Full Disk Encryption (FDE) with Ubuntu Autoinstall

🔍 Context

As system administrators and security-conscious developers, encrypting data at rest is a fundamental best practice—especially for laptops, servers in untrusted environments, or sensitive workloads. Full Disk Encryption (FDE) ensures that all data on the disk is encrypted, and can only be accessed after providing a unlocking key, thus safeguarding data even if physical access to the disk is obtained.

By leveraging cloud-init's autoinstall YAML, we can fully automate the provisioning process—including LUKS encryption, LVM setup, and embedding a drive unlocking key into the initramfs.

🛠️ Implementation Overview

Here’s a high-level overview of what we will be doing:

• Use LUKS to encrypt the main data partition.
• Inside the encrypted container, create a LVM volume group to manage the logical volumes.
• Generate a random key file early in the installation process, which is used to unlock the encrypted volume.
• Ensured this key is securely copied into the target system and embedded into the initramfs so the system can boot without manual passphrase entry.

🧪 Workflow

• Early Commands: Generate a 4KB random keyfile (root.key) under /etc/cryptsetup-keys.d, with appropriate permissions.

early-commands:
    - mkdir -p /etc/cryptsetup-keys.d
    - dd if=/dev/urandom of=/etc/cryptsetup-keys.d/root.key bs=1024 count=4
    - chmod 600 /etc/cryptsetup-keys.d/root.key

• Storage config: The disk was partitioned into:
  • An EFI system partition (/boot/efi)
  • An unencrypted /boot partition
  • A third partition for encrypted data.

Create a LUKS-encrypted volume on the third partition using the key file. On top of that, create a LVM volume group (VolGroup) and allocate a root logical volume (lv_root).

  storage:
    config:
      - ptable: gpt
        match:
          size: smallest
        wipe: superblock-recursive
        preserve: false
        name: ''
        grub_device: true
        id: disk-sda
        type: disk

      - device: disk-sda
        size: 536870912  # 512MB
        wipe: superblock
        flag: boot
        number: 1
        preserve: false
        grub_device: true
        id: partition-0
        type: partition

      - fstype: fat32
        volume: partition-0
        preserve: false
        id: format-0
        type: format

      - path: /boot/efi
        device: format-0
        id: mount-0
        type: mount

      - device: disk-sda
        size: 1073741824  # 1GB
        wipe: superblock
        number: 2
        preserve: false
        grub_device: false
        id: partition-1
        type: partition

      - fstype: ext4
        volume: partition-1
        preserve: false
        id: format-1
        type: format

      - path: /boot
        device: format-1
        id: mount-1
        type: mount

      - device: disk-sda
        size: -1
        wipe: superblock
        number: 3
        preserve: false
        grub_device: false
        id: partition-2
        type: partition

      - name: cryptlvm
        volume: partition-2
        preserve: false
        keyfile: /etc/cryptsetup-keys.d/root.key
        id: dm_crypt-lvm
        type: dm_crypt

      - name: VolGroup
        devices:
          - dm_crypt-lvm
        preserve: false
        id: lvm_volgroup-0
        type: lvm_volgroup

      - name: lv_root
        volgroup: lvm_volgroup-0
        size: -1
        wipe: superblock
        preserve: false
        id: lvm_partition-root
        type: lvm_partition

      - fstype: ext4
        volume: lvm_partition-root
        preserve: false
        id: format-root
        type: format

      - path: /
        device: format-root
        id: mount-root
        type: mount

• Late Commands:
  • Extract the UUID of the LUKS volume and copy the key file into /etc/cryptsetup-keys.d inside the target filesystem, renaming it to match the UUID.
  • Update /etc/crypttab to ensure the system knows how to unlock the encrypted volume during boot.
  • Add the appropriate hook configuration for cryptsetup-initramfs and rebuilt the initramfs so the key file will be included and accessible early in the boot process.

  late-commands:
    - mkdir -p /target/etc/cryptsetup-keys.d /target/etc/cryptsetup-initramfs
    - bash -c '
        luks_uuid=$(blkid -t TYPE=crypto_LUKS -s UUID -o value);
        cp /etc/cryptsetup-keys.d/root.key "/target/etc/cryptsetup-keys.d/${luks_uuid}.key";
        chmod 600 "/target/etc/cryptsetup-keys.d/${luks_uuid}.key";
        echo "dm_crypt-lvm UUID=${luks_uuid} /etc/cryptsetup-keys.d/${luks_uuid}.key luks" > /target/etc/crypttab;
        echo "KEYFILE_PATTERN=/etc/cryptsetup-keys.d/*.key" >> /target/etc/cryptsetup-initramfs/conf-hook;
      '
    - curtin in-target --target=/target -- update-initramfs -c -k all

✅ Conclusion

With this setup, we successfully created a secure, automated Ubuntu installation with full disk encryption using LUKS and LVM. The system boots without requiring a passphrase, thanks to the securely handled key file integrated into the initramfs.
This makes the setup highly suitable for hands-off provisioning in secure environments.

Looking ahead, this foundation can be extended to further enhance security by:

• Binding the LUKS key to a TPM after installation to enable secure, passphrase-free unlocks based on hardware identity.
• Integrating with Secure Boot and measured boot for a trusted boot chain.