AlmaLinux 10 LUKS Disk Encryption

This tutorial shows how to configure LUKS disk encryption on AlmaLinux 10 for a data or secondary disk on a dedicated server. You will initialize the disk with LUKS, open the encrypted device, create a filesystem, mount it persistently, verify that it stays accessible across remounts, and roll back the change safely if needed.

The steps focus on a single block device so you can apply encryption to storage that holds application data, backups, or other non-root datasets without changing your existing system layout.

Prerequisites

AlmaLinux 10 installed on the dedicated server.
Root access or a normal administrative user with sudo privileges.
A secondary disk that can be dedicated to encrypted data.
Kernel support for device-mapper and LUKS.
Network access if you need to install or update the required tools.
Familiarity with the disk name you intend to encrypt.

Tutorial steps

Before you start, identify the target disk carefully. The commands below operate directly on the selected block device and will destroy any existing data on it.

lsblk

Review the output and choose the correct non-system disk. If you want to confirm the current partition or filesystem state before proceeding, use:

blkid

Initialize LUKS on the target disk. Replace /dev/sdX with the actual device name you identified.

cryptsetup luksFormat /dev/sdX

After you confirm the passphrase, open the encrypted device so it appears under /dev/mapper/.

cryptsetup open /dev/sdX encrypted_data

Create a filesystem on the mapped LUKS device. For this tutorial, use XFS:

mkfs.xfs /dev/mapper/encrypted_data

If your deployment requires ext4 instead, use the ext4 command on the same mapped device:

mkfs.ext4 /dev/mapper/encrypted_data

Create a mount point for the encrypted volume.

mkdir -p /mnt/encrypted-data

Mount the filesystem and confirm the volume is usable.

mount /dev/mapper/encrypted_data /mnt/encrypted-data

To make the mount persistent, back up the current crypttab and fstab files before editing them.

cp /etc/crypttab /etc/crypttab.bak

cp /etc/fstab /etc/fstab.bak

Add an entry for the encrypted device in /etc/crypttab that maps the source disk to the chosen name encrypted_data. Then add the corresponding mount entry in /etc/fstab for /mnt/encrypted-data. Keep the entries consistent with the device name you opened and the filesystem you created.

After saving both files, reload the system manager configuration so the updated mount metadata is recognized.

systemctl daemon-reload

If you need to inspect the resulting configuration, review the files directly:

cat /etc/crypttab

cat /etc/fstab

Verification

Verify that the disk is encrypted by checking the LUKS header on the original block device.

cryptsetup luksDump /dev/sdX

You can also verify that the volume is accessible only through the mapped device under /dev/mapper/:

lsblk

The mapped name should appear as an unlocked device, and the mounted filesystem should show up on the expected mount point.

mount

Check that the persistent configuration is present and ready for reboot-safe activation by reviewing both files again:

cat /etc/crypttab

cat /etc/fstab

To confirm the setup survives a remount cycle, unmount the filesystem, close the mapping, reopen it, and mount it again.

umount /mnt/encrypted-data

cryptsetup close encrypted_data

cryptsetup open /dev/sdX encrypted_data

mount /dev/mapper/encrypted_data /mnt/encrypted-data

After the remount, verify that access still works and that the encrypted volume appears in both lsblk and mount output.

Troubleshooting

If cryptsetup open fails, recheck the source device name and confirm you are targeting the same disk that was initialized with LUKS. A mismatched device or an already-used disk path is the most common cause of failure.

If the mount fails after reboot or reload, inspect /etc/crypttab and /etc/fstab for an incorrect mapper name, mount point, or filesystem type. The device name in both files must match the name supplied to cryptsetup open.

If the filesystem type does not match the one you created, the mount will fail even if LUKS opens successfully. Use the filesystem command that matches the intended layout, then update the mount entry accordingly.

Rollback

To remove the encrypted data disk configuration, unmount the filesystem, close the mapper, and restore the saved configuration files if you modified them for this volume.

umount /mnt/encrypted-data

cryptsetup close encrypted_data

If you need to remove the LUKS metadata from the disk itself, erase the header only after you are certain the data is no longer needed.

cryptsetup luksErase /dev/sdX

After erasing the LUKS header, the disk no longer opens as an encrypted volume and can be reused for a different purpose.

Conclusion

You have configured AlmaLinux 10 LUKS disk encryption for a dedicated server data disk, opened the encrypted volume, created a filesystem, mounted it persistently, and validated that access survives a remount. You can now verify the encrypted device through /dev/mapper/, confirm the mount in lsblk and mount, and use the same layout with confidence on AlmaLinux 10.