Encryption at Rest: Linux (LUKS and VeraCrypt)

Part of the Encryption in Transit and At Rest series.

Why At-Rest Encryption Matters on Linux

A strong password on your Linux user account protects your session. It does not protect your data if someone removes the drive and reads it on another machine. Full disk encryption means the drive is unreadable without the passphrase, regardless of how someone tries to access it.

Two tools cover most use cases on Linux: LUKS for full disk or partition encryption, and VeraCrypt for encrypted containers you can move between machines and operating systems.

LUKS: Full Disk Encryption

LUKS (Linux Unified Key Setup) is the standard for disk encryption on Linux. It works at the block device level, meaning the entire partition is encrypted. dm-crypt is the kernel module underneath it. Most Linux installers can set it up during installation.

Setting it up during a fresh install:

Most distributions offer full disk encryption as a checkbox in the installer. On Ubuntu, Fedora, and Debian-based systems, look for “Encrypt this installation” or “Use LVM with encryption” during the partitioning step. The installer handles everything and prompts for a passphrase.

This is the recommended approach. Encrypting after the fact requires backing everything up, wiping the drive, setting up LUKS, and restoring.

Verifying your disk is encrypted:

lsblk -o NAME,FSTYPE,MOUNTPOINT

Look for a device with FSTYPE crypto_LUKS. If you see it, LUKS is in place.

sudo cryptsetup status /dev/mapper/dm-0

This shows the active encryption details for a mounted LUKS volume, including the cipher and key size.

Checking the LUKS header:

sudo cryptsetup luksDump /dev/sdX

Replace sdX with your actual device. This shows the version, cipher, and how many key slots are in use.

Key slots:

LUKS supports up to 8 passphrases for the same volume (called key slots). This lets you have a recovery passphrase in addition to your main one. To add a second passphrase:

sudo cryptsetup luksAddKey /dev/sdX

Keep the recovery passphrase somewhere physically secure and offline.

VeraCrypt: Encrypted Containers

VeraCrypt creates encrypted container files or encrypted partitions that you mount when needed. This is useful for:

Portable encrypted volumes you can copy to a USB drive
Cross-platform volumes that also open on Windows or macOS
Encrypted storage on a drive that is not fully LUKS-encrypted
Sensitive files on a shared machine

Installing VeraCrypt on Linux:

Download the installer from veracrypt.jp. Verify the signature before installing.

# Extract and run the installer
tar xzf veracrypt-*.tar.gz
sudo ./veracrypt-*-setup-gui-x64

Creating a new encrypted volume:

Open VeraCrypt, click Create Volume, and follow the wizard. Choose a file container for a portable volume or a partition for a dedicated encrypted drive. The wizard asks for:

Volume type (standard or hidden)
Location and size
Encryption algorithm (AES is the default and is fine)
Passphrase

Mounting a volume:

Select a slot, click Select File, choose your container, click Mount, and enter your passphrase. The volume appears as a drive in your file manager.

Which One to Use

Situation	Use
New machine, starting fresh	LUKS at install time
Portable encrypted files to share or move	VeraCrypt container
Need to access the same encrypted data on Windows or Mac	VeraCrypt container
Encrypting a secondary drive	Either, LUKS is simpler

References

Continue reading:

Running a specific distribution or VM setup? Post below and we can get specific.