luks volume disappears after reboot

Question

I created a separate partition on a CentOS install (VirtualBox), and am attempting to encrypt it using cryptsetup and LUKS.

I'm using the following commands to get this set up:

cryptsetup luksOpen /dev/mapper/VolGroup-db00 db_fips (no error, all clear)
mkfs -t ext4 /dev/mapper/db_fips (no error, all clear)
e2fsck -f /dev/mapper/db_fips

e2fsck 1.41.12 (17-May-2010)
Pass 1: Checking inodes, blocks, and sizes
Pass 2: Checking directory structure
Pass 3: Checking directory connectivity
Pass 4: Checking reference counts
Pass 5: Checking group summary information
/dev/mapper/db_fips: 11/131072 files (0.0% non-contiguous), 17196/523776 blocks

Ok, the volume is created.
So next I reboot.

After logging in, the /dev/mapper/db_fips volume is gone.

[root@dhcp ~]# ll /dev/mapper/db_fips/

ls: cannot access /dev/mapper/db_fips/: No such file or directory

# lvs
  LV       VG       Attr       LSize    Pool Origin Data%  Meta%  Move Log Cpy%Sync Convert
  LogVol01 VolGroup -wi-ao----    1.46g                                                    
  LogVol02 VolGroup -wi-ao----  500.00m                                                    
  LogVol03 VolGroup -wi-ao---- 1000.00m                                                    
  LogVol04 VolGroup -wi-ao----  500.00m                                                    
  LogVol05 VolGroup -wi-ao----  300.00m                                                    
  LogVol06 VolGroup -wi-ao----    3.00g                                                    
  db00     VolGroup -wi-a-----    2.00g           

Why is the db_fips volume I just created gone?

/dev/mapper/VolGroup-db00 still exists, and shows to be encrypted (?)

blkid /dev/mapper/VolGroup-db00 
/dev/mapper/VolGroup-db00: UUID="some uuid" TYPE="crypto_LUKS" 

If /dev/mapper/VolGroup-db00 is what I actually encrypted, why did I need to issue cryptsetup /dev/mapper/VolGroup-db00 luksOpen db_fips, and why is that no longer available?

Answer 1

Creating an encrypted volume does just that: create an encrypted volume on the disk. Using the volume on your live system is a concept that only makes sense as long as the system remains live: it needs to be done all over again if the system reboots. So you need to arrange for the volume to be brought up during the system startup. To do that, list it in the file /etc/crypttab. Add a line like this:

db_fips /dev/VolGroup/db00

Your system startup scripts will take care of calling cryptsetup luksOpen; you'll be prompted for the password. This is analogous to listing a filesystem in /etc/fstab so that it is mounted during startup.