Skip to content

Commit 12d97b6

Browse files
ShawnJacksonShawnJackson
committed
edit pass: how-to-verify-encryption-status
1 parent 30d34cc commit 12d97b6

File tree

1 file changed

+70
-95
lines changed

1 file changed

+70
-95
lines changed

‎articles/virtual-machines/linux/how-to-verify-encryption-status.md

Lines changed: 70 additions & 95 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
---
2-
title: How to verify encryption status for Linux
3-
description: This article provides instructions on verifying the encryption status from platform and OS level.
2+
title: Verify encryption status for Linux - Azure Disk Encryption
3+
description: This article provides instructions on verifying the encryption status from the platform and OS level.
44
author: kailashmsft
55
ms.service: security
66
ms.topic: article
@@ -13,79 +13,62 @@ ms.custom: seodec18
1313

1414

1515

16-
# How to verify encryption status for Linux
16+
# Verify encryption status for Linux
1717

18-
**This scenario applies for ADE dual-pass and single-pass extensions.**
19-
This Document scope is to validate the encryption status of a virtual machine using different methods.
18+
The scope of this article is to validate the encryption status of a virtual machine by using different methods: the Azure portal, PowerShell, the Azure CLI, or the OS of the virtual machine (VM).
2019

21-
### Environment
20+
You can validate the encryption status during or after the encryption, by either:
2221

23-
- Linux distributions
22+
- Checking the disks attached to a particular VM.
23+
- Querying the encryption settings on each disk, whether the disk is attached or unattached.
2424

25-
### Procedure
26-
27-
A virtual machine has been encrypted using dual-pass or single-pass.
28-
29-
The encryption status can be validated during or after the encryption using different methods.
25+
This scenario applies for Azure Disk Encryption dual-pass and single-pass extensions. Linux distributions are the only environment for this scenario.
3026

3127
>[!NOTE]
32-
>We're using variables throughout the document, replace the values accordingly.
33-
34-
### Verification
35-
36-
The verification can be done from the Portal, PowerShell, AZ CLI and, or from the VM OS side.
37-
38-
This verification can be done by checking the disks attached to a particular VM.
39-
40-
Or by querying the encryption settings on each individual disk whether the disk is attached or unattached.
28+
>We're using variables throughout the article. Replace the values accordingly.
4129
42-
Below the different validations methods:
43-
44-
## Using the Portal
30+
## Portal
4531

4632
Validate the encryption status by checking the extensions section on the Azure portal.
4733

48-
Inside the **Extensions** section, you'll see the ADE extension listed.
49-
50-
Click it and take a look at the **status message**, it will indicate the current encryption status:
51-
52-
![Portal check number 1](./media/disk-encryption/verify-encryption-linux/portal-check-001.png)
34+
In the Azure portal, inside the **Extensions** section, select the Azure Disk Encryption extension in the list. The information for **Status message** indicates the current encryption status:
5335

54-
In the list of extensions, you'll see the corresponding ADE extension version. Version 0.x corresponds to ADE Dual-Pass and version 1.x corresponds to ADE Single-pass.
36+
![Portal check with status, version, and status message highlighted](./media/disk-encryption/verify-encryption-linux/portal-check-001.png)
5537

56-
You can get further details clicking on the extension and then on *View detailed status*.
38+
In the list of extensions, you'll see the corresponding Azure Disk Encryption extension version. Version 0.x corresponds to Azure Disk Encryption dual-pass, and version 1.x corresponds to Azure Disk Encryption single-pass.
5739

58-
You'll see a more detailed status of the encryption process in json format:
40+
You can get more details by selecting the extension and then selecting **View detailed status**. The detailed status of the encryption process appears in JSON format.
5941

60-
![Portal check number 2](./media/disk-encryption/verify-encryption-linux/portal-check-002.png)
42+
![Portal check with the "View detailed status" link highlighted](./media/disk-encryption/verify-encryption-linux/portal-check-002.png)
6143

62-
![Portal check number 3](./media/disk-encryption/verify-encryption-linux/portal-check-003.png)
44+
![Detailed status in JSON format](./media/disk-encryption/verify-encryption-linux/portal-check-003.png)
6345

64-
Another way of validating the encryption status is by taking a look at the **Disks** section.
46+
Another way to validate the encryption status is by looking at the **Disk settings** section.
6547

66-
![Portal check number 4](./media/disk-encryption/verify-encryption-linux/portal-check-004.png)
48+
![Encryption status for OS disk and data disks](./media/disk-encryption/verify-encryption-linux/portal-check-004.png)
6749

6850
>[!NOTE]
69-
> This status means the disks have encryption settings stamped but not that they were actually encrypted at OS level.
70-
> By design, the disks get stamped first and encrypted later.
71-
> If the encryption process fails, the disks may end up stamped but not encrypted.
51+
> This status means the disks have encryption settings stamped but not that they were actually encrypted at the OS level.
52+
>
53+
> By design, the disks are stamped first and encrypted later. If the encryption process fails, the disks may end up stamped but not encrypted.
54+
>
7255
> To confirm if the disks are truly encrypted, you can double check the encryption of each disk at OS level.
7356
74-
## Using PowerShell
57+
## PowerShell
7558

76-
You can validate the **general** encryption status of an encrypted VM using the following PowerShell commands:
59+
You can validate the *general* encryption status of an encrypted VM by using the following PowerShell commands:
7760

7861
```azurepowershell
7962
$VMNAME="VMNAME"
8063
$RGNAME="RGNAME"
8164
Get-AzVmDiskEncryptionStatus -ResourceGroupName ${RGNAME} -VMName ${VMNAME}
8265
```
83-
![check PowerShell 1](./media/disk-encryption/verify-encryption-linux/verify-status-ps-01.png)
66+
![General encryption status in PowerShell](./media/disk-encryption/verify-encryption-linux/verify-status-ps-01.png)
8467

85-
You can capture the encryption settings from each individual disk using the following PowerShell commands:
68+
You can capture the encryption settings from each disk by using the following PowerShell commands.
8669

87-
### Single-Pass
88-
If single-pass, the encryption settings are stamp on each of the disks (OS and Data), you can capture the OS disk encryption settings in single pass as follows:
70+
### Single pass
71+
In a single pass, the encryption settings are stamped on each of the disks (OS and data). You can capture the encryption settings for an OS disk in a single pass, as follows:
8972

9073
``` powershell
9174
$RGNAME = "RGNAME"
@@ -103,13 +86,13 @@ $VM = Get-AzVM -Name ${VMNAME} -ResourceGroupName ${RGNAME}
10386
Write-Host "Key URL:" $Sourcedisk.EncryptionSettingsCollection.EncryptionSettings.KeyEncryptionKey.KeyUrl
10487
Write-Host "============================================================================================================================================================="
10588
```
106-
![Verify OS Single pass 01](./media/disk-encryption/verify-encryption-linux/verify-os-single-ps-001.png)
89+
![Encryption settings for an OS disk](./media/disk-encryption/verify-encryption-linux/verify-os-single-ps-001.png)
10790

108-
If the disk doesn't have encryption settings stamped, the output will be empty as shown below:
91+
If the disk doesn't have encryption settings stamped, the output will be empty:
10992

110-
![OS Encryption settings 2](./media/disk-encryption/verify-encryption-linux/os-encryption-settings-2.png)
93+
![Empty output](./media/disk-encryption/verify-encryption-linux/os-encryption-settings-2.png)
11194

112-
Capture Data disk(s) encryption settings:
95+
Use the following commands to capture encryption settings for data disks:
11396

11497
```azurepowershell
11598
$RGNAME = "RGNAME"
@@ -130,12 +113,12 @@ $VM = Get-AzVM -Name ${VMNAME} -ResourceGroupName ${RGNAME}
130113
Write-Host "============================================================================================================================================================="
131114
}
132115
```
133-
![Verify data single ps 001](./media/disk-encryption/verify-encryption-linux/verify-data-single-ps-001.png)
116+
![Encryption settings for data disks](./media/disk-encryption/verify-encryption-linux/verify-data-single-ps-001.png)
134117

135-
### Dual-Pass
136-
In Dual Pass, the encryption settings are stamped in the VM model and not on each individual disk.
118+
### Dual pass
119+
In a dual pass, the encryption settings are stamped in the VM model and not on each individual disk.
137120

138-
To verify the encryption settings were stamped in dual-pass, you can use the following commands:
121+
To verify that the encryption settings were stamped in a dual pass, use the following commands:
139122

140123
```azurepowershell
141124
$RGNAME = "RGNAME"
@@ -154,7 +137,7 @@ Write-Host "Secret URL:" $Sourcedisk.EncryptionSettingsCollection.EncryptionSett
154137
Write-Host "Key URL:" $Sourcedisk.EncryptionSettingsCollection.EncryptionSettings.KeyEncryptionKey.KeyUrl
155138
Write-Host "============================================================================================================================================================="
156139
```
157-
![Verify dual pass PowerShell 1](./media/disk-encryption/verify-encryption-linux/verify-dual-ps-001.png)
140+
![Encyption settings in a dual pass](./media/disk-encryption/verify-encryption-linux/verify-dual-ps-001.png)
158141

159142
### Unattached disks
160143

@@ -173,19 +156,19 @@ Write-Host "Secret URL:" $Sourcedisk.EncryptionSettingsCollection.EncryptionSett
173156
Write-Host "Key URL:" $Sourcedisk.EncryptionSettingsCollection.EncryptionSettings.KeyEncryptionKey.KeyUrl
174157
Write-Host "============================================================================================================================================================="
175158
```
176-
## Using AZ CLI
159+
## Azure CLI
177160

178-
You can validate the **general** encryption status of an encrypted VM using the following AZ CLI commands:
161+
You can validate the *general* encryption status of an encrypted VM by using the following Azure CLI commands:
179162

180163
```bash
181164
VMNAME="VMNAME"
182165
RGNAME="RGNAME"
183166
az vm encryption show --name ${VMNAME} --resource-group ${RGNAME} --query "substatus"
184167
```
185-
![Verify general using CLI ](./media/disk-encryption/verify-encryption-linux/verify-gen-cli.png)
168+
![General encryption status from the Azure CLI ](./media/disk-encryption/verify-encryption-linux/verify-gen-cli.png)
186169

187-
### Single Pass
188-
You can validate the encryption settings from each individual disk using the following AZ CLI commands:
170+
### Single pass
171+
You can validate the encryption settings from each individual disk by using the following Azure CLI commands:
189172

190173
```bash
191174
az vm encryption show -g ${RGNAME} -n ${VMNAME} --query "disks[*].[name, statuses[*].displayStatus]" -o table
@@ -194,12 +177,11 @@ az vm encryption show -g ${RGNAME} -n ${VMNAME} --query "disks[*].[name, statuse
194177
![Data encryption settings](./media/disk-encryption/verify-encryption-linux/data-encryption-settings-2.png)
195178

196179
>[!IMPORTANT]
197-
> In case the disk does not have encryption settings stamped, it will be shown as
198-
"Disk is not encrypted"
180+
> If the disk doesn't have encryption settings stamped, you'll see the message "Disk is not encrypted."
199181
200-
Detailed Status and Encryption settings:
182+
Use the following commands to get detailed status and encryption settings.
201183

202-
OS Disk:
184+
OS disk:
203185

204186
```bash
205187
RGNAME="RGNAME"
@@ -217,9 +199,9 @@ echo "==========================================================================
217199
done
218200
```
219201

220-
![OSSingleCLI](./media/disk-encryption/verify-encryption-linux/os-single-cli.png)
202+
![Detailed status and encryption settings for the OS disk](./media/disk-encryption/verify-encryption-linux/os-single-cli.png)
221203

222-
Data Disks:
204+
Data disks:
223205

224206
```bash
225207
RGNAME="RGNAME"
@@ -237,15 +219,15 @@ echo "==========================================================================
237219
done
238220
```
239221

240-
![Data single CLI ](./media/disk-encryption/verify-encryption-linux/data-single-cli.png)
222+
![Detailed status and encryption settings for the data disks](./media/disk-encryption/verify-encryption-linux/data-single-cli.png)
241223

242-
### Dual Pass
224+
### Dual pass
243225

244226
``` bash
245227
az vm encryption show --name ${VMNAME} --resource-group ${RGNAME} -o table
246228
```
247229

248-
![Verify general dual using CLI ](./media/disk-encryption/verify-encryption-linux/verify-gen-dual-cli.png)
230+
![General encryption settings for dual pass via the Azure CLI](./media/disk-encryption/verify-encryption-linux/verify-gen-dual-cli.png)
249231
You can also check the Encryption settings on the VM Model Storage profile of the OS disk:
250232

251233
```bash
@@ -261,7 +243,7 @@ echo "==========================================================================
261243
done
262244
```
263245

264-
![Verify vm profile dual using CLI ](./media/disk-encryption/verify-encryption-linux/verify-vm-profile-dual-cli.png)
246+
![VM profile for dual pass via the Azure CLI](./media/disk-encryption/verify-encryption-linux/verify-vm-profile-dual-cli.png)
265247

266248
### Unattached disks
267249

@@ -286,10 +268,10 @@ Unmanaged disks are VHD files that are stored as page blobs in Azure storage acc
286268

287269
To get the details of a specific disk, you need to provide:
288270

289-
The ID of the storage account that contains the disk.
290-
A connection string for that particular storage account.
291-
The name of the container that stores the disk.
292-
The disk name.
271+
- The ID of the storage account that contains the disk.
272+
- A connection string for that particular storage account.
273+
- The name of the container that stores the disk.
274+
- The disk name.
293275

294276
This command lists all the IDs for all your storage accounts:
295277

@@ -304,65 +286,58 @@ Select the appropriate ID and store it on a variable:
304286
```bash
305287
id="/subscriptions/<subscription id>/resourceGroups/<resource group name>/providers/Microsoft.Storage/storageAccounts/<storage account name>"
306288
```
307-
The connection string.
308289

309290
This command gets the connection string for one particular storage account and stores it on a variable:
310291

311292
```bash
312293
ConnectionString=$(az storage account show-connection-string --ids $id --query connectionString -o tsv)
313294
```
314295

315-
The container name.
316-
317296
The following command lists all the containers under a storage account:
318297
```bash
319298
az storage container list --connection-string $ConnectionString --query [].[name] -o tsv
320299
```
321-
The container used for disks is normally named "vhds"
300+
The container used for disks is normally named "vhds."
322301

323-
Store the container name on a variable
302+
Store the container name on a variable:
324303
```bash
325304
ContainerName="name of the container"
326305
```
327306

328-
The disk name.
329-
330-
Use this command to list all the blobs on a particular container
307+
Use this command to list all the blobs on a particular container:
331308
```bash
332309
az storage blob list -c ${ContainerName} --connection-string $ConnectionString --query [].[name] -o tsv
333310
```
334-
Choose the disk you want to query and store its name on a variable.
311+
Choose the disk you want to query and store its name on a variable:
335312
```bash
336313
DiskName="diskname.vhd"
337314
```
338-
Query the disk encryption settings
315+
Query the disk encryption settings:
339316
```bash
340317
az storage blob show -c ${ContainerName} --connection-string ${ConnectionString} -n ${DiskName} --query metadata.DiskEncryptionSettings
341318
```
342319

343-
## From the OS
344-
Validate if the data disk partitions are encrypted (and the OS disk isn't)
320+
## Operating system
321+
Validate if the data disk partitions are encrypted (and the OS disk isn't).
345322

346-
When a partition/disk is encrypted it's displayed as **crypt** type, when it's not encrypted it's displayed as **part/disk** type
323+
When a partition or disk is encrypted, it's displayed as a **crypt** type. When it's not encrypted, it's displayed as a **part/disk** type.
347324

348325
``` bash
349326
lsblk
350327
```
351328

352-
![Os Crypt layer ](./media/disk-encryption/verify-encryption-linux/verify-os-crypt-layer.png)
353-
354-
You can get further details using the following "lsblk" variant.
329+
![OS crypt layer for a partition](./media/disk-encryption/verify-encryption-linux/verify-os-crypt-layer.png)
355330

356-
You'll see a **crypt** type layer that is mounted by the extension.
331+
You can get more details using the following **lsblk** variant.
357332

358-
The following example shows Logical Volumes and normal disks having a "**crypto\_LUKS FSTYPE**".
333+
You'll see a **crypt** type layer that is mounted by the extension. The following example shows logical volumes and normal disks having **crypto\_LUKS FSTYPE**.
359334

360335
```bash
361336
lsblk -o NAME,TYPE,FSTYPE,LABEL,SIZE,RO,MOUNTPOINT
362337
```
363-
![Os Crypt layer 2](./media/disk-encryption/verify-encryption-linux/verify-os-crypt-layer-2.png)
338+
![OS crypt layer for logial volumes and normal disks](./media/disk-encryption/verify-encryption-linux/verify-os-crypt-layer-2.png)
364339

365-
As an extra step, you can also validate if the data disk has any keys loaded
340+
As an extra step, you can validate if the data disk has any keys loaded:
366341

367342
``` bash
368343
cryptsetup luksDump /dev/VGNAME/LVNAME
@@ -372,12 +347,12 @@ cryptsetup luksDump /dev/VGNAME/LVNAME
372347
cryptsetup luksDump /dev/sdd1
373348
```
374349

375-
And which dm devices are listed as crypt
350+
And you can check which **dm** devices are listed as **crypt**:
376351

377352
```bash
378353
dmsetup ls --target crypt
379354
```
380355

381-
## Next Steps
356+
## Next steps
382357

383358
- [Azure Disk Encryption troubleshooting](disk-encryption-troubleshooting.md)

0 commit comments

Comments
 (0)