Here's the scenario: I have a backup server that currently has a (unencrypted) logical backup volume that expands over two physical disks. I need to be able to expand the volume by adding more disks. I would like to encrypt that backup volume now and I am not clear what the best way to do this would be. From what I read, Luks does not seem to work well, or not work at all, with multi-disk LVMs. To me the best solution would look like a container within the backup volume, e.g. with VeraCrypt, but that container also needs to be expandable in case I want to add more disks to the volume. Maybe ecryptfs, but I'm not sure if that works well for directories other than the home folder. So, any advice for this scenario would be highly appreciated! Thanks :)

  • For servers with variable drives size/number over time, it's better to encrypt the data, not the drives. Put the data in encrypted containers (tar, img, iso, etc) and put them on to the unencrypted server drives. Data is still secure, while server drives can be swapped out as needed. – Mioriin Jan 27 '18 at 1:33
  • Both LUKS on LVM and LVM on LUKS are viable options. It's a matter of taste. – frostschutz Jan 27 '18 at 1:34
  • Might want to read cryptsetup's FAQ 2.2 LUKS on partitions or raw disks? - LUKS on top of LVM/RAID looks easier (automatic assembly & easier debugging lvm/raid). – Xen2050 Feb 25 '18 at 19:45

Luks should work, with some configuration. Depends on if you want it mounted on boot or manually. Ecryptfs is what I use daily and it works with every folder, the results for the home folder are no different for another folder. While using lvm with luks it is possible to add disks and expand the volume you will need to manually encrypt the other disk, open the disk and then format using lvm

  • I wanted to place this as comment and not as answer – Matthias Hoste Jan 27 '18 at 21:42
  • And i cant remove it on phone – Matthias Hoste Jan 27 '18 at 21:42
  • 1
    I found out in the meatime that I can create a volume group first and then luks-encrypt the resulting logical volume, while still being able to expand it, which is basically what I wanted. Thanks for your answers! – maks Jan 28 '18 at 1:50
  • Glad to hear you were able to fix it – Matthias Hoste Jan 28 '18 at 1:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.