0

I am new to linux. I did encryption on a azure linux vm, followed with the steps which azure suggested. I can see the encryption is enabled and the disk is showing encrypted. But I am unable to boot into the OS. There is no CPU usage/Disk operation. Looks like VM is completely down. Anyone please suggest how to check whether the OS is corrupt or not?

Regards Mydeen

Improve this question
13
  • 1
    Maybe you've encrypted your OS volume, instead of data storage? Have you done any backup or snapshot of your volume before encryption?
    – Comar
    Apr 28, 2019 at 23:14
  • Yes the vm has only OS volume. Yes we took backup before encrypting the VM.
    – Mydeen
    Apr 29, 2019 at 0:14
  • Well, if you've encrypted your OS volume then, in my understanding, it's not possible to boot it anymore because there is nothing in front of it do decrypt it. So you can either create another VM ubuntu and then try to mount your encrypted volume, or simply use your backup.
    – Comar
    Apr 29, 2019 at 16:48
  • We should not encrypt the OS volume in Linux even manually? Azure has listed this OS version (Ubuntu 16.04 LTS) in their list. Which we can enable disk encryption on OS as well Data disks.
    – Mydeen
    May 1, 2019 at 19:07
  • It depend on how it's set up. I suspect you've had bootloader encrypted aswell, so nothing was able to boot an encrypted volume.
    – Comar
    May 1, 2019 at 22:37

1 Answer 1

Reset to default
1

I have tried Linux VM encryption and faced many issues. I made some points before going to enable the disk encryption on Linux VM in Azure.

Disabling encryption on Linux VMs is only supported for data volumes. It is not supported on data or OS volumes if the OS volume has been encrypted.

If VM is not booting after encryption then only VM restoration option is available. You cannot resolve the issue.

Before enabling the disk encryption, we have to prepare the some question’s answer.

  1. Have a working backup for the vm which you are going to encrypt it.
  2. Make sure that the VM has enough RAM(minimum 7Gb) and also enough space in the OSDisk.
  3. Make sure that the application is stopped prior to the encryption process is started, also make sure that the application remains stopped after a reboot also, as the ADE process will reboot the vm.
  4. Make sure that the vm is not accessed by any means being it ssh or winscp or any other tools.
  5. Make sure that there is no extension installed in the vm.
  6. Make sure that there is no server hardening is done on the vm which is going to encrypted i.e, Kernel Parameter changes, Grub password setting, boot password setting
  7. You can monitor the encryption status using the PowerShell or azure cli commands or checking the serial console.
  8. if you are using datadisk, make sure that the file system type is ext4 and not xfs, because xfs file system is not supported for single pass encryption
  9. Remove the old kernels which are no longer required and regenerate the grub.cfg file. Keep only 3-4 Old Kernels if required.

Azure Disk Encryption does not work for the following scenarios, features, and technology: • Encrypting basic tier VM or VMs created through the classic VM creation method. • Disabling encryption on an OS drive or data drive of a Linux VM when the OS drive is encrypted. • Encrypting OS drive for Linux virtual machine scale sets. • Encrypting custom images on Linux VMs. • Integration with an on-premises key management system. • Azure Files (shared file system). • Network File System (NFS). • Dynamic volumes.

Azure Disk Encryption prerequisites https://docs.microsoft.com/en-us/azure/security/azure-security-disk-encryption-prerequisites

Enable Azure Disk Encryption for Linux IaaS VMs https://docs.microsoft.com/en-us/azure/security/azure-security-disk-encryption-linux

How to encrypt a Linux virtual machine in Azure https://docs.microsoft.com/bs-latn-ba/azure/virtual-machines/linux/encrypt-disks

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .