Setting Up Encrypted Partitions with Bootable Linux, GRUB, and LUKS on a Single SSD

In today's digital world, securing data is a top priority. One effective way to protect your data is by using encrypted partitions. This article aims to guide you through the process of setting up encrypted partitions on a single SSD, focusing on a bootable Linux system using GRUB and LUKS encryption.

Prerequisites

Before we begin, ensure that your system meets the following requirements:

Single SSD with multiple partitions (e.g., one for Windows 11 and various data)
Linux distribution installed alongside Windows 11
Basic understanding of Linux terminal commands

Setting up Encrypted Partitions

Partitioning the SSD

First, we need to create partitions for our Linux system and encrypted data. Use a partitioning tool like GParted or fdisk to create partitions. For this example, we'll create two partitions: one for the Linux system (/dev/sda1) and another for encrypted data (/dev/sda2).


 sudo fdisk /dev/sda

Formatting the Partitions

Format the Linux partition as an ext4 filesystem and the encrypted partition as a LUKS container.


 sudo mkfs.ext4 /dev/sda1
 sudo cryptsetup luksFormat /dev/sda2

Creating an Encrypted Volume

Now, create an encrypted volume on the LUKS container and format it as an ext4 filesystem.


 sudo cryptsetup luksOpen /dev/sda2 linux_data --format=ext4

Setting up the Bootloader

Installing GRUB

Install GRUB as the bootloader. This step assumes that you have already installed the Linux distribution alongside Windows 11.


 sudo apt install grub-pc grub-pc-bin grub-lts
 sudo grub-install /dev/sda

Configuring GRUB

Edit the GRUB configuration file to include the encrypted partition.


 sudo nano /etc/default/grub

Add the following lines at the end of the file:

 GRUB_CMDLINE_LINUX_DEFAULT="cryptdevice-auto=target=/dev/mapper/linux_data source=/dev/sda2,keyfile=/etc/crypttab/linux_data.key"

Save and close the file, then update the GRUB configuration:


 sudo update-grub

Setting up the Encrypted Partition

Creating a Keyfile

Create a keyfile to unlock the encrypted partition at boot.


 sudo dd if=/dev/urandom bs=1024 count=1 | sudo tee /etc/crypttab/linux_data.key

Mounting the Encrypted Partition

Create a mount point for the encrypted partition and mount it.


 sudo mkdir /mnt/encrypted_data
 sudo mount /dev/mapper/linux_data /mnt/encrypted_data

In this article, we walked through the process of setting up encrypted partitions on a single SSD, focusing on a bootable Linux system using GRUB and LUKS encryption. We created partitions, formatted them, installed GRUB, and configured it to include the encrypted partition. Finally, we created a keyfile and mounted the encrypted partition.