Windows VPS Backup and Restore: VSS, System State, and File-Level

In this guide, you will learn to encrypt storage VPS with LUKS and an automated unlock strategy. LUKS is the standard method for encrypting disk drives and storage volumes on Linux systems.

Using encryption-at-rest on a High Storage VPS keeps your stored data private, while still letting the server reboot and mount the disk automatically. You can follow this guide to encrypt a second drive with LUKS and set up a secure local keyfile so it can unlock itself during boot.

To encrypt storage VPS with LUKS, your server must be running a modern Linux operating system, such as Ubuntu, Debian, AlmaLinux, or Rocky Linux. We highly recommend using a Storage VPS from a reliable provider like PerLod Hosting for optimal performance.

Also, you will need:

• root privileges.
• The cryptsetup package installed on your system.
• An unformatted secondary block device attached to your VPS. In this guide, we use /dev/vdb.

Once you are done, proceed to the following steps to encrypt storage VPS with LUKS.

The first step is to format the secondary block device with a LUKS header. To do this, you can run the command below:

You will be prompted to create an initial, manual recovery passphrase.

Once you have finished formatting, you must decrypt and map the volume to a virtual device. You can open the LUKS device and map it to secure_storage:

At this point, you have unlocked and mapped the volume to /dev/mapper/secure_storage. Now you must create a filesystem on it before it can store data.

Create the EXT4 filesystem with the following command:

Then, create a target directory, and mount the volume by running the commands below:

To let the server unlock the drive automatically, you must generate a random keyfile for LUKS. Also, this file must be protected with strict permissions, so only the root user can read it.

Generate a 4KB random keyfile for LUKS with the command below:

Restrict permissions to root only with the following command:

You need to add the keyfile to the LUKS drive so it can unlock the volume. When you run this command, it will ask for the password you set in Step 1 to confirm the change.

Add the keyfile to the LUKS authorized keys with the command below:

During boot, the system reads /etc/crypttab to know which encrypted volumes to unlock and how to unlock them. You can use the drive's unique ID, UUID, instead of /dev/vdb. This prevents boot errors if the system ever changes the drive letters.

Find the UUID of your storage volume:

Open /etc/crypttab with your desired text editor:

Add the following line to /etc/crypttab with your actual UUID:

Once crypttab unlocks the volume, /etc/fstab handles mounting the decrypted filesystem to your desired directory. You can open /etc/fstab with your desired text editor:

To ensure the unlocked mapper device mounts on boot, add the following line to the /etc/fstab file:

Before you reboot your server, it is recommended to test your configuration to prevent potential lockouts. You can unmount the directory, close the LUKS device, and then attempt to reopen it using only the keyfile to ensure the automation works correctly.

Unmount and lock the volume with the commands below:

Test unlocking with the keyfile:

Also, test automatic mounting from fstab:

If the mount -a command succeeds without errors, your automated unlock strategy is fully operational.

By following these steps, you have successfully completed an encrypt storage VPS with LUKS configuration. This keeps your data safe from physical theft while allowing your server to reboot and mount the drive automatically. This setup on your High Storage VPS gives you strong security without any extra tasks. Just be sure to save your manual password offline, so you can always access your data if the keyfile is lost.

We hope you enjoy this guide. Subscribe to our X and Facebook channels to get the latest updates and articles.

For further reading:

Create a Download Server with Aria2 and Nginx

Set up Nextcloud on a High Storage VPS