If i’m rebuilding an encrypted RAID 1 with the whole array encrypted with LUKS, if I decrypt the array to use it, will the data still be encrypted, or will the array rebuild decrypted?


This looks like a misunderstanding, or possibly incorrect terminology.

I'm assuming that "encrypted RAID 1 with the whole array encrypted with LUKS" you mean that you've first built up a RAID array out of physical /dev/sd* devices, creating an array device, and then set up a LUKS encryption on top of the array device. It is possible to do it the other way too (i.e. first encrypt a number of devices, then RAID on top of the encrypted devices).

You don't need to decrypt the array to use it: you need to open it.

cryptsetup luksOpen will not decrypt the data on the disk. It adds a device-mapper dm-crypt layer on top of the encrypted disk/array that decrypts anything you read from the disk on the fly, and also encrypts everything you write through it. As a result, you can use the resulting mapped device just like a regular, unencrypted disk or array. The data on the disk is still encrypted.

If the underlying disk is a RAID array, you just need to take care not to mix any mapped devices "above" the encryption layer with the ones "below" it. That should not be too difficult, as the software RAID 1 works with a similar principle: there is a device-mapper raid1 layer with the component devices "below" it and the device representing the whole array "above" it. The aim is that the array device can be used just the same regardless of whether the devices "below" are fully intact or undergoing a rebuild.

The dmsetup ls --tree -o blkdevname command can be helpful in understanding the storage configuration if you're using RAID, disk encryption, LVM and/or multipathing in a combination.

If you've done it the other way (i.e. RAID "on top of" the encryption layer), then you'll need to first re-establish the encryption layer on the replacement disk before letting the array rebuild on it. In that case it would be possible to accidentally omit the encryption layer on the replacement RAID component device and let the array rebuild unencrypted on a /dev/sd* device.


I depends on... If you use software RAID on top of dm-crypt block devices and the new drive is not dm-crypted, then you have an issue. In any other case it is safe to rebuild as far as I know.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.