How to Configure LUKS Encryption on SupremeRAID Virtual Devices

How to Configure LUKS Encryption on SupremeRAID Virtual Devices

Environment

  • RAID Model: All models

  • Host Hardware: AMD/Intel

  • Operating System: Linux (Ubuntu/CentOS/RHEL)

  • SupremeRAID Driver: 1.7.x and later versions

Description

This article describes the procedure to encrypt a SupremeRAID Virtual Device (VD) using LUKS (Linux Unified Key Setup) and configure it for automatic mounting at boot.

Due to the initialization time required by the SupremeRAID driver (graid.service), specific systemd parameters must be configured to prevent a race condition where the OS attempts to unlock the encrypted volume before the SupremeRAID VD is fully ready.

Resolution

Warning: The following steps involve formatting the disk. All existing data on the target Virtual Device will be erased. Please ensure you have backed up any necessary data before proceeding.


Step 1: Install Required Tools

Ensure cryptsetup is installed on your system.

  • Ubuntu/Debian:

    Bash
    Quote
    sudo apt update
    sudo apt install cryptsetup

  • RHEL/CentOS:

    Bash
    Quote
    sudo yum install cryptsetup-luks

Step 2: Initialize LUKS Encryption

Assume the target SupremeRAID VD is /dev/gdg0n1.

  1. Format the device with LUKS:

    Bash
    Quote
    sudo cryptsetup luksFormat /dev/gdg0n1

    • Type YES (uppercase) when prompted.

    • Enter and verify your passphrase.

  2. Open (unlock) the encrypted device. Map it to a name (e.g., graiddrive_crypt):

    Bash
    Quote
    sudo cryptsetup luksOpen /dev/gdg0n1 graiddrive_crypt

Step 3: Create Filesystem and Mount Point

Perform these operations on the mapped device, not the raw VD.

  1. Create an ext4 filesystem:

    Bash
    Quote
    sudo mkfs.ext4 /dev/mapper/graiddrive_crypt

  2. Create a mount point:

    Bash
    Quote
    sudo mkdir /data

Step 4: Configure Persistent Mounting (Crucial)

To ensure the system boots correctly, we must configure the dependency chain so that LUKS waits for the graid.service.

  1. Get the UUID of the SupremeRAID VD: Run sudo blkid. Locate /dev/gdg0n1 (Type=crypto_LUKS) and copy its UUID.

    • Note: Do not copy the UUID of /dev/mapper/graiddrive_crypt.

  2. Edit /etc/crypttab: Add the following line. Ensure you add x-systemd.requires=graid.service.

    Plaintext
    # <target name>    <source device>                     <key file>   <options>
    graiddrive_crypt   UUID=<UUID_of_gdg0n1>               none         luks,nofail,x-systemd.requires=graid.service

    • graiddrive_crypt: The name used in Step 2.

    • UUID: The UUID of the raw /dev/gdg0n1.

    • none: Prompts for a password at boot. (Replace with a keyfile path for password-less boot).

    • x-systemd.requires=graid.service: Ensures LUKS waits for the driver.

  3. Edit /etc/fstab: Add the following line to mount the unlocked mapper device.

    Plaintext
    # <file system>                 <mount point>   <type>  <options>                           <dump>  <pass>
    /dev/mapper/graiddrive_crypt    /data           ext4    defaults,nofail,noatime,nodiratime  0       2

Step 5: Verify Configuration

  1. Reload systemd manager configuration:

    Bash
    sudo systemctl daemon-reload

  2. (Optional) Update initramfs to ensure boot-time configuration is applied immediately:

    Bash
    sudo update-initramfs -u

  3. Reboot the system to verify that the password prompt appears and the volume mounts successfully.

Troubleshooting

Issue: System hangs or enters Emergency Mode at boot.

  • Cause 1: Incorrect UUID in /etc/crypttab.

    • Fix: Ensure you are using the UUID of the physical VD (/dev/gdg0n1), NOT the mapper device.

  • Cause 2: Race condition (LUKS starts before GRAID).

    • Fix: Verify that x-systemd.requires=graid.service is correctly added to the options column in /etc/crypttab.

  • Workaround: If the system is old (e.g., Ubuntu 20.04) and ignores systemd flags in crypttab, add noauto to /etc/crypttab and add x-systemd.automount to /etc/fstab.