drive should appear under /media/username/.
Screenshot: lsblk output confirming LUKS is active (sda3 = crypto_LUKS) and USB drive is connected (sdb1 mounted at /media/test1/6063-0305).
Screenshot: ls /media/$(whoami)/ output — the highlighted name (e.g. 6063-0305) is your USB drive label. Use this label in the restore command below.
Note: The name shown (e.g. 6063-0305) is your USB drive label. Replace DRIVE-LABEL in the command below with this name.
Step 3b: Verify backup contents on USB drive
Screenshot: Backup folder contents on USB drive — Desktop, Documents, Downloads, Music, Pictures, Videos confirmed. All folders must be present before restoring.
Step 3c: Restore your data from USB to home folder
What this does: Copies your backup files from the USB drive back to your home folder. Replace DRIVE-LABEL with your USB drive label from Step 3a.
Then make sure your user owns all restored files (needed because the restore ran with sudo):
Screenshot: rsync restore running — files being copied from USB back to /home/test1/. Wait for the command to complete.
Screenshot: rsync restore complete — all files transferred from USB to home folder successfully.
Step 3d: Verify restored files
Screenshot: ls /home/test1/ — Desktop, Documents, Downloads, Music, Pictures, Videos all restored successfully on the LUKS-encrypted Ubuntu.
Option B: Restore using tar (alternative)
What this does: Extracts the tar backup to your home folder. -x = extract, -z = decompress, -v = show files, -C = destination folder. Replace DRIVE-LABEL with your USB label.
After restoring, verify all your important files and folders are present in your home folder before ejecting the USB drive.
Backout Plan:
Since LUKS encryption is applied to the root partition (/), it cannot be removed while Ubuntu is running. The only safe way to remove LUKS is to reinstall Ubuntu without encryption — the same process used to enable it, but without selecting encryption.
Step 1: Back Up Your Data
Before reinstalling, back up all your data to an external USB drive — the same process as Step 1 in the Implementation Steps above.
Replace DRIVE-LABEL with your USB drive label. Verify all important files are backed up before proceeding.
Step 2: Reinstall Ubuntu Without Encryption
Follow the same reinstallation steps as Step 2 in the Implementation Steps, but on the "Advanced features" screen select "None" instead of "Use LVM and encryption". This installs Ubuntu without LUKS encryption.
Step 3: Restore Your Data
After reinstalling Ubuntu without encryption, restore your backed-up data from the external USB drive — the same process as Step 3 in the Implementation Steps.
Replace DRIVE-LABEL with your USB drive label. After restoring, verify all your files are present.
WARNING: Reinstalling Ubuntu will WIPE the entire disk. Ensure your backup is complete and verified on the external USB drive before proceeding.
Note:
The LUKS passphrase must be stored securely — losing it means permanent data loss with no recovery option. For production systems, consider using a key escrow solution via your MDM/IT administrator. IT administrators can also keep a backup of the LUKS header (for example: sudo cryptsetup luksHeaderBackup /dev/sda3 --header-backup-file luks-header.img), stored off the device, because a damaged header makes the data unrecoverable even with the correct passphrase. Encryption happens at the block device level — the system can be used normally after setup. Run lsblk -o NAME,FSTYPE to verify encryption status at any time.