NetNXT Logo

How to Enforce & Monitor Full Disk Encryption (LUKS) on Ubuntu

December 18, 2025
3 min read
ByNetNXT

Overview

Securing Linux endpoints is critical for compliance (SOC2, HIPAA). On Linux, Full Disk Encryption (FDE) is handled by LUKS (Linux Unified Key Setup).

Important Constraint: Unlike Windows BitLocker or macOS FileVault, LUKS cannot be enabled remotely on an existing installation without data loss. It must be selected during the initial OS provisioning.

This guide covers:

  1. Provisioning: How to correctly set up Ubuntu with LUKS.

  2. Compliance: How to use JumpCloud to monitor and flag non-encrypted devices.

  3. Verification: Validating encryption status via the command line.

Step 1: Provisioning (The "Enforcement" Phase)

Since FDE must be done at install time, your IT provisioning team or the end-user must follow these steps when setting up a new machine.

  1. Boot from the Ubuntu Installation USB.

  2. Proceed to the Installation Type screen.

  3. Click Advanced Features.

Select "Use LVM with the new Ubuntu installation".

  1. Check the box: "Encrypt the new Ubuntu installation for security".

  2. Create a Security Key: Choose a strong passphrase.

    • Best Practice: Store this recovery passphrase in your password manager (e.g., 1Password/Keeper) immediately. If this key is lost, the data is unrecoverable.

Step 2: Configuring JumpCloud Monitoring Policy

Once the agent is installed, you need to ensure the device actually is encrypted. JumpCloud uses a policy to check the disk status and report back.

  1. Log in to the JumpCloud Admin Portal.

  2. Navigate to Device Management > Policy Management.

  3. Click (+) and select the Linux tab.

  4. Search for and select "Check Disk Encryption".

  5. Configure the Policy:

    • Policy Name: Monitor - Linux Disk Encryption Compliance.

    • Encryption Type: Select Full Disk Encryption. (Do not select "Home Directory" unless you specifically use fscrypt).

  6. Scope: Apply to your "All Linux Workstations" group.

  7. Click Save.

Result: JumpCloud will now poll your Linux fleet. It will not encrypt the drive, but it will mark the device as "Compliant" (Green) or "Non-Compliant" (Red) in your reports.

Step 3: Verifying Status via Command Line (Terminal)

If a device is flagged as "Non-Compliant" or you need to manually verify a machine, use these commands.

Check for LUKS partitions:

Run the following command to list block devices and their types:

lsblk -f

  • Look for: crypto_LUKS under the FSTYPE column.

  • Look for: A partition named dm_crypt or crypt_root.

Check Encryption Status:

sudo cryptsetup status <partition_name>
# Example: sudo cryptsetup status dm_crypt-0

Success Output: The status should read active and the cipher should be visible (e.g., aes-xts-plain64).

Troubleshooting & Remediation

Scenario 1: Device is "Non-Compliant"

If JumpCloud reports a device is unencrypted, you have two options:

  1. Re-image (Recommended): Backup data, wipe the device, and reinstall Ubuntu following Step 1. This is the only way to get true FDE.

  2. Home Directory Encryption (Alternative): If you cannot wipe the device, you can encrypt just the user's home folder using fscrypt.

    • Note: You must update the JumpCloud policy setting to "Home Directory Encryption" for this device to show as compliant.

Scenario 2: "LUKS Device Not Found"

  • Ensure you are checking the physical partition (e.g., /dev/nvme0n1p3), not the mapped volume.

  • Some dual-boot setups may hide the partition. Run sudo blkid | grep LUKS to find the UUID.

FAQ

1) Why can’t LUKS full disk encryption be enabled remotely on existing Linux machines?

LUKS must be enabled at install time. Enabling it later on a live system remotely risks data loss. There is no safe remote FDE activation without wiping the disk.

2) How do you enforce full disk encryption on Ubuntu using LUKS?

During Ubuntu install, select LVM with encryption under Advanced Features and enable the option to encrypt the new Ubuntu installation for security with a strong passphrase.

3) How can JumpCloud monitor Linux disk encryption compliance?

JumpCloud policies can check encryption status, report compliant (green) or non-compliant (red) devices, and flag systems without encrypting them remotely.

4) How do you verify if a Linux partition is encrypted with LUKS?

Use lsblk -f to find crypto_LUKS in FSTYPE or run sudo cryptsetup status <partition> to confirm active status and view the cipher details.

Was this article helpful?