Objective

This lab demonstrates how Linux Full Disk Encryption (LUKS) works and what it protects against.

Part 1 - Attack Scenario (Unencrypted Disk)

Step 1 - Identify disk

lsblk

Step 2 - Create filesystem (no ecnryption)

sudo mkfs.ext4 /dev/sdc

sdc

Step 3 - Mount disk

sudo mkdir /mnt/test
sudo mount /dev/sdc /mnt/test

mount_sdc

Step 4 - Add sensitive data

echo "Sensitive data" | sudo tee /mount/test/secret.txt

ATTACK SIMULATION

Step 1 - Direct mount attempt

sudo mkdir /mnt/attack; sudo mount /dev/sdc /mnt/attack
ls -l /mnt/attack
cat /mnt/attack/secret.txt

exposed_data

Part 2 - LUKS Encryption Setup (Defense)

Step 1 - Identify target disk

lsblk

Find: target -> sdb (2.9G)

sdb

Step 2 - Initialize LUKS encryption

sudo cryptsetup luksFormat /dev/sdb

luks_init

Step 3 - Unlock encrypted disk

sudo cryptsetup luksOpen /dev/sdb secure_disk
ls /dev/mapper

unlock

This creates: /dev/mapper/secure_disk

Step 4 - Create filesystem

sudo mkfs.ext4 /dev/mapper/secure_disk

filesystem

Step 5 - Mount filesystem

sudo mkdir /mnt/secure
sudo mount /dev/mapper/secure_disk /mnt/secure

mount

Step 6 - Store secret data

echo "TOP SECRET DATA" | sudo tee /mnt/secure/secure/secret.txt

Step 7 - Unmount filesystem and close encrypted disk

sudo umount /mnt/secure
sudo cryptsetup luksClose secure_disk

close

Part 3 - Attack against LUKS Disk

Attacker steals /dev/sdb

Step 1 - Try direct mount

sudo mkdir /mnt/attack2; sudo mount /dev/sdb /mnt/attack2

Step 2 - Try unlocking encrypted disk

sudo cryptsetup luksOpen /dev/sdb

faile_attempt

Part 4 - Legitimate Unlock Process

Step 1 - Unlock disk

sudo cryptsetup luksOpen /dev/sdb secure_disk

Enter passphrase.

Step 2 - Mount

sudo mount /dev/mapper/secure_disk /mnt/secure

Step 3 - Read data

cat /mnt/secure/secret.txt

Key Security Insight

LUKS protects:

  • Data at rest
  • Stolen disks
  • Offline attacks

LUKS does NOT protect:

  • Already-unlocked system
  • Root user after login
  • Weak passphrases
  • RAM extraction attacks