Skip to content

Commit 699963a

Browse files
Ja-DunnJa-Dunn
authored
Merge pull request #109862 from ShawnJackson/how-to-verify-encryption-status
edit pass: how-to-verify-encryption-status
2 parents 8bd78fe + fd5390e commit 699963a

File tree

1 file changed

+74
-100
lines changed

1 file changed

+74
-100
lines changed

‎articles/virtual-machines/linux/how-to-verify-encryption-status.md

Lines changed: 74 additions & 100 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
---
2-
title: How to verify encryption status for Linux
3-
description: This article provides instructions on verifying the encryption status from platform and OS level.
2+
title: Verify encryption status for Linux - Azure Disk Encryption
3+
description: This article provides instructions on verifying the encryption status from the platform and OS levels.
44
author: kailashmsft
55
ms.service: security
66
ms.topic: article
@@ -13,79 +13,60 @@ ms.custom: seodec18
1313

1414

1515

16-
# How to verify encryption status for Linux
16+
# Verify encryption status for Linux
1717

18-
**This scenario applies for ADE dual-pass and single-pass extensions.**
19-
This Document scope is to validate the encryption status of a virtual machine using different methods.
18+
The scope of this article is to validate the encryption status of a virtual machine by using different methods: the Azure portal, PowerShell, the Azure CLI, or the operating system of the virtual machine (VM).
2019

21-
### Environment
20+
You can validate the encryption status during or after the encryption, by either:
2221

23-
- Linux distributions
22+
- Checking the disks attached to a particular VM.
23+
- Querying the encryption settings on each disk, whether the disk is attached or unattached.
2424

25-
### Procedure
26-
27-
A virtual machine has been encrypted using dual-pass or single-pass.
28-
29-
The encryption status can be validated during or after the encryption using different methods.
25+
This scenario applies for Azure Disk Encryption dual-pass and single-pass extensions. Linux distributions are the only environment for this scenario.
3026

3127
>[!NOTE]
32-
>We're using variables throughout the document, replace the values accordingly.
33-
34-
### Verification
35-
36-
The verification can be done from the Portal, PowerShell, AZ CLI and, or from the VM OS side.
37-
38-
This verification can be done by checking the disks attached to a particular VM.
39-
40-
Or by querying the encryption settings on each individual disk whether the disk is attached or unattached.
41-
42-
Below the different validations methods:
28+
>We're using variables throughout the article. Replace the values accordingly.
4329
44-
## Using the Portal
30+
## Portal
4531

46-
Validate the encryption status by checking the extensions section on the Azure portal.
32+
In the Azure portal, inside the **Extensions** section, select the Azure Disk Encryption extension in the list. The information for **Status message** indicates the current encryption status:
4733

48-
Inside the **Extensions** section, you'll see the ADE extension listed.
34+
![Portal check with status, version, and status message highlighted](./media/disk-encryption/verify-encryption-linux/portal-check-001.png)
4935

50-
Click it and take a look at the **status message**, it will indicate the current encryption status:
36+
In the list of extensions, you'll see the corresponding Azure Disk Encryption extension version. Version 0.x corresponds to Azure Disk Encryption dual pass, and version 1.x corresponds to Azure Disk Encryption single pass.
5137

52-
![Portal check number 1](./media/disk-encryption/verify-encryption-linux/portal-check-001.png)
38+
You can get more details by selecting the extension and then selecting **View detailed status**. The detailed status of the encryption process appears in JSON format.
5339

54-
In the list of extensions, you'll see the corresponding ADE extension version. Version 0.x corresponds to ADE Dual-Pass and version 1.x corresponds to ADE Single-pass.
40+
![Portal check with the "View detailed status" link highlighted](./media/disk-encryption/verify-encryption-linux/portal-check-002.png)
5541

56-
You can get further details clicking on the extension and then on *View detailed status*.
42+
![Detailed status in JSON format](./media/disk-encryption/verify-encryption-linux/portal-check-003.png)
5743

58-
You'll see a more detailed status of the encryption process in json format:
44+
Another way to validate the encryption status is by looking at the **Disk settings** section.
5945

60-
![Portal check number 2](./media/disk-encryption/verify-encryption-linux/portal-check-002.png)
61-
62-
![Portal check number 3](./media/disk-encryption/verify-encryption-linux/portal-check-003.png)
63-
64-
Another way of validating the encryption status is by taking a look at the **Disks** section.
65-
66-
![Portal check number 4](./media/disk-encryption/verify-encryption-linux/portal-check-004.png)
46+
![Encryption status for OS disk and data disks](./media/disk-encryption/verify-encryption-linux/portal-check-004.png)
6747

6848
>[!NOTE]
69-
> This status means the disks have encryption settings stamped but not that they were actually encrypted at OS level.
70-
> By design, the disks get stamped first and encrypted later.
71-
> If the encryption process fails, the disks may end up stamped but not encrypted.
72-
> To confirm if the disks are truly encrypted, you can double check the encryption of each disk at OS level.
49+
> This status means the disks have encryption settings stamped, not that they were actually encrypted at the OS level.
50+
>
51+
> By design, the disks are stamped first and encrypted later. If the encryption process fails, the disks may end up stamped but not encrypted.
52+
>
53+
> To confirm if the disks are truly encrypted, you can double check the encryption of each disk at the OS level.
7354
74-
## Using PowerShell
55+
## PowerShell
7556

76-
You can validate the **general** encryption status of an encrypted VM using the following PowerShell commands:
57+
You can validate the *general* encryption status of an encrypted VM by using the following PowerShell commands:
7758

7859
```azurepowershell
7960
$VMNAME="VMNAME"
8061
$RGNAME="RGNAME"
8162
Get-AzVmDiskEncryptionStatus -ResourceGroupName ${RGNAME} -VMName ${VMNAME}
8263
```
83-
![check PowerShell 1](./media/disk-encryption/verify-encryption-linux/verify-status-ps-01.png)
64+
![General encryption status in PowerShell](./media/disk-encryption/verify-encryption-linux/verify-status-ps-01.png)
8465

85-
You can capture the encryption settings from each individual disk using the following PowerShell commands:
66+
You can capture the encryption settings from each disk by using the following PowerShell commands.
8667

87-
### Single-Pass
88-
If single-pass, the encryption settings are stamp on each of the disks (OS and Data), you can capture the OS disk encryption settings in single pass as follows:
68+
### Single pass
69+
In a single pass, the encryption settings are stamped on each of the disks (OS and data). You can capture the encryption settings for an OS disk in a single pass as follows:
8970

9071
``` powershell
9172
$RGNAME = "RGNAME"
@@ -103,13 +84,13 @@ $VM = Get-AzVM -Name ${VMNAME} -ResourceGroupName ${RGNAME}
10384
Write-Host "Key URL:" $Sourcedisk.EncryptionSettingsCollection.EncryptionSettings.KeyEncryptionKey.KeyUrl
10485
Write-Host "============================================================================================================================================================="
10586
```
106-
![Verify OS Single pass 01](./media/disk-encryption/verify-encryption-linux/verify-os-single-ps-001.png)
87+
![Encryption settings for an OS disk](./media/disk-encryption/verify-encryption-linux/verify-os-single-ps-001.png)
10788

108-
If the disk doesn't have encryption settings stamped, the output will be empty as shown below:
89+
If the disk doesn't have encryption settings stamped, the output will be empty:
10990

110-
![OS Encryption settings 2](./media/disk-encryption/verify-encryption-linux/os-encryption-settings-2.png)
91+
![Empty output](./media/disk-encryption/verify-encryption-linux/os-encryption-settings-2.png)
11192

112-
Capture Data disk(s) encryption settings:
93+
Use the following commands to capture encryption settings for data disks:
11394

11495
```azurepowershell
11596
$RGNAME = "RGNAME"
@@ -130,12 +111,12 @@ $VM = Get-AzVM -Name ${VMNAME} -ResourceGroupName ${RGNAME}
130111
Write-Host "============================================================================================================================================================="
131112
}
132113
```
133-
![Verify data single ps 001](./media/disk-encryption/verify-encryption-linux/verify-data-single-ps-001.png)
114+
![Encryption settings for data disks](./media/disk-encryption/verify-encryption-linux/verify-data-single-ps-001.png)
134115

135-
### Dual-Pass
136-
In Dual Pass, the encryption settings are stamped in the VM model and not on each individual disk.
116+
### Dual pass
117+
In a dual pass, the encryption settings are stamped in the VM model and not on each individual disk.
137118

138-
To verify the encryption settings were stamped in dual-pass, you can use the following commands:
119+
To verify that the encryption settings were stamped in a dual pass, use the following commands:
139120

140121
```azurepowershell
141122
$RGNAME = "RGNAME"
@@ -154,7 +135,7 @@ Write-Host "Secret URL:" $Sourcedisk.EncryptionSettingsCollection.EncryptionSett
154135
Write-Host "Key URL:" $Sourcedisk.EncryptionSettingsCollection.EncryptionSettings.KeyEncryptionKey.KeyUrl
155136
Write-Host "============================================================================================================================================================="
156137
```
157-
![Verify dual pass PowerShell 1](./media/disk-encryption/verify-encryption-linux/verify-dual-ps-001.png)
138+
![Encryption settings in a dual pass](./media/disk-encryption/verify-encryption-linux/verify-dual-ps-001.png)
158139

159140
### Unattached disks
160141

@@ -173,19 +154,19 @@ Write-Host "Secret URL:" $Sourcedisk.EncryptionSettingsCollection.EncryptionSett
173154
Write-Host "Key URL:" $Sourcedisk.EncryptionSettingsCollection.EncryptionSettings.KeyEncryptionKey.KeyUrl
174155
Write-Host "============================================================================================================================================================="
175156
```
176-
## Using AZ CLI
157+
## Azure CLI
177158

178-
You can validate the **general** encryption status of an encrypted VM using the following AZ CLI commands:
159+
You can validate the *general* encryption status of an encrypted VM by using the following Azure CLI commands:
179160

180161
```bash
181162
VMNAME="VMNAME"
182163
RGNAME="RGNAME"
183164
az vm encryption show --name ${VMNAME} --resource-group ${RGNAME} --query "substatus"
184165
```
185-
![Verify general using CLI ](./media/disk-encryption/verify-encryption-linux/verify-gen-cli.png)
166+
![General encryption status from the Azure CLI ](./media/disk-encryption/verify-encryption-linux/verify-gen-cli.png)
186167

187-
### Single Pass
188-
You can validate the encryption settings from each individual disk using the following AZ CLI commands:
168+
### Single pass
169+
You can validate the encryption settings for each disk by using the following Azure CLI commands:
189170

190171
```bash
191172
az vm encryption show -g ${RGNAME} -n ${VMNAME} --query "disks[*].[name, statuses[*].displayStatus]" -o table
@@ -194,12 +175,11 @@ az vm encryption show -g ${RGNAME} -n ${VMNAME} --query "disks[*].[name, statuse
194175
![Data encryption settings](./media/disk-encryption/verify-encryption-linux/data-encryption-settings-2.png)
195176

196177
>[!IMPORTANT]
197-
> In case the disk does not have encryption settings stamped, it will be shown as
198-
"Disk is not encrypted"
178+
> If the disk doesn't have encryption settings stamped, you'll see the text **Disk is not encrypted**.
199179
200-
Detailed Status and Encryption settings:
180+
Use the following commands to get detailed status and encryption settings.
201181

202-
OS Disk:
182+
OS disk:
203183

204184
```bash
205185
RGNAME="RGNAME"
@@ -217,9 +197,9 @@ echo "==========================================================================
217197
done
218198
```
219199

220-
![OSSingleCLI](./media/disk-encryption/verify-encryption-linux/os-single-cli.png)
200+
![Detailed status and encryption settings for the OS disk](./media/disk-encryption/verify-encryption-linux/os-single-cli.png)
221201

222-
Data Disks:
202+
Data disks:
223203

224204
```bash
225205
RGNAME="RGNAME"
@@ -237,16 +217,17 @@ echo "==========================================================================
237217
done
238218
```
239219

240-
![Data single CLI ](./media/disk-encryption/verify-encryption-linux/data-single-cli.png)
220+
![Detailed status and encryption settings for the data disks](./media/disk-encryption/verify-encryption-linux/data-single-cli.png)
241221

242-
### Dual Pass
222+
### Dual pass
243223

244224
``` bash
245225
az vm encryption show --name ${VMNAME} --resource-group ${RGNAME} -o table
246226
```
247227

248-
![Verify general dual using CLI ](./media/disk-encryption/verify-encryption-linux/verify-gen-dual-cli.png)
249-
You can also check the Encryption settings on the VM Model Storage profile of the OS disk:
228+
![General encryption settings for dual pass via the Azure CLI](./media/disk-encryption/verify-encryption-linux/verify-gen-dual-cli.png)
229+
230+
You can also check the encryption settings on the VM Model Storage profile of the OS disk:
250231

251232
```bash
252233
disk=`az vm show -g ${RGNAME} -n ${VMNAME} --query storageProfile.osDisk.name -o tsv`
@@ -261,7 +242,7 @@ echo "==========================================================================
261242
done
262243
```
263244

264-
![Verify vm profile dual using CLI ](./media/disk-encryption/verify-encryption-linux/verify-vm-profile-dual-cli.png)
245+
![VM profile for dual pass via the Azure CLI](./media/disk-encryption/verify-encryption-linux/verify-vm-profile-dual-cli.png)
265246

266247
### Unattached disks
267248

@@ -284,12 +265,12 @@ echo "==========================================================================
284265

285266
Unmanaged disks are VHD files that are stored as page blobs in Azure storage accounts.
286267

287-
To get the details of a specific disk, you need to provide:
268+
To get the details for a specific disk, you need to provide:
288269

289-
The ID of the storage account that contains the disk.
290-
A connection string for that particular storage account.
291-
The name of the container that stores the disk.
292-
The disk name.
270+
- The ID of the storage account that contains the disk.
271+
- A connection string for that particular storage account.
272+
- The name of the container that stores the disk.
273+
- The disk name.
293274

294275
This command lists all the IDs for all your storage accounts:
295276

@@ -304,65 +285,58 @@ Select the appropriate ID and store it on a variable:
304285
```bash
305286
id="/subscriptions/<subscription id>/resourceGroups/<resource group name>/providers/Microsoft.Storage/storageAccounts/<storage account name>"
306287
```
307-
The connection string.
308288

309289
This command gets the connection string for one particular storage account and stores it on a variable:
310290

311291
```bash
312292
ConnectionString=$(az storage account show-connection-string --ids $id --query connectionString -o tsv)
313293
```
314294

315-
The container name.
316-
317295
The following command lists all the containers under a storage account:
318296
```bash
319297
az storage container list --connection-string $ConnectionString --query [].[name] -o tsv
320298
```
321-
The container used for disks is normally named "vhds"
299+
The container used for disks is normally named "vhds."
322300

323-
Store the container name on a variable
301+
Store the container name on a variable:
324302
```bash
325303
ContainerName="name of the container"
326304
```
327305

328-
The disk name.
329-
330-
Use this command to list all the blobs on a particular container
306+
Use this command to list all the blobs on a particular container:
331307
```bash
332308
az storage blob list -c ${ContainerName} --connection-string $ConnectionString --query [].[name] -o tsv
333309
```
334-
Choose the disk you want to query and store its name on a variable.
310+
Choose the disk that you want to query and store its name on a variable:
335311
```bash
336312
DiskName="diskname.vhd"
337313
```
338-
Query the disk encryption settings
314+
Query the disk encryption settings:
339315
```bash
340316
az storage blob show -c ${ContainerName} --connection-string ${ConnectionString} -n ${DiskName} --query metadata.DiskEncryptionSettings
341317
```
342318

343-
## From the OS
344-
Validate if the data disk partitions are encrypted (and the OS disk isn't)
319+
## Operating system
320+
Validate if the data disk partitions are encrypted (and the OS disk isn't).
345321

346-
When a partition/disk is encrypted it's displayed as **crypt** type, when it's not encrypted it's displayed as **part/disk** type
322+
When a partition or disk is encrypted, it's displayed as a **crypt** type. When it's not encrypted, it's displayed as a **part/disk** type.
347323

348324
``` bash
349325
lsblk
350326
```
351327

352-
![Os Crypt layer ](./media/disk-encryption/verify-encryption-linux/verify-os-crypt-layer.png)
353-
354-
You can get further details using the following "lsblk" variant.
328+
![OS crypt layer for a partition](./media/disk-encryption/verify-encryption-linux/verify-os-crypt-layer.png)
355329

356-
You'll see a **crypt** type layer that is mounted by the extension.
330+
You can get more details by using the following **lsblk** variant.
357331

358-
The following example shows Logical Volumes and normal disks having a "**crypto\_LUKS FSTYPE**".
332+
You'll see a **crypt** type layer that is mounted by the extension. The following example shows logical volumes and normal disks having **crypto\_LUKS FSTYPE**.
359333

360334
```bash
361335
lsblk -o NAME,TYPE,FSTYPE,LABEL,SIZE,RO,MOUNTPOINT
362336
```
363-
![Os Crypt layer 2](./media/disk-encryption/verify-encryption-linux/verify-os-crypt-layer-2.png)
337+
![OS crypt layer for logical volumes and normal disks](./media/disk-encryption/verify-encryption-linux/verify-os-crypt-layer-2.png)
364338

365-
As an extra step, you can also validate if the data disk has any keys loaded
339+
As an extra step, you can validate if the data disk has any keys loaded:
366340

367341
``` bash
368342
cryptsetup luksDump /dev/VGNAME/LVNAME
@@ -372,12 +346,12 @@ cryptsetup luksDump /dev/VGNAME/LVNAME
372346
cryptsetup luksDump /dev/sdd1
373347
```
374348

375-
And which dm devices are listed as crypt
349+
And you can check which **dm** devices are listed as **crypt**:
376350

377351
```bash
378352
dmsetup ls --target crypt
379353
```
380354

381-
## Next Steps
355+
## Next steps
382356

383357
- [Azure Disk Encryption troubleshooting](disk-encryption-troubleshooting.md)

0 commit comments

Comments
 (0)