Hands-on steps to encrypt, open and manage block devices with cryptsetup. 08.07.2026 | reading time: 3 min Start by asking: how do you protect data at rest on Linux so it mounts only when needed? This page shows the core `cryptsetup` workflow used to create and handle LUKS-encrypted block devices, with a full example you can reproduce on a test system. A complete, repeatable example Follow these commands to create a 100 MB loopback container, format it as LUKS2, open it, create a filesystem, mount it, check status and then tear it down; copy-paste into a safe test environment: ```bash fallocate -l 100M /tmp/secure.img losetup --show -f /tmp/secure.img # => /dev/loop0 cryptsetup luksFormat --type luks2 /dev/loop0 # (enter passphrase when prompted) cryptsetup open /dev/loop0 secret_disk # (enters mapping at /dev/mapper/secret_disk) mkfs.ext4 /dev/mapper/secret_disk mkdir -p /mnt/secure mount /dev/mapper/secret_disk /mnt/secure lsblk # SAMPLE OUTPUT: # NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT # loop0 7:0 0 100M 0 loop # └─secret_disk 252:0 0 100M 0 crypt /mnt/secure cryptsetup status secret_disk # device: /dev/mapper/secret_disk # cipher: aes-xts-plain64 # keysize: 512 # device size: 204800 # After inspection, unmount and close: umount /mnt/secure cryptsetup close secret_disk losetup -d /dev/loop0 ``` Useful options and real needs Use `--type luks2` for modern metadata, add secondary keys with `luksAddKey` for key rotation, and use a keyfile for automation with `--key-file`; increase PBKDF memory with `--pbkdf-memory` to harden against brute force; integrate with systemd or initramfs to unlock at boot, or use detached keyfiles to support removable tokens. Integration and adjacent tools cryptsetup acts on top of dm-crypt and typically works together with losetup for loop devices, LVM for logical volumes and systemd's unlock mechanisms for boot-time decryption; for policy-based unlocking consider clevis or TPM tooling for automated but secure unlocking. Next steps for the practitioner Practice on throwaway images, try key rotation with `luksAddKey`, and rebuild an initramfs to observe boot unlocking; encryption is powerful but requires testing and operational procedures to avoid data loss, so script and document your processes and keep backups of critical headers and keys; explore more to harden deployments and automation. Join Bits & Bytes Academy First class LINUX exam preparation. security storage filesystem utilities boot-process This page was created with the help of AI.
