How to Create and Mount an Encrypted LUKS Partition in Ubuntu Using cryptsetup

Protecting sensitive corporate records, personal financial archives, and private developer keys requires encryption at rest. While Ubuntu offers whole-disk encryption during initial installation, users frequently need to protect secondary data drives, external USB flash storage, or dedicated storage partitions without wiping the entire operating system.

Linux Unified Key Setup (LUKS) is the standard specification for block-device encryption on Linux, implemented via the dm-crypt kernel subsystem and managed through the cryptsetup utility. LUKS establishes a cryptographic layer over raw disk partitions, ensuring that physical access to the storage drive reveals only scrambled ciphertext without the correct decryption passphrase.

Identifying the Target Partition and Installing Cryptsetup

Ensure that cryptsetup is installed and accurately identify the target disk partition to avoid overwriting system volumes.

1. Open Terminal and verify that the cryptsetup package is installed:

   sudo apt update && sudo apt install cryptsetup -y

2. List all available block storage devices and existing partition layouts:

   lsblk -e 7

3. Locate your target partition (for example, /dev/sdb1). Caution: Formatting a partition with LUKS irreversibly erases all existing data on that partition. Verify the device node path carefully before proceeding.

Formatting the Partition with LUKS2 Encryption

Initialize the partition as an encrypted LUKS volume using the modern LUKS2 specification and AES-XTS cipher.

1. Execute the luksFormat command on the target partition:

   sudo cryptsetup luksFormat --type luks2 /dev/sdb1

2. The utility displays a stern warning. Type YES in capital letters to confirm.
3. Enter a strong passphrase for encryption when prompted, then re-enter it to verify. Keep this passphrase recorded in a secure password manager; without it, data cannot be recovered.
4. Inspect the encrypted header details:

   sudo cryptsetup luksDump /dev/sdb1

   This confirms the cipher algorithm (aes-xts-plain64), key size (512-bit), and active keyslots.

Opening and Formatting the Encrypted Block Device

Before an encrypted partition can store files, it must be mapped to an unlocked virtual block device and formatted with a filesystem.

1. Open and decrypt the volume mapping:

   sudo cryptsetup open /dev/sdb1 secure_vault

   Enter your passphrase when requested. The system creates a decrypted virtual block device at /dev/mapper/secure_vault.
2. Format the mapped device with a standard Linux filesystem such as Ext4:

   sudo mkfs.ext4 -L "SecureVault" /dev/mapper/secure_vault

3. Create a mount directory for your decrypted files:

   sudo mkdir -p /mnt/secure_vault

4. Mount the unlocked filesystem:

   sudo mount /dev/mapper/secure_vault /mnt/secure_vault

5. Change ownership to your standard user account so you can read and write files without root privileges:

   sudo chown -R $USER:$USER /mnt/secure_vault

Safely Unmounting and Locking the Encrypted Partition

When you have finished working with your confidential files, you must unmount the filesystem and close the device mapper to restore encrypted lock protection.

1. Ensure no terminals or applications are actively accessing the mount path, then unmount:

   sudo umount /mnt/secure_vault

2. Close the device mapper, removing the unlocked encryption key from kernel memory:

   sudo cryptsetup close secure_vault

3. Verify with lsblk that secure_vault is no longer mapped under the partition. The storage volume is now safely locked.

Automating Passphrase Unlocking at Boot via crypttab (Optional)

If the encrypted partition is an internal secondary drive that you want unlocked automatically during system startup:

• Find the partition’s unique UUID: sudo blkid -s UUID -o value /dev/sdb1
• Add a mapping rule inside /etc/crypttab:

  secure_vault UUID=YOUR-UUID-HERE none luks

• Add an entry inside /etc/fstab to mount the volume to /mnt/secure_vault. During boot, Ubuntu will prompt for the LUKS passphrase before mounting the filesystem.