Enable Encryption
To ensure that you are aware of the requirements for encrypting volumes, read the information in Encryption of Data at Rest.
- If you lose the passphrase for the master encryption key or if you lose access to the external key manager, data in the encrypted volumes cannot be retrieved.
- Once it has been set, the encryption status of a volume cannot be changed.
Enabling encryption using the default group encryption settings
(encryption_cipher = aes-256-xts, encryption_scope = group, and encryption_mode =
available). Here you have the option of using the encryptkey
--create_master
command to enable encryption with local key management
or setting up an external key manager as described in the next section.
$ encryptkey --create_master
Enter new passphrase:
Retype new passphrase:
Creating a volume with encryption when encryption is enabled for the group.
$ vol --create finance --size 1000000 --encryption_cipher aes-256-xts
Creating an unencrypted volume when encryption is enabled for the group.
$ group --edit --encryption_scope volume
$ vol --create facilities --size 500000 --encryption_cipher none