Encrypting KVM QCOW2 Disk Images with LUKS

~ Tom's IT Cafe

An important aspect of virtualization is ensuring the security of the disk images used by VMs. Encrypting these disk images helps protect sensitive data from unauthorized access. This post will guide you through the process of encrypting a KVM QCOW2 disk image using LUKS (Linux Unified Key Setup).

Before we begin, ensure you have the following:

  1. A Debian 12 system with KVM and QEMU installed.
  2. Basic knowledge of command-line operations.
  3. Administrative (root) access to your Debian 12 system.

Create a QCOW2 disk image

Create a QCOW2 disk image for your virtual machine. If you already have a disk image, you can skip this step. Otherwise, use the qemu-img command to create a new disk image:

qemu-img create -f qcow2 /var/lib/libvirt/images/encrypted-disk.qcow2 20G

This command creates a 20GB QCOW2 disk image at the specified path.

Setup LUKS encryption

Now, initialize the LUKS encryption on the disk image. This process will erase all existing data on the disk, so ensure you are using a new disk image or have backups of any important data.

sudo cryptsetup luksFormat /var/lib/libvirt/images/encrypted-disk.qcow2

You’ll be prompted to confirm the action and set a passphrase. Choose a strong passphrase and remember it, as you’ll need it to access the encrypted disk.

Open the encrypted disk

To use the encrypted disk, you need to open it and map it to a virtual device. Use the following command:

sudo cryptsetup open /var/lib/libvirt/images/encrypted-disk.qcow2 encrypted_disk

You’ll be prompted to enter the passphrase you set earlier. After successfully entering the passphrase, the encrypted disk will be available as /dev/mapper/encrypted_disk.

Format the mapped device

Next, format the mapped device with a filesystem of your choice. For example, to format it with the ext4 filesystem, use:

sudo mkfs.ext4 /dev/mapper/encrypted_disk

Step 6: Use the Encrypted Disk in a Virtual Machine

Now, you can use the encrypted disk image in your virtual machine. Open Virt-Manager or use virsh commands to attach the disk image to your VM. If using Virt-Manager, follow these steps:

  1. Open Virt-Manager and select your VM.
  2. Go to the VM’s settings and navigate to the “Add Hardware” section.
  3. Choose “Storage” and select the existing disk image.
  4. Browse to /var/lib/libvirt/images/encrypted-disk.qcow2 and add it.

Automate opening the encrypted disk at boot (Optional)

To automate the process of opening the encrypted disk at boot, you can add an entry to /etc/crypttab. Open the file in a text editor:

sudo nano /etc/crypttab

Add the following line:

encrypted_disk /var/lib/libvirt/images/encrypted-disk.qcow2 none luks

This ensures the encrypted disk is opened automatically at boot. However, you will need to provide the passphrase during the boot process unless you configure a key file.

Encrypting your KVM QCOW2 disk images with LUKS on Debian 12 provides an additional layer of security, protecting your data from unauthorized access. This guide has walked you through the process of creating an encrypted disk image, setting up LUKS encryption, and using the encrypted disk in your virtual machines. By following these steps, you can enhance the security of your virtualized environment effectively.

Leave a comment