Set Up a LUKS-Encrypted Data Volume on SLES

For a new data volume on SUSE Linux Enterprise Server, use YaST Expert Partitioner if you want SUSE to create the encrypted partition and its mount configuration in one workflow. Use cryptsetup when you need a repeatable command-line setup and can also manage /etc/crypttab, /etc/fstab, and boot testing. Neither method encrypts an existing volume in place without risk: creating LUKS on a partition overwrites its contents.

This follows SLES 15 SP7 documentation; older service packs may differ. Scope: a new data partition, not root, /boot, or a production database disk without a change plan. Back up data and confirm the target and passphrase recovery before starting.

Choose the method and LUKS format

YaST supports LUKS2 from SLES 15 SP4, but SUSE labels its selector experimental and requires explicit enablement. Do not alter production boot parameters just to expose it. If the running-system partitioner does not offer LUKS2, use the verified CLI route or YaST’s available default. LUKS2 has a newer header, supports up to 32 keys and labels, and can use Argon2, which consumes more memory. Choose LUKS1 for older-tool compatibility; choose LUKS2 only after testing the service pack, recovery tools, and backups. See SUSE’s YaST Expert Partitioner reference for the exact options.

YaST: the lower-maintenance path for one volume

1. Identify the target. Run lsblk -fp and findmnt. Match the disk or partition by stable device identifier, size, current filesystem, and mount point. Confirm it is a dedicated, backed-up target. If it contains data you need, stop; YaST’s encryption workflow formats the selected partition.
2. Open the partitioner. In YaST Control Center, choose System > Partitioner. In Expert Partitioner, select the intended disk, create a dedicated partition if needed, or select the existing empty partition and choose Edit. Read the device and size again before applying anything.
3. Enable encryption and define use. Select Encrypt device, choose a filesystem such as XFS or another filesystem supported by your workload, and set the mount point. Choose whether the volume should mount from /etc/fstab at startup or remain available for manual mounting. SUSE notes that required encryption software may need to be installed when prompted.
4. Choose LUKS and set a passphrase. Enter and confirm a strong passphrase, then complete the YaST changes. To choose LUKS2 in YaST, enable its documented experimental support in YaST configuration first; otherwise the encryption-method selector may not appear. Save the passphrase in the organization’s approved secrets process. Losing it can make the data inaccessible.

cryptsetup: more control, more manual work

Use this alternative only for a new, unmounted partition that you have verified and backed up. Check that cryptsetup is installed with cryptsetup --version; if it is missing, use the approved SLES repository and your organization’s package process. Replace the placeholder with the confirmed stable path under /dev/disk/by-id/. The formatting command destroys data on that target; never run it against a guessed /dev/sdX name. SUSE’s SLES 15 SP7 encryption guide explains the YaST workflow and its limitations.

5. Create the LUKS container. This example requests LUKS2 explicitly. The command prompts for a passphrase and a confirmation; do not place the passphrase in the command line or a script.

DEVICE=/dev/disk/by-id/REPLACE_WITH_VERIFIED_ID
sudo cryptsetup luksFormat --type luks2 "$DEVICE"

6. Unlock the mapping. The mapping name below creates /dev/mapper/appdata_crypt after you enter the passphrase.

sudo cryptsetup open "$DEVICE" appdata_crypt

7. Create a filesystem and mount it. This example uses XFS and /srv/appdata. Creating a filesystem erases data on the mapped device, so run it only on the new mapping.

sudo mkfs.xfs /dev/mapper/appdata_crypt
sudo mkdir -p /srv/appdata
sudo mount /dev/mapper/appdata_crypt /srv/appdata

8. Configure startup behavior and verify. For an interactive passphrase prompt at boot, add the LUKS UUID to /etc/crypttab and the mapper mount to /etc/fstab. Retrieve the LUKS UUID with sudo cryptsetup luksUUID "$DEVICE", then replace the example placeholder in the config:

# /etc/crypttab
appdata_crypt UUID=PASTE_LUKS_UUID_HERE none luks

# /etc/fstab
/dev/mapper/appdata_crypt /srv/appdata xfs defaults 0 2

Test the mapping and mount before rebooting. Confirm that cryptsetup status appdata_crypt reports the expected mapping, findmnt /srv/appdata reports XFS at the intended path, and lsblk -f shows the encrypted container and mapped filesystem. If the server is headless, a boot-time passphrase prompt may prevent unattended mounting; do not store a plaintext key on the same host. For centrally managed server keys, SUSE’s cryptctl documentation describes a separate key-server design with its own availability, backup, and trust requirements.

What encryption does—and does not—protect

LUKS protects data on a locked device, such as a disk removed from a powered-off server. Once mounted, host permissions govern access. Encrypt backups separately and store a LUKS header backup with protected recovery material. LUKS does not protect an unlocked volume or a compromised running system.

For one SLES data volume, prefer YaST when its available format meets your requirements. Use cryptsetup when automation justifies managing the extra configuration. Before service resumes, verify unlock, mount, application access, and recovery.