Hands-on Lab·LPIC-2
An encrypted volume, and what the header holds
Objective 203.3 names encrypted filesystems and the path had nothing on them. This guide formats a LUKS2 container, opens it, puts a filesystem inside, adds a second passphrase, backs up the header that holds the master key, closes it, and shows exactly what an unopened container discloses - then writes the crypttab line that would open it at boot.
201: Filesystems and Storage Guide 26 of 29 Intermediate
- OSUbuntu 26.04 LTS
- Kernel7.0.0-30-generic
- systemd259
- Block devicesone 50 GB disk
- TimeAbout 26 min
| Server Name | IP Address | OS | Roles | CPU | RAM | HDD |
|---|---|---|---|---|---|---|
| LPIC2-A01 | 192.168.0.78 | Ubuntu 26.04 LTS | Primary service host - BIND, Apache, Samba, Postfix. Topic 204 RAID runs on loop devices; this machine has no spare disk | 2 Core | 4 GB | 50 GB |
This guide includes
Use this when data has to survive the disk leaving the building. This matters because the passphrases do not encrypt anything - they unlock a master key stored only in the header, so losing that header loses the data even if every passphrase is known.
- formatting a device as LUKS2 and reading its header back
- opening it, and seeing the mapper device the filesystem actually goes on
- measuring what the encryption layer costs, from raw device to usable filesystem
- adding a second passphrase into a second key slot, and backing up the header
- closing it, and finding what the disk still says about itself
Before you start
- lvm-on-a-real-disk
-
A device to encrypt
-
Formatting it as a LUKS container
-
Opening it, and what appears when you do
-
A second passphrase, and what the header holds
-
Closing it, and what is left on disk
-
The crypttab line that would open it at boot
-
Putting the machine back