Learn Rocky Linux 10 LUKS encryption to create, open, mount, verify, and safely close an encrypted block device.

Introduction

This tutorial shows how to apply LUKS encryption to a dedicated server block device on Rocky Linux 10, then format, open, mount, verify, and close the mapped volume cleanly. It is aimed at administrators who need a straightforward, device-level encryption workflow for data volumes that must remain under operational control.

If you are planning storage changes on a dedicated server, it is useful to confirm your backup process first. For a related validation workflow, see Backup Verification on Ubuntu 26.04 and AlmaLinux 10.

Prerequisites

• Rocky Linux 10 installed on the dedicated server
• Root access, or a normal administrative user with sudo privileges
• An unmounted target block device that will be encrypted
• Local console or remote access with a trusted way to enter the LUKS passphrase
• Network access only if your environment still needs package installation or updates

Tutorial steps

Identify the target block device

Before formatting anything with LUKS, confirm exactly which device you intend to encrypt. Use lsblk to inspect the block layout, then use blkid to check whether the device already contains a filesystem or existing signatures.

lsblk

blkid

Choose a device that is not in use and does not contain data you need to preserve. The device path should be verified carefully before proceeding.

Create the LUKS container

Once you have confirmed the correct device, initialize it as a LUKS container. Replace /dev/sdX with the actual block device you identified.

cryptsetup luksFormat /dev/sdX

Follow the prompt to confirm the operation and set the passphrase. This step writes the encryption metadata to the device and is destructive to any existing contents.

Open the encrypted volume

After the container is created, open it to create a mapped device under /dev/mapper. Choose a mapping name that matches your storage naming convention.

cryptsetup open /dev/sdX encrypted_data

The mapped device will be available as /dev/mapper/encrypted_data.

Create a filesystem and mount point

Format the mapped encrypted volume with XFS, then create a mount point directory for it.

mkfs.xfs /dev/mapper/encrypted_data

mkdir -p /mnt/encrypted_data

Mount the encrypted filesystem

Mount the new filesystem on the mount point so it is ready for use.

mount /dev/mapper/encrypted_data /mnt/encrypted_data

At this point the encrypted block device is open, formatted, and mounted on Rocky Linux 10.

Verification

Verify the open mapping, filesystem type, and mount status before putting the volume into service. Start by checking the LUKS mapping state.

cryptsetup status encrypted_data

Then confirm the filesystem is mounted and that the encrypted mapping appears in the block-device listing.

findmnt /mnt/encrypted_data

lsblk -f

You should see the mount point associated with /dev/mapper/encrypted_data, and the filesystem type should be reported as XFS. The cryptsetup status output should show the mapping as active.

Troubleshooting

If cryptsetup luksFormat warns about an existing filesystem or signature, stop and recheck the device selection with lsblk and blkid. That usually means the wrong block device was chosen.

If cryptsetup open fails, confirm the passphrase is correct and that the device still contains valid LUKS metadata. If the mapping name already exists, choose a different name or close the existing mapping before retrying.

If mount fails after formatting, verify that the filesystem was created on the mapped device, not on the raw block device, and confirm that the mount point directory exists.

Rollback

To safely undo the configuration, unmount the filesystem first, then close the encrypted mapping. This leaves the LUKS container on the device but removes the active mount and mapping.

umount /mnt/encrypted_data

cryptsetup close encrypted_data

After rollback, verify the mapping is closed by checking that cryptsetup status encrypted_data no longer reports an active device and that lsblk -f no longer shows the mapper entry in use.

Conclusion

You have now completed Rocky Linux 10 LUKS encryption for a dedicated server block device, including creation, opening, formatting, mounting, verification, and safe closure. After following this process, you can verify that the encrypted mapping opens correctly, mounts as XFS, and closes cleanly when unmounted.