How do I solve encryption issues on MetaDefender Endpoint/MetaDefender IT-OT Access VM devices using Cryptsetup?

Users running MetaDefender Endpoint on one or more Linux virtual devices (VMs) may occasionally seeMetaDefender IT-OT Access device compliance warnings/flags related to encryption.

This warning/flag is triggered by a device issue and will appear under MetaDefender IT-OT Access Console>Inventory>Devices>Relevant Device>Detailed Device Information>Deep Compliance>Encryption.

This article covers the process of using Cryptsetup to:

• Option 1: encrypt your virtual disk during the Ubuntu install process.
• Option 2: encrypt your Home partition following Ubuntu install.

Option 1: Encryption During Install

Phase 1: Initiate Ubuntu installation

1. Boot your new VM via either your computer’s DVD drive, a USB flash drive, your VM installer tool, or an Ubuntu image.

2. Select your Language, then click Install Ubuntu on the right-hand side of the screen to start installing the distro.

3. Select your preferred Keyboard layout, then click Continue.

4. On the Updates and other software screen, select how you would like to install Ubuntu. Your options include:

   • Normal installation: all features and selected software will be installed.
   • Minimal installation:only basic components will be installed, and you can download and install software as required.
   • Download updates while installing Ubuntu: auto-download updates while installing, provided you are on a stable, fast internet connection.
   • Install third-party software for graphics and Wi-Fi hardware and additional media formats: some license-requiring software, and some proprietary software for graphics, Wi-Fi and additional media formats, will be installed.

5. Click Continue to save and proceed.

Phase 2: Encrypt Your Disk During Install

1. On the Installation type screen of the wizard, select the installation type to be applied to your disk while installing. There are two options:

• Erase disk and install Ubuntu: select this option.
• Something else: ignore this option.

2. Under the first option above, there are two sub-options that are checked by default and that should remain checked. If they are not checked, ensure that you check them. They are:

• Encrypt the new Ubuntu installation for security: select this option.
• Use LVM with the new Ubuntu installation: select this option.

3. With the appropriate boxes checked, click the Install Now button.

4. Set and confirm a strong Security Key that will be entered when the VM starts up.
5. Click Install Now to proceed.

6. On the pop-up screen, you should opt to Overwrite all empty disk space, then click Continue to proceed.

Phase 3: Finish the Installation

1. Select your preferred Time Zone.

2. On the Who are you? Screen, create a login account and set a hostname for your VM.
3. As an additional layer of security, select the Require my password to log in option on this same screen.

4. On the same page, you should also select the option to Encrypt my home folder, as an added layer of security for the data on your system.
5. Click Continue to save your settings and begin the installation.

6. Finally, click the Restart Now button on the pop-up to restart your system and complete the installation.

Phase 4: Verify That the Disk Is Encrypted

1. Log into the system by entering the Credentials that you set up during Phase 3 above, then clicking Sign In.

2. Once you’re logged in, open a Terminal and run the following command to check your encryption status: $lsblk -o NAME,MOUNTPOINT,TYPE,FSTYPE

3. In the response, check the file system type of a given partition. If it is listed as crypto_LUKS for the FSTYPE, this means the partition is encrypted.

Phase 1: Install the Encryption Utilities

1. Open a Terminal and run the following command to install the encryption utilities: sudo apt-get install ecryptfs-utils cryptsetup

2. Log out, then log in again with the newly created user, tempuser.

Phase 3: Migrate the Same Home Folder That You Wish To Encrypt

Open a Terminal, then run the following command to migrate the Home partition of the user named test, the same Home partition you plan to encrypt:

Phase 4: Log Into The Account for Which the Home Partition Is To Be Encrypted

1. Log out and log back in again as the user who’s Home partition will be encrypted - in this case, test.

2. Once you are logged in, click the Run this action now button to create a recovery Passphrase. Store this passphrase safely, as you will need it if you ever have to recover files manually in future.

Phase 5: Verify That the Home Partition Is Encrypted

1. Open a Terminal and run the following command to verify the encryption status of your Home partition: ls -A /home

If your home folder has been encrypted, you will see a .ecryptfs folder in the response.

Reference: