To encrypt a second disk on an Ubuntu VPS, create a LUKS2 container with cryptsetup, open it as a device-mapper volume, put a filesystem on the mapped device, and persist the mapping in /etc/crypttab and the mount in /etc/fstab. The procedure below uses a passphrase at boot, formats only a separate data disk, and includes the checks and header backup needed to avoid an unrecoverable mistake.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What you are building
The finished setup has four layers:
- The VPS provider presents a separate block device, such as
/dev/sdb. - LUKS2 stores encryption metadata at the beginning of that device and protects the volume key with your passphrase.
- dm-crypt, through device-mapper, exposes an unlocked mapping such as
/dev/mapper/securedata. - An ext4 filesystem is created on the mapping and mounted at
/srv/securedata.
Applications use the mounted directory normally. While the mapping is closed, the underlying blocks are ciphertext. Ubuntu describes this as block-level encryption for a disk or selected partition, not as encryption of every process or network connection.
As an Amazon Associate I earn from qualifying purchases.
Recommended Free Tools
Unlocking changes the security boundary: any process that has permission to read the mounted path can read the plaintext. Encryption at rest therefore complements, rather than replaces, backups, access controls, patching, and the VPS provider’s own security controls.
Requirements and decisions before you format anything
- An Ubuntu VPS with sudo access and a separately attached block volume. Do not use the operating system’s root disk.
- A console or other out-of-band recovery path supplied by your VPS provider. Keep it available while testing boot-time storage.
- The
cryptsetuppackage and enough free capacity for the filesystem you intend to create. - A strong passphrase stored in your organization’s approved password or secret-management system. A lost passphrase cannot be bypassed.
- A destination outside the VPS for a LUKS header backup.
Decide whether an administrator can enter a passphrase during boot. The configuration in this guide deliberately uses a manual passphrase. Unattended unlocking requires a separate key-management design and has a different threat model; placing a key file on the same VPS does not protect data if an attacker can obtain both the disk and that key.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
Why LUKS2 instead of plain dm-crypt?
Plain dm-crypt encrypts sectors but does not provide a self-describing metadata header or managed key slots. LUKS adds those facilities, making it possible to identify the container, add or revoke passphrases, and back up the metadata. For normal administration, the cryptsetup manual advises using LUKS unless you understand the cryptographic implications of plain mode. This guide explicitly requests LUKS2.
1. Identify the correct data device
Device names can change after a reboot or after attaching another volume. Inspect the current state rather than assuming that the second disk is safe to erase.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minutelsblk -f
findmntIn the lsblk -f output, look for a device with the capacity of the newly attached volume and no mount point. In findmnt, confirm which device backs / and the other system mounts. The target might be /dev/sdb, but it may have another name in your VPS environment.
Checks that must pass
- The selected path is the separate data volume, not the device containing the root filesystem, boot partition, swap, or an existing application mount.
- You have confirmed the device has no data you need.
luksFormatoverwrites the existing volume structure. - You will use the whole device, or you have intentionally selected a specific partition or LVM logical volume. Cryptsetup can operate on a block device, partition, LVM volume, or file-backed loop device.
For the examples below, assume the verified target is /dev/sdb. Substitute your confirmed path in every command; never copy the example blindly.
2. Install cryptsetup
Update the package index and install the Ubuntu tooling:
sudo apt update
sudo apt install cryptsetupIf the package is already installed, apt will report that no change is needed. Do not proceed until the command completes without an installation error.
3. Initialize a LUKS2 container
Run the destructive initialization only after the device check:
sudo cryptsetup luksFormat --type luks2 /dev/sdbCryptsetup displays a warning and asks you to confirm. Read the device path in that warning, type the requested confirmation, and enter a strong passphrase twice. A LUKS2 header is written at the start of the device. The encrypted volume key is stored in that header, protected by one or more key slots derived from your passphrase.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
Do not create a filesystem on /dev/sdb after this point. The raw device is the encrypted container. A filesystem placed there would overwrite the LUKS metadata. All filesystem operations must target the unlocked mapping created in the next step.
Record the LUKS identifier
After formatting, obtain the stable LUKS UUID. You will use it in /etc/crypttab so that boot does not depend on a potentially changing device name.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →sudo cryptsetup luksUUID /dev/sdbCopy the UUID exactly, without extra spaces. Keep it with your storage documentation, but do not treat the UUID as a secret; the passphrase is the credential.
4. Open the encrypted mapping
Unlock the container and assign it the name securedata:
sudo cryptsetup open /dev/sdb securedataEnter the LUKS passphrase when prompted. A successful command creates /dev/mapper/securedata. Verify both the mapping and its relationship to the physical device:
lsblk -f
ls -l /dev/mapper/securedataThe mapper node is a representation of decrypted sectors. It exists only while the container is open. If the command reports an incorrect passphrase, check the passphrase manager and the target device; do not repeatedly format the disk.
5. Create a filesystem on the mapped device and mount it
Create the filesystem on the mapper path, never on the encrypted source:
sudo mkfs.ext4 /dev/mapper/securedataThis command creates a new ext4 filesystem and destroys any data currently in that mapping. For a newly initialized LUKS volume, that is expected. If you need another filesystem, substitute its supported mkfs command, but keep the target as /dev/mapper/securedata.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
Create a mount point, mount the filesystem, and verify the result:
sudo mkdir -p /srv/securedata
sudo mount /dev/mapper/securedata /srv/securedata
findmnt /srv/securedata
df -h /srv/securedatafindmnt should show the mapper device mounted at the requested path. df reports the filesystem’s usable size. You can now create a temporary test file, check that applications can use the directory, and remove the file before production use.
Set ownership for the application that will use the volume
The mount point is normally owned by root immediately after creation. Grant access deliberately to the service account that needs it, using your normal least-privilege policy. Do not make the directory world-writable merely to solve an application permission error; identify the service user and assign only the required owner, group, and mode.
6. Persist unlocking in crypttab and mounting in fstab
Two configuration files perform different jobs:
/etc/crypttabtells the boot system which encrypted source to activate and what cryptsetup options to use./etc/fstabtells the boot system where the resulting filesystem belongs and which mount options to apply.
Get the filesystem UUID
With the mapping open and filesystem mounted, query the filesystem identifier:
sudo blkid /dev/mapper/securedataCopy the value labeled UUID. This is different from the LUKS UUID returned by cryptsetup luksUUID; use each identifier in the correct file.
Add the crypttab entry
Edit the file as root:
sudoedit /etc/crypttabAdd one line, replacing the placeholder with the LUKS UUID you recorded:
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutesecuredata UUID=<LUKS-UUID> none luksThe first field must match the mapping name, so it produces /dev/mapper/securedata. The UUID= source identifies the encrypted device. none indicates that no key file path is configured; the system will request the passphrase. The luks option tells cryptsetup to treat the source as a LUKS container.
Add the fstab entry
Edit /etc/fstab:
sudoedit /etc/fstabAdd a line using the filesystem UUID from blkid:
UUID=<FILESYSTEM-UUID> /srv/securedata ext4 defaults,nofail 0 2The nofail mount option prevents a missing data volume from being treated like a required root filesystem during boot. It does not make an incorrect UUID harmless: the mount will still fail and should be investigated. The final fields request the standard filesystem checks ordering for a non-root ext4 filesystem.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
Keep the two UUIDs distinct. Putting the LUKS UUID in fstab, or the filesystem UUID in crypttab, prevents the dependency chain from working.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
7. Test the configuration without risking the next reboot
Do not reboot immediately after editing both files. First close the live mount and mapping, reload systemd’s generated units, and ask the system to recreate the setup:
sudo umount /srv/securedata
sudo cryptsetup close securedata
sudo systemctl daemon-reload
sudo mount -aBecause crypttab defines a passphrase-protected mapping, the mount attempt may prompt for that passphrase. Enter it and then inspect the resulting state:
lsblk -f
findmnt /srv/securedata
journalctl -bYou should see the LUKS source, the securedata mapper, and the ext4 filesystem mounted at /srv/securedata. If mount -a returns an error, fix it before rebooting. Check spelling, UUIDs, filesystem type, and whether the target volume is attached.
Use the provider console for the first reboot
Keep the VPS provider’s console or recovery environment open for the first reboot after persistence is configured. A malformed storage dependency can leave a server waiting for input or start without the expected data mount. The console lets you read the boot message, enter the passphrase, correct the files, or boot into recovery without depending on the encrypted volume itself.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →8. Back up the LUKS header immediately
The header contains the metadata and the encrypted volume key needed to interpret the data. A disk backup that omits or corrupts the header may not be usable, even when all ciphertext sectors are intact. Create a protected header backup:
sudo cryptsetup luksHeaderBackup /dev/sdb --header-backup-file /root/securedata.luks-headerCopy that file to storage outside the VPS, protect it from unauthorized access, and document which physical or virtual volume it belongs to. A header backup is sensitive: anyone who obtains it still needs a valid passphrase, but exposing it weakens your recovery security.
Protect the passphrase separately. Do not leave the only copy in a shell history, an unencrypted note, or on the same VPS. If the header and every valid passphrase are lost, the data is normally inaccessible. If a header is damaged, restoration is a specialist recovery operation and must use the matching backup for that exact volume; restoring the wrong header can destroy the ability to unlock otherwise healthy data.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
What happens at reboot?
At boot, systemd reads the crypttab entry and asks for the passphrase to activate securedata. Once the mapper exists, the fstab entry mounts its filesystem at /srv/securedata. Services that start after the mount can use the directory.
Free tools Windows power users keep installed
One-click scans. No signup required.
A manually entered passphrase means an operator must be available when the VPS starts. This is often preferable to storing an unlock key on the same machine, but it has an operational cost: unattended reboots, kernel updates, and provider maintenance may pause until someone unlocks the volume. Plan a console-access procedure and define which services should tolerate the data volume being unavailable.
If you require unattended startup, design it as a separate key-management project. Consider where the key is held, how the VPS authenticates to that service, what happens during a network outage, and how keys are revoked. Do not silently convert a passphrase setup into a plaintext key file just to remove the boot prompt.
Choosing between common implementations
| Decision | Option | What changes | Operational consequence |
|---|---|---|---|
| Container format | LUKS2 | Metadata header, UUID, and managed key slots are available. | Better administration and recovery workflow; use this guide’s commands. |
| Container format | Plain dm-crypt | No LUKS metadata or built-in key-slot management. | More manual bookkeeping and a greater risk of misconfiguration; it is not the default choice here. |
| Unlock method | Interactive passphrase | An operator supplies the credential during activation. | Strong separation from the VPS disk, but reboot automation requires human availability. |
| Unlock method | Automated key retrieval | A key is obtained from a separate mechanism. | Can support unattended boot, but introduces key-storage, network, identity, and outage dependencies. |
| Filesystem | ext4 in this procedure | A Linux filesystem is created on the decrypted mapper. | Use the filesystem your application and recovery tooling support; the filesystem UUID belongs in fstab. |
| Encryption responsibility | Guest-managed dm-crypt | You control the passphrase, LUKS header, mapping, and recovery process. | You must protect keys and headers and test restores. |
| Encryption responsibility | Provider-managed storage encryption | The provider supplies an encryption layer for its storage service. | Key custody, recovery behavior, and guarantees depend on that provider’s documented controls; it does not replace guest-level access control. |
These layers can coexist. Provider-side encryption may protect a detached volume in the provider’s infrastructure, while LUKS protects the guest data from anyone who obtains the block contents without the guest passphrase.
Troubleshooting by symptom
luksFormat warns about the wrong disk
Answer no or cancel immediately. Re-run lsblk -f and findmnt, identify the root device, and compare the target’s size and mount status with the provider’s volume attachment information. Never continue because a device name “looks right.”
cryptsetup open cannot find or unlock the device
- If the path does not exist, confirm that the block volume is attached and that the kernel sees it in
lsblk. - If the passphrase is rejected, verify the keyboard layout and retrieve the original passphrase. Formatting again creates a new container and does not repair the old one.
- If the LUKS metadata is reported as invalid, stop writing to the device and locate the matching header backup before attempting recovery.
The mapper exists but mounting fails
Check that the filesystem was created on /dev/mapper/securedata, not on the raw source. Run lsblk -f and blkid /dev/mapper/securedata. If no filesystem type or UUID appears, the filesystem creation did not complete or targeted a different device.
mount -a reports “wrong fs type” or a missing UUID
Compare the fstab UUID character-for-character with the value returned for the mapper. Confirm the type is ext4 and that /srv/securedata exists. Do not substitute the LUKS UUID; the mount needs the filesystem UUID.
The server pauses or starts without the mount after reboot
Use the provider console. A passphrase prompt may be waiting on the console, or the data volume may not have been attached. Once logged in, inspect journalctl -b, lsblk -f, and findmnt. Correct the relevant crypttab or fstab line, run systemctl daemon-reload, and retest with an unmount/close cycle before another reboot.
The mount is present but an application receives “permission denied”
Confirm the service account, directory owner, group, and mode. The encryption layer only supplies readable blocks after unlock; it does not grant application users access to the mounted directory.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Quick Recap
Operational checklist
- Confirm the target is a separate, unmounted data device.
- Install
cryptsetupand initialize--type luks2. - Record the LUKS UUID and keep the passphrase in protected storage.
- Open the mapping and create the filesystem only on
/dev/mapper/securedata. - Verify the mount with
findmntand capacity withdf -h. - Use the LUKS UUID in
/etc/crypttaband the filesystem UUID in/etc/fstab. - Unmount, close, reload systemd, run
mount -a, and inspect the journal before rebooting. - Keep a provider console available during the first reboot.
- Create a LUKS header backup, move it off the VPS, and protect it separately from the passphrase.
- Test that your backup and recovery documentation are usable before the encrypted volume holds irreplaceable data.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
