4

I have two hard drives in a volume group with LVM. All volumes in that volume group hold LUKS containers. If I add an SSD as an LVM cache to that volume group, is all data on the cache device encrypted?

Bonus points for tools that confirm the cache's content.

4

If I add an SSD as an LVM cache to that volume group, is all data on the cache device encrypted?

Yes, it's encrypted because LVM cache works with blocks directly. It has no idea what the underlying data is.

Bonus points for tools that confirm the cache's content.

Fire up any hex editor (hexedit, dhex, etc) and open your logical volume directly. Encrypted data should look like noise.

5

Since you are caching the LUKS-container, your cache is also encrypted, yes.

I'm using a different setup, where my pv (the acual one and the one used as cache) is on top of luks.

Unencrypted LVM without cache:

[Disk 1  ]
[PV Data ]
[VG      ]
[LV      ]
[Filesyst]

Unencrypted with LVM cache:

[Disk 1  ] [Disk 2   ]
[PV Data ] [PV Cache ]
[VG                  ]
[LV      ]-----------]
[Filesyst]

Yours:

[Disk 1  ] [Disk 2   ]
[PV Data ] [PV Cache ]
[VG                  ]
[LV      ]-----------]
[LUKS    ]
[Filesyst]

Mine:

[Disk 1  ] [Disk 2   ]
[LUKS    ] [LUKS     ]
[PV Data ] [PV Cache ]
[VG                  ]
[LV      ]-----------]
[Filesyst]

Both variants are encrypting fine, I couldn't find any recommendation for putting LVM on top of LUKS or the other way around, so I used the fedora default which installs LVM on top of LUKS. (If I remember right, Debian has the other variant as default)

defect, encrypted data, unencrypted cache:

[Disk 1  ] [Disk 2   ]
[LUKS    ] ⎡ unenc   ⎤
[PV Data ] ⎣PV Cache ⎦
[VG                  ]
[LV      ]-----------]
[Filesyst]

not really for the bonus-points: you can try running photorec on the cache-device. But this would only proof that the cache is defect if you can find something, not that the cache is encrypted if you don't. It makes it even harder because the LVM-Cache doesn't need to save the data ordered/“defragmentated”.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.