Encrypt the disks holding the system and data

Description

With LUKS (dm-crypt), each partition or LVM volume group is encrypted with a key unlocked at boot, by a passphrase, a TPM or a key server. The Debian installer sets it up with the "Guided - use entire disk and set up encrypted LVM" partitioning method. Only /boot and the EFI system partition stay in clear text.

The check covers every mounted ext2/3/4, XFS, Btrfs, F2FS and JFS file system except /boot and below, and every swap partition or swap file; zram swap is in memory and skipped. A device that is not a block device (ZFS dataset, network file system) makes the check report an error, to be reviewed by hand.

Rationale

Laptops and workstations are lost and stolen, and disks leave with returned or discarded hardware. Without encryption, the data, the password hashes and the keys on the disk can be read, and the system can be modified offline (for example to plant a backdoor) without any trace.

Impact

A passphrase must be typed at every boot, unless a TPM or network unlock is set up, which makes unattended reboots harder. Encrypting an existing system requires a reinstallation or an offline conversion. Performance cost is negligible on CPUs with AES instructions.

Setting

Audit

Run lsblk -o NAME,TYPE,FSTYPE,MOUNTPOINTS. Every mounted file system except /boot and /boot/efi, and every swap, must sit below a device of type crypt.

Automated: every check must pass. Scanners report each check by its id.

crypt

dm-crypt below each mounted disk file system and swap.

script: |
  rc=0 n=0
  list=$(findmnt -rn -o SOURCE,TARGET -t ext2,ext3,ext4,xfs,btrfs,f2fs,jfs
         swapon --noheadings --show=NAME,TYPE 2>/dev/null | while read -r name type; do
           case $type in
             partition) echo "$name swap" ;;
             file) echo "$(findmnt -n -o SOURCE -T "$name") swap:$name" ;;
           esac
         done)
  while read -r src target; do
    [ -n "$src" ] || continue
    case $target in /boot | /boot/*) continue ;; esac
    case $src in /dev/zram*) continue ;; esac
    dev=${src%%\[*}
    n=$((n + 1))
    if ! t=$(lsblk -nso TYPE "$dev" 2>/dev/null); then
      echo "$target on $src: not a block device, check by hand"
      [ "$rc" = 1 ] || rc=3
    elif ! printf '%s\n' "$t" | grep -qx crypt; then
      echo "$target on $src: not encrypted"
      rc=1
    fi
  done <<EOF
  $list
  EOF
  [ "$rc" = 0 ] && echo "$n file systems and swaps, all on dm-crypt"
  exit "$rc"

Remediation

Encryption cannot be added safely to a running system by a script.

1. For a new system, choose "Guided - use entire disk and set up encrypted LVM" in the Debian installer, or create LUKS2 volumes with cryptsetup luksFormat and list them in /etc/crypttab.
2. For an existing system, back up the data, reinstall with encryption and restore; or convert offline with cryptsetup reencrypt --encrypt from a live system, after a full backup.
3. Encrypt swap as well (inside the encrypted LVM, or with a random key in /etc/crypttab).
4. Keep a recovery passphrase in a safe place, separate from the device.

References

• crypttab(5), Debian manual pages Debian, vendor-doc, accessed 2026-10-18
• cryptsetup(8), Debian manual pages Debian, vendor-doc, accessed 2026-10-18
• Cryptsetup and LUKS on Debian (README.Debian) Debian, vendor-doc, accessed 2026-10-18

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

People and lifecycle