What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
To encrypt a second disk on an Ubuntu VPS, identify the non-root block device, initialize it as a LUKS2 container with cryptsetup, open the dm-crypt mapping, create a filesystem on the mapping, and mount it. Add the LUKS UUID to /etc/crypttab and the filesystem UUID to /etc/fstab only after testing the manual workflow.
The procedure below assumes a separate, empty data volume such as /dev/sdb. Formatting the wrong device irreversibly destroys its existing data, so device identification and an out-of-band console are essential.
What you are creating
dm-crypt is the Linux device-mapper encryption layer. It encrypts and decrypts blocks as they pass between a physical or virtual block device and a filesystem. In normal Ubuntu administration, dm-crypt is used through LUKS (Linux Unified Key Setup), which adds a metadata header and managed key slots around the encrypted data.
Canonical’s Ubuntu Security Documentation describes LUKS as block-level disk encryption and explains that the volume key is itself encrypted and stored in the LUKS header at the beginning of the device. The header lets cryptsetup identify the container and validate a passphrase or another key slot. A LUKS2 container is the usual choice for a new Ubuntu data volume; Ubuntu documentation distinguishes LUKS1’s PBKDF2 setup from LUKS2’s Argon2-based configuration.
#1 Best Overall
- Get NVMe solid state performance with up to 1050MB/s read and 1000MB/s write speeds in a portable, high-capacity drive(1) (Based on internal testing; performance may be lower depending on host device & other factors. 1MB=1,000,000 bytes.)
- Up to 3-meter drop protection and IP65 water and dust resistance mean this tough drive can take a beating(3) (Previously rated for 2-meter drop protection and IP55 rating. Now qualified for the higher, stated specs.)
- Use the handy carabiner loop to secure it to your belt loop or backpack for extra peace of mind.
- Help keep private content private with the included password protection featuring 256‐bit AES hardware encryption.(3)
- Easily manage files and automatically free up space with the SanDisk Memory Zone app.(5). Non-Operating Temperature -20°C to 85°C
After the container is opened, Ubuntu exposes a decrypted device-mapper target, normally below /dev/mapper/. The filesystem belongs on that mapped device, not on the raw encrypted disk.
Requirements and safety checks
- An Ubuntu VPS with
sudoaccess and a separately attached block volume. - The volume must be disposable or backed up.
luksFormatwrites a new header and makes existing data inaccessible. - A strong passphrase stored in an approved password-management process. Losing both the passphrase and every alternative key slot means losing access to the data.
- A VPS provider console, rescue environment, or other out-of-band recovery path. A bad boot-time storage entry can leave SSH unavailable even when the encrypted disk itself is healthy.
- Enough free space for the LUKS metadata, filesystem metadata, and your data. Encryption is not a backup.
Do not use this procedure on the root disk unless you have a separate, tested migration plan. The examples use /dev/sdb and the mapping name securedata; substitute your own device only after verification.
How the layers fit together
- Block device: the VPS provider’s attached volume, for example
/dev/sdb. - LUKS2 container: the encrypted device with its header and key slots.
- dm-crypt mapping: an unlocked device such as
/dev/mapper/securedata. - Filesystem: ext4 in this example, created on the mapping.
- Mount point: the directory applications use, here
/srv/securedata.
When the mapping is closed, the filesystem cannot be read because its underlying device disappears. When it is open, encryption protects data at rest but does not prevent an authorized process from reading the mounted path.
Step 1: identify the correct volume
Attach the additional volume in your VPS control panel, then inspect the device tree and current mounts:
sudo lsblk -f
findmntLook for a device that is not mounted, is not the root device, and has the size and name expected from the provider. A typical candidate might be /dev/sdb, but device names vary across VPS platforms and can change after hardware or attachment changes.
Check the root filesystem explicitly before proceeding:
findmnt -no SOURCE,TARGET /
lsblk -o NAME,SIZE,FSTYPE,MOUNTPOINTSIf the candidate already has a filesystem, partitions, or a mount point containing data, stop and verify the provider’s documentation and your backup before doing anything destructive. The command in the next step will not ask whether the data is valuable; it only warns that the operation destroys existing contents.
Step 2: install cryptsetup
Install Ubuntu’s encryption tooling and refresh package metadata:
sudo apt update && sudo apt install cryptsetupConfirm that the command is available:
cryptsetup --versionDo not format the disk yet if the package installation reveals a repository, connectivity, or policy problem. Fix that first so you are not left with a half-completed storage setup.
Rank #2
- Solid state performance with up to 800MB/s read speeds in a portable drive. (Based on internal testing; performance may be lower depending on host device, interface, usage conditions and other factors. 1MB=1,000,000 bytes.)
- Back up your content and memories on a storage solution that fits seamlessly into your mobile lifestyle.
- Take it with you on your adventures—up to two-meter drop protection means this durable drive can take a beating. (Based on internal testing.)
- Secure it to your belt loop or backpack for extra peace of mind thanks to the tough rubber hook.
- From Sandisk, a brand professional photographers trust to take on assignments.
Step 3: initialize a LUKS2 container
Run luksFormat against the whole data device in this example:
sudo cryptsetup luksFormat --type luks2 /dev/sdbRead the destructive warning, type the confirmation requested by cryptsetup, and enter a long, unique passphrase twice. This operation creates the LUKS2 header and encrypted volume-key material. It does not create a usable filesystem and it does not mount anything.
LUKS is preferable to plain dm-crypt for most administrators because the metadata identifies the container and supports key-slot management. The Ubuntu cryptsetup(8) guidance states: “Unless you understand the cryptographic background well, use LUKS.” Plain dm-crypt has no comparable metadata layer; a wrong cipher, offset, or sector-size choice can make a correctly written disk impossible to reopen.
Record the device you formatted and the passphrase-handling procedure used by your team. Never put the passphrase in shell history, a ticket, an image, or an unprotected script.
Step 4: open the encrypted mapping
Unlock the new container and assign it a stable mapping name:
sudo cryptsetup open /dev/sdb securedataEnter the LUKS passphrase when prompted. A successful command creates:
/dev/mapper/securedataVerify the mapping and its relationship to the underlying disk:
sudo cryptsetup status securedata
sudo lsblk -fThe mapped device will not yet show a filesystem. That is expected. Do not run filesystem tools on /dev/sdb; the filesystem must be created on /dev/mapper/securedata.
Step 5: create and mount a filesystem
This example uses ext4. Create it on the unlocked mapping:
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #3
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
sudo mkfs.ext4 /dev/mapper/securedataCreate a mount point and mount the filesystem:
sudo mkdir -p /srv/securedata
sudo mount /dev/mapper/securedata /srv/securedataCheck both the active mount and available space:
findmnt /srv/securedata
df -h /srv/securedata
sudo lsblk -fAt this stage, write a test file and remove it to prove that applications can use the intended path:
sudo sh -c 'printf "%sn" test > /srv/securedata/.mount-test'
sudo cat /srv/securedata/.mount-test
sudo rm /srv/securedata/.mount-testSet ownership and permissions for the service that will use the directory instead of leaving sensitive application data broadly readable. Encryption does not replace Unix ownership, mode bits, ACLs, service isolation, or patching.
Step 6: capture the identifiers
Persistent configuration should use UUIDs rather than assuming that /dev/sdb will always receive the same device name. Obtain the LUKS UUID from the raw encrypted device:
sudo cryptsetup luksUUID /dev/sdbObtain the filesystem UUID from the mapped device:
sudo blkid /dev/mapper/securedataKeep the two identifiers distinct. The LUKS UUID identifies the encrypted container; the filesystem UUID identifies ext4 inside the unlocked mapping. Putting the filesystem UUID in crypttab, or the LUKS UUID in fstab, points each subsystem at the wrong layer.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Step 7: configure automatic activation with crypttab
Edit /etc/crypttab as root:
sudoedit /etc/crypttabAdd one line, replacing the placeholder with the exact value returned by cryptsetup luksUUID:
securedata UUID=<LUKS-UUID> none luksThe first field is the mapping name that will appear below /dev/mapper/. The second identifies the encrypted source. The third is the key source; none tells Ubuntu to request the passphrase interactively during activation. The final field contains cryptsetup options; luks declares that the source is a LUKS container.
Check spelling, capitalization, and whitespace. A typographical error can prevent activation and, depending on how the mount is configured, can affect boot progress.
Step 8: configure the filesystem in fstab
Edit /etc/fstab:
sudoedit /etc/fstabAdd a line using the filesystem UUID returned by blkid:
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →UUID=<FILESYSTEM-UUID> /srv/securedata ext4 defaults,nofail 0 2The mount point must already exist. nofail tells the boot-time mount process not to treat an unavailable data volume as a fatal boot failure; it does not solve a wrong UUID or a failed unlock. The final fields request the normal filesystem checks ordering used for a non-root ext4 filesystem.
Rank #4
- NEARLY 2X FASTER THAN OUR PREVIOUS GENERATION(8) – move 1,000 high-res photos in under 60 seconds(6) with up to 2000MB/s transfer speeds(2).
- IP65 RATING AND UP TO 3M DROP PROTECTION(3) – protects against spills and drops.
- POCKET-SIZED – fits easily in pockets and small bags.
- SPACE TO OWN YOUR AI CONTENT – speed and capacity to download your high-res clips and photo edits.
- 256-BIT AES ENCRYPTION(4) – helps keep private files secure with password protection.
Do not add the raw device or the LUKS UUID to this line. fstab should mount the filesystem exposed by the unlocked mapping.
Step 9: test the configuration without rebooting
First return to a locked state:
sudo umount /srv/securedata
sudo cryptsetup close securedataReload systemd’s generated unit information, then ask the configured mounts to activate:
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchsudo systemctl daemon-reload
sudo mount -aIf a passphrase prompt appears, enter the LUKS passphrase. Inspect the result:
sudo lsblk -f
findmnt /srv/securedata
df -h /srv/securedata
sudo journalctl -bA successful test shows the LUKS device, the securedata mapping, and the ext4 filesystem mounted at /srv/securedata. If mount -a reports an error, fix the configuration and repeat the unmount-close-test cycle before rebooting.
Only after a clean local test should you schedule a reboot. Keep the provider console or rescue access open while testing; an SSH session alone is not a recovery plan.
Step 10: back up the LUKS header
Create a protected header backup immediately:
sudo cryptsetup luksHeaderBackup /dev/sdb --header-backup-file /root/securedata.luks-headerThe LUKS header contains the encrypted volume-key information required for normal unlocking. Copy the backup to a separate, access-controlled location away from the VPS:
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorssudo chmod 600 /root/securedata.luks-headerThe command above only protects the local copy’s permissions; it does not encrypt the backup for transport or storage. Use your organization’s approved secure transfer and backup process, and restrict access because a header backup is sensitive recovery material. Protect the passphrase separately. A header without a valid passphrase, or a passphrase without an intact header, may not restore access to the data.
Manual passphrases versus unattended startup
The sample crypttab entry uses none, so an operator must supply the passphrase when the mapping is activated. This keeps the key out of the VPS filesystem but requires someone or something with console access during a reboot.
Unattended systems can use an automated key source, such as a carefully protected key file or an external secret-management and key-release system, if the organization accepts the added operational and compromise risk. Do not place a plaintext passphrase in a world-readable file or bake it into a machine image. Decide explicitly whether availability during an unattended reboot is more important than keeping the unlock secret out of the server.
Best Value
- Easily store and access 5TB of content on the go with the Seagate portable drive, a USB external hard Drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
| Unlock approach | Operational benefit | Primary trade-off |
|---|---|---|
| Interactive passphrase | The key is not stored on the VPS; an administrator can verify the request. | A reboot may wait for an operator and an out-of-band console. |
| Automated key source | Services can return after a reboot without manual intervention. | The key-release mechanism becomes part of the attack surface and recovery plan. |
LUKS2, plain dm-crypt, and other design choices
| Decision | What it changes | Practical choice for this procedure |
|---|---|---|
| LUKS2 versus plain dm-crypt | LUKS2 supplies a metadata header, UUID, and key-slot management. Plain dm-crypt has no equivalent metadata and is easier to misconfigure. | Use LUKS2 unless you have a specific, documented reason to manage raw dm-crypt parameters yourself. |
| Filesystem | The filesystem determines permissions, tooling, portability, and application behavior after decryption. | ext4 is used here because it is a standard Ubuntu choice; create the filesystem only on the opened mapping. |
| Local encryption versus provider-managed encryption | Local LUKS protects the guest-visible block contents and leaves key handling under your administration. Provider-managed encryption may shift some key custody and recovery responsibilities to the provider. | Clarify who can unlock, restore, snapshot, and decommission volumes before choosing a control boundary. |
| Passphrase versus automated unlock | Manual entry minimizes secrets stored on the VPS; automation improves unattended availability. | Choose according to your reboot, console, incident-response, and key-management requirements. |
Common failures and recovery paths
The wrong disk was selected
Stop immediately if lsblk or findmnt reveals that you formatted the root disk or a volume containing needed data. Do not continue mounting or writing. Preserve the device state, use the provider’s recovery options, and restore from a known-good backup. Encryption cannot undo an accidental format.
Recommended Free Tools
cryptsetup open says the passphrase is wrong
Check keyboard layout, capitalization, and whether the passphrase manager supplied the exact value. Do not repeatedly overwrite the device. If the passphrase is genuinely unavailable, test every documented key slot or recovery credential your organization maintains; otherwise the encrypted data may be unrecoverable.
The mapping opens but mounting fails
Verify that the filesystem was created on /dev/mapper/securedata, not on /dev/sdb. Run lsblk -f and inspect the filesystem type and UUID. A mapping with no filesystem, a damaged filesystem, or a filesystem created on the wrong layer will not mount correctly.
mount -a reports a UUID error
Re-run sudo cryptsetup luksUUID /dev/sdb and sudo blkid /dev/mapper/securedata. Compare each value with its corresponding line in /etc/crypttab and /etc/fstab. Ensure the mount directory exists and that the mapping name in crypttab matches the device referenced by the generated mount.
The VPS does not become reachable after reboot
Use the provider console or rescue environment rather than repeatedly rebooting. Inspect journalctl -b and the storage configuration, correct the malformed entry, and test again. Keeping nofail on a non-root data mount reduces the chance that an unavailable volume blocks the rest of the boot, but it does not make an invalid configuration correct.
cryptsetup close says the device is busy
Find and stop processes using the mount, leave the directory in other shells, and unmount it before closing the mapping:
findmnt /srv/securedata
sudo umount /srv/securedata
sudo cryptsetup close securedataDo not force-close an active mapping while applications are writing; that can cause filesystem or application-level corruption.
Operating the volume after setup
Before maintenance, identify the active layers:
sudo lsblk -f
findmnt /srv/securedata
sudo cryptsetup status securedataTo shut down cleanly, stop applications that use the directory, unmount the filesystem, and close the mapping. To bring it back, open the LUKS device, then mount the filesystem. The same passphrase and mapping name used during setup must match the persistent configuration.
Include the encrypted volume in backup jobs only after confirming that the backup agent runs while the filesystem is intentionally unlocked. A backup of an inaccessible raw encrypted disk is not automatically a usable file-level backup, and a snapshot policy must account for whether the guest has flushed application data before capture.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteWhat dm-crypt does—and does not—protect
This setup provides encryption at rest for the selected disk or partition. It helps protect data when the underlying block volume, snapshot, or detached disk is examined without the unlock secret. It does not protect data while the mapping is open from:
- A root user or compromised process on the VPS.
- An application account that has permission to read
/srv/securedata. - Stolen application credentials, exposed backups, or insecure exports.
- Weak file permissions, unpatched software, or a compromised provider control plane.
Use least-privilege service accounts, restrictive directory permissions, patching, monitoring, tested backups, and provider security controls alongside encryption. Treat the passphrase, LUKS header backup, console credentials, and backup keys as separate assets with separate access controls.
Quick Recap
Final validation checklist
- The encrypted device is a separate data volume, not the root disk.
cryptsetup luksFormat --type luks2was run only after confirming the target.- The mapping opens as
/dev/mapper/securedata. - The ext4 filesystem was created on the mapping and mounts at
/srv/securedata. /etc/crypttabcontains the LUKS UUID, while/etc/fstabcontains the filesystem UUID.- The unmount, close,
daemon-reload, andmount -atest completed without errors. - A provider console or rescue route is available before rebooting.
- A protected LUKS header backup exists off the VPS, and the passphrase is recoverable through your approved process.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
