Pop!_OS: Adding a Secondary Encrypted Drive with Auto-Unlock

IT & Systems
, , , ,
1

Adding A Secondary Encrypted Drive On Pop!_OS

This guide walks through adding a second NVMe drive to a Pop!_OS system with LUKS encryption. The drive will auto-unlock at boot after you enter your OS drive passphrase, so you only type one password.

The setup used here is a WD Black SN850X 2TB as the secondary drive on a Pop!_OS 24.04 LTS system with an already-encrypted OS drive.

What You Need

  • A second drive installed and recognized by the system
  • Pop!_OS with an encrypted OS drive (standard Pop!_OS install)
  • Terminal access with sudo

Step 1 - Identify Your Drives

Before touching anything, confirm which drive is which.

lsblk

Sample output:

NAME            MAJ:MIN RM  SIZE RO TYPE  MOUNTPOINTS
nvme0n1         259:0    0  1.9T  0 disk
├─nvme0n1p1     259:1    0  976M  0 part  /boot/efi
├─nvme0n1p2     259:2    0  3.8G  0 part  /recovery
└─nvme0n1p3     259:3    0  1.9T  0 part
  └─cryptdata   252:0    0  1.9T  0 crypt
    └─data-root 252:1    0  1.9T  0 lvm   /
nvme1n1         259:4    0  1.8T  0 disk

In this case nvme0n1 is the OS drive and nvme1n1 is the new drive. Your device names may differ. Double-check before proceeding.

Confirm the drive model:

sudo parted /dev/nvme1n1 print

Verify the model name matches your drive before continuing.

Step 2 - Partition The Drive

Wipe the existing partition table and create a single new partition spanning the full drive.

sudo parted /dev/nvme1n1 mklabel gpt
sudo parted /dev/nvme1n1 mkpart primary 0% 100%

Parted will warn you that all data will be destroyed. Type yes to confirm.

Verify the result:

sudo parted /dev/nvme1n1 print

You should see one partition covering the full disk.

Step 3 - Encrypt The Partition With LUKS

sudo cryptsetup luksFormat /dev/nvme1n1p1

Type YES in capitals when prompted, then set a passphrase. You can use the same passphrase as your OS drive or a different one. Either way, once the keyfile is set up in the next step you will not be prompted for it at boot.

Step 4 - Create A Keyfile For Auto-Unlock

The keyfile lives on your OS drive. When the OS drive unlocks at boot, it uses this keyfile to unlock the secondary drive automatically.

sudo mkdir -p /etc/cryptsetup-keys.d
sudo dd if=/dev/urandom of=/etc/cryptsetup-keys.d/data.key bs=512 count=4
sudo chmod 600 /etc/cryptsetup-keys.d/data.key
sudo cryptsetup luksAddKey /dev/nvme1n1p1 /etc/cryptsetup-keys.d/data.key

The last command adds the keyfile as a valid unlock method. It will ask for the passphrase you set in Step 3.

Step 5 - Open The Volume And Format As ext4

sudo cryptsetup luksOpen /dev/nvme1n1p1 data2 --key-file /etc/cryptsetup-keys.d/data.key
sudo mkfs.ext4 /dev/mapper/data2

This unlocks the encrypted volume under the name data2 and formats it. The format step will take a moment on a large drive.

Step 6 - Get The Partition UUID

sudo cryptsetup luksUUID /dev/nvme1n1p1

Copy the UUID from the output. You will need it in the next step.

Step 7 - Add To crypttab

This tells the system to unlock the drive at boot using the keyfile.

echo "data2 UUID=your-uuid-here /etc/cryptsetup-keys.d/data.key luks" | sudo tee -a /etc/crypttab

Replace your-uuid-here with the UUID from Step 6.

Verify:

sudo cat /etc/crypttab

You should see two entries: one for your OS drive and one for the new drive.

Step 8 - Create A Mount Point And Add To fstab

sudo mkdir -p /mnt/data2
echo "/dev/mapper/data2 /mnt/data2 ext4 defaults 0 2" | sudo tee -a /etc/fstab

Verify fstab:

sudo cat /etc/fstab

Step 9 - Test Before Rebooting

Reload systemd to pick up the fstab change and mount the drive:

sudo systemctl daemon-reload
sudo mount /mnt/data2

Verify it mounted correctly:

df -h /mnt/data2

You should see the drive listed with its full capacity available.

Set ownership so you can write to it without sudo:

sudo chown your-username:your-username /mnt/data2

Step 10 - Reboot And Verify

sudo reboot

After the system comes back up, confirm the drive mounted automatically:

df -h /mnt/data2

If it shows up, everything is working. The drive is encrypted, unlocks automatically after you enter your boot passphrase and mounts at /mnt/data2 on every boot.

Verification After Reboot

After rebooting, confirm the drive auto-unlocked and mounted without any prompts:

df -h /mnt/data2

Expected output:

Filesystem         Size  Used Avail Use% Mounted on
/dev/mapper/data2  1.8T   28K  1.7T   1% /mnt/data2

If it shows up, everything is working correctly. You should not have been prompted for a second password at any point during boot.

You can also confirm the LUKS volume is open:

lsblk

Look for nvme1n1p1 with data2 mapped under it in the output.

Notes

  • The keyfile is stored at /etc/cryptsetup-keys.d/data.key on your OS drive. If someone pulls the secondary drive without the OS drive they cannot unlock it.
  • The passphrase you set in Step 3 remains a valid unlock method. Keep it somewhere safe as a backup in case the keyfile is lost.
  • If you ever need to change the mount point, update both /etc/crypttab and /etc/fstab and run sudo systemctl daemon-reload.