Skip to content

Commit c6248ad

Browse files
ttorblettorble
authored
Merge pull request #108553 from jofrance/master
Update how-to-verify-encryption-status.md
2 parents 35f1e29 + 0bd2832 commit c6248ad

File tree

1 file changed

+150
-52
lines changed

1 file changed

+150
-52
lines changed

‎articles/virtual-machines/linux/how-to-verify-encryption-status.md

Lines changed: 150 additions & 52 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ ms.custom: seodec18
1515

1616
# How to verify encryption status for Linux
1717

18-
**This scenario is applicable to ADE dual-pass and single-pass extensions.**
18+
**This scenario applies for ADE dual-pass and single-pass extensions.**
1919
This Document scope is to validate the encryption status of a virtual machine using different methods.
2020

2121
### Environment
@@ -24,35 +24,54 @@ This Document scope is to validate the encryption status of a virtual machine us
2424

2525
### Procedure
2626

27-
1. A virtual machine has been encrypted using dual-pass or single-pass.
28-
2. Once the encryption process is triggered (in progress) or has been completed, we can validate the encryption status using different methods defined below
27+
A virtual machine has been encrypted using dual-pass or single-pass.
28+
29+
The encryption status can be validated during or after the encryption using different methods.
30+
31+
>[!NOTE]
32+
>We're using variables throughout the document, replace the values accordingly.
2933
3034
### Verification
3135

32-
The encryption status validation can be done from the Portal, PowerShell, AZ CLI and/or within the VM (OS side). Below the different validations methods:
36+
The verification can be done from the Portal, PowerShell, AZ CLI and, or from the VM OS side.
37+
38+
This verification can be done by checking the disks attached to a particular VM.
39+
40+
Or by querying the encryption settings on each individual disk whether the disk is attached or unattached.
3341

34-
## Using the Portal:
42+
Below the different validations methods:
3543

36-
- You can validate the encryption status of a virtual machine by taking a look at the extensions blade in the corresponding virtual machine from the Portal.
37-
Inside the **Extensions** blade, you will see the ADE extension listed. You can click it and take a look at the **status message** which will indicate the current encryption status:
44+
## Using the Portal
45+
46+
Validate the encryption status by checking the extensions section on the Azure portal.
47+
48+
Inside the **Extensions** section, you'll see the ADE extension listed.
49+
50+
Click it and take a look at the **status message**, it will indicate the current encryption status:
3851

3952
![Portal check number 1](./media/disk-encryption/verify-encryption-linux/portal-check-001.png)
4053

41-
In the list of extensions, you will also be able to see the corresponding ADE extension version. Version 0.x corresponds to ADE Dual-Pass and version 1.x corresponds to ADE Single-pass
42-
You can also get further details clicking on the extension and then on *View detailed status*, once that's done, you will be able to see a more detailed status of the encryption process in json format as shown in the image below:
54+
In the list of extensions, you'll see the corresponding ADE extension version. Version 0.x corresponds to ADE Dual-Pass and version 1.x corresponds to ADE Single-pass.
55+
56+
You can get further details clicking on the extension and then on *View detailed status*.
57+
58+
You'll see a more detailed status of the encryption process in json format:
4359

4460
![Portal check number 2](./media/disk-encryption/verify-encryption-linux/portal-check-002.png)
4561

4662
![Portal check number 3](./media/disk-encryption/verify-encryption-linux/portal-check-003.png)
4763

48-
- Another way of validating the encryption status is by taking a look at the **Disks** blade. Over there, you get to see if encryption is enabled on each disk attached to a particular VM.
64+
Another way of validating the encryption status is by taking a look at the **Disks** section.
4965

5066
![Portal check number 4](./media/disk-encryption/verify-encryption-linux/portal-check-004.png)
5167

5268
>[!NOTE]
53-
> As a warning, this status is not too accurate. This just means the disks have encryption settings stamped but not that they were actually encrypted at OS level. Unfortunately by the way the ADE extension design works today, the disks get stamped first and encrypted later. If the encryption process fails, the disks may end up stamped but not encrypted. To confirm if the disks are truly encrypted, you can double check the encryption of each disk at OS level, following instructions in one of the upcoming sections.
69+
> This status means the disks have encryption settings stamped but not that they were actually encrypted at OS level.
70+
> By design, the disks get stamped first and encrypted later.
71+
> If the encryption process fails, the disks may end up stamped but not encrypted.
72+
> To confirm if the disks are truly encrypted, you can double check the encryption of each disk at OS level.
5473
55-
## Using PowerShell:
74+
## Using PowerShell
5675

5776
You can validate the **general** encryption status of an encrypted VM using the following PowerShell commands:
5877

@@ -61,17 +80,12 @@ You can validate the **general** encryption status of an encrypted VM using the
6180
$RGNAME="RGNAME"
6281
Get-AzVmDiskEncryptionStatus -ResourceGroupName ${RGNAME} -VMName ${VMNAME}
6382
```
64-
65-
>[!NOTE]
66-
> Replace the "VMNAME" and "RGNAME" variables accordingly
67-
68-
![verify status PowerShell 1](./media/disk-encryption/verify-encryption-linux/verify-status-ps-01.png)
83+
![check PowerShell 1](./media/disk-encryption/verify-encryption-linux/verify-status-ps-01.png)
6984

7085
You can capture the encryption settings from each individual disk using the following PowerShell commands:
7186

72-
**Single-Pass:**
73-
In the case of single-pass the encryption settings are stamped in each of the disks (OS and Data).
74-
You can capture the OS disk encryption settings in single pass as follows:
87+
### Single-Pass
88+
If single-pass, the encryption settings are stamp on each of the disks (OS and Data), you can capture the OS disk encryption settings in single pass as follows:
7589

7690
``` powershell
7791
$RGNAME = "RGNAME"
@@ -89,16 +103,12 @@ $VM = Get-AzVM -Name ${VMNAME} -ResourceGroupName ${RGNAME}
89103
Write-Host "Key URL:" $Sourcedisk.EncryptionSettingsCollection.EncryptionSettings.KeyEncryptionKey.KeyUrl
90104
Write-Host "============================================================================================================================================================="
91105
```
92-
93106
![Verify OS Single pass 01](./media/disk-encryption/verify-encryption-linux/verify-os-single-ps-001.png)
94107

95-
In case the disk does not have encryption settings stamped, the output will be empty as shown below:
108+
If the disk doesn't have encryption settings stamped, the output will be empty as shown below:
96109

97110
![OS Encryption settings 2](./media/disk-encryption/verify-encryption-linux/os-encryption-settings-2.png)
98111

99-
>[!NOTE]
100-
> Replace the $VMNAME and $RGNAME variables accordingly
101-
102112
Capture Data disk(s) encryption settings:
103113

104114
```azurepowershell
@@ -120,16 +130,12 @@ $VM = Get-AzVM -Name ${VMNAME} -ResourceGroupName ${RGNAME}
120130
Write-Host "============================================================================================================================================================="
121131
}
122132
```
123-
124133
![Verify data single ps 001](./media/disk-encryption/verify-encryption-linux/verify-data-single-ps-001.png)
125134

126-
>[!NOTE]
127-
> Replace the "VMNAME" and "RGNAME" variables accordingly
135+
### Dual-Pass
136+
In Dual Pass, the encryption settings are stamped in the VM model and not on each individual disk.
128137

129-
**Dual-Pass**:
130-
In the case of dual pass, the encryption settings are stamped in the VM model and not on in individual disk.
131-
132-
To verify the encryption settings were stamped in dual-pass you can use the following commands:
138+
To verify the encryption settings were stamped in dual-pass, you can use the following commands:
133139

134140
```azurepowershell
135141
$RGNAME = "RGNAME"
@@ -148,13 +154,26 @@ Write-Host "Secret URL:" $Sourcedisk.EncryptionSettingsCollection.EncryptionSett
148154
Write-Host "Key URL:" $Sourcedisk.EncryptionSettingsCollection.EncryptionSettings.KeyEncryptionKey.KeyUrl
149155
Write-Host "============================================================================================================================================================="
150156
```
157+
![Verify dual pass PowerShell 1](./media/disk-encryption/verify-encryption-linux/verify-dual-ps-001.png)
151158

152-
>[!NOTE]
153-
> Replace the "VMNAME" and "RGNAME" variables accordingly
159+
### Unattached disks
154160

155-
![Verify dual pass PowerShell 1](./media/disk-encryption/verify-encryption-linux/verify-dual-ps-001.png)
161+
Check the encryption settings for disks that aren't attached to a VM.
156162

157-
## Using AZ CLI:
163+
### Managed disks
164+
```powershell
165+
$Sourcedisk = Get-AzDisk -ResourceGroupName ${RGNAME} -DiskName ${TARGETDISKNAME}
166+
Write-Host "============================================================================================================================================================="
167+
Write-Host "Encryption Settings:"
168+
Write-Host "============================================================================================================================================================="
169+
Write-Host "Enabled:" $Sourcedisk.EncryptionSettingsCollection.Enabled
170+
Write-Host "Version:" $Sourcedisk.EncryptionSettingsCollection.EncryptionSettingsVersion
171+
Write-Host "Source Vault:" $Sourcedisk.EncryptionSettingsCollection.EncryptionSettings.DiskEncryptionKey.SourceVault.Id
172+
Write-Host "Secret URL:" $Sourcedisk.EncryptionSettingsCollection.EncryptionSettings.DiskEncryptionKey.SecretUrl
173+
Write-Host "Key URL:" $Sourcedisk.EncryptionSettingsCollection.EncryptionSettings.KeyEncryptionKey.KeyUrl
174+
Write-Host "============================================================================================================================================================="
175+
```
176+
## Using AZ CLI
158177

159178
You can validate the **general** encryption status of an encrypted VM using the following AZ CLI commands:
160179

@@ -163,22 +182,15 @@ VMNAME="VMNAME"
163182
RGNAME="RGNAME"
164183
az vm encryption show --name ${VMNAME} --resource-group ${RGNAME} --query "substatus"
165184
```
166-
167-
>[!NOTE]
168-
> Replace the "VMNAME" and "RGNAME" variables accordingly
169-
170185
![Verify general using CLI ](./media/disk-encryption/verify-encryption-linux/verify-gen-cli.png)
171186

172-
Single Pass:
187+
### Single Pass
173188
You can validate the encryption settings from each individual disk using the following AZ CLI commands:
174189

175190
```bash
176191
az vm encryption show -g ${RGNAME} -n ${VMNAME} --query "disks[*].[name, statuses[*].displayStatus]" -o table
177192
```
178193

179-
>[!NOTE]
180-
> Replace the $VMNAME and $RGNAME variables accordingly
181-
182194
![Data encryption settings](./media/disk-encryption/verify-encryption-linux/data-encryption-settings-2.png)
183195

184196
>[!IMPORTANT]
@@ -198,6 +210,7 @@ for disk in $disk; do \
198210
echo "============================================================================================================================================================="
199211
echo -ne "Disk Name: "; az disk show -g ${RGNAME} -n ${disk} --query name -o tsv; \
200212
echo -ne "Encryption Enabled: "; az disk show -g ${RGNAME} -n ${disk} --query encryptionSettingsCollection.enabled -o tsv; \
213+
echo -ne "Version: "; az disk show -g ${RGNAME} -n ${TARGETDISKNAME} --query encryptionSettingsCollection.encryptionSettingsVersion -o tsv; \
201214
echo -ne "Disk Encryption Key: "; az disk show -g ${RGNAME} -n ${disk} --query encryptionSettingsCollection.encryptionSettings[].diskEncryptionKey.secretUrl -o tsv; \
202215
echo -ne "key Encryption Key: "; az disk show -g ${RGNAME} -n ${disk} --query encryptionSettingsCollection.encryptionSettings[].keyEncryptionKey.keyUrl -o tsv; \
203216
echo "============================================================================================================================================================="
@@ -214,9 +227,10 @@ VMNAME="VMNAME"
214227
az vm encryption show --name ${VMNAME} --resource-group ${RGNAME} --query "substatus"
215228

216229
for disk in `az vm show -g ${RGNAME} -n ${VMNAME} --query storageProfile.dataDisks[].name -o tsv`; do \
217-
echo "============================================================================================================================================================="
230+
echo "============================================================================================================================================================="; \
218231
echo -ne "Disk Name: "; az disk show -g ${RGNAME} -n ${disk} --query name -o tsv; \
219232
echo -ne "Encryption Enabled: "; az disk show -g ${RGNAME} -n ${disk} --query encryptionSettingsCollection.enabled -o tsv; \
233+
echo -ne "Version: "; az disk show -g ${RGNAME} -n ${TARGETDISKNAME} --query encryptionSettingsCollection.encryptionSettingsVersion -o tsv; \
220234
echo -ne "Disk Encryption Key: "; az disk show -g ${RGNAME} -n ${disk} --query encryptionSettingsCollection.encryptionSettings[].diskEncryptionKey.secretUrl -o tsv; \
221235
echo -ne "key Encryption Key: "; az disk show -g ${RGNAME} -n ${disk} --query encryptionSettingsCollection.encryptionSettings[].keyEncryptionKey.keyUrl -o tsv; \
222236
echo "============================================================================================================================================================="
@@ -225,7 +239,7 @@ done
225239

226240
![Data single CLI ](./media/disk-encryption/verify-encryption-linux/data-single-cli.png)
227241

228-
Dual Pass:
242+
### Dual Pass
229243

230244
``` bash
231245
az vm encryption show --name ${VMNAME} --resource-group ${RGNAME} -o table
@@ -237,9 +251,10 @@ You can also check the Encryption settings on the VM Model Storage profile of th
237251
```bash
238252
disk=`az vm show -g ${RGNAME} -n ${VMNAME} --query storageProfile.osDisk.name -o tsv`
239253
for disk in $disk; do \
240-
echo "============================================================================================================================================================="
254+
echo "============================================================================================================================================================="; \
241255
echo -ne "Disk Name: "; az disk show -g ${RGNAME} -n ${disk} --query name -o tsv; \
242256
echo -ne "Encryption Enabled: "; az disk show -g ${RGNAME} -n ${disk} --query encryptionSettingsCollection.enabled -o tsv; \
257+
echo -ne "Version: "; az disk show -g ${RGNAME} -n ${TARGETDISKNAME} --query encryptionSettingsCollection.encryptionSettingsVersion -o tsv; \
243258
echo -ne "Disk Encryption Key: "; az disk show -g ${RGNAME} -n ${disk} --query encryptionSettingsCollection.encryptionSettings[].diskEncryptionKey.secretUrl -o tsv; \
244259
echo -ne "key Encryption Key: "; az disk show -g ${RGNAME} -n ${disk} --query encryptionSettingsCollection.encryptionSettings[].keyEncryptionKey.keyUrl -o tsv; \
245260
echo "============================================================================================================================================================="
@@ -248,23 +263,106 @@ done
248263

249264
![Verify vm profile dual using CLI ](./media/disk-encryption/verify-encryption-linux/verify-vm-profile-dual-cli.png)
250265

251-
## From the Linux VM OS:
252-
Validate if the data disk partitions are encrypted (and the OS disk is not). When a partition/disk is encrypted it's displayed as **crypt** type, when it's not encrypted it is displayed as **part/disk** type
266+
### Unattached disks
267+
268+
Check the encryption settings for disks that aren't attached to a VM.
269+
270+
### Managed disks
271+
272+
```bash
273+
RGNAME="RGNAME"
274+
TARGETDISKNAME="DISKNAME"
275+
echo "============================================================================================================================================================="
276+
echo -ne "Disk Name: "; az disk show -g ${RGNAME} -n ${TARGETDISKNAME} --query name -o tsv; \
277+
echo -ne "Encryption Enabled: "; az disk show -g ${RGNAME} -n ${TARGETDISKNAME} --query encryptionSettingsCollection.enabled -o tsv; \
278+
echo -ne "Version: "; az disk show -g ${RGNAME} -n ${TARGETDISKNAME} --query encryptionSettingsCollection.encryptionSettingsVersion -o tsv; \
279+
echo -ne "Disk Encryption Key: "; az disk show -g ${RGNAME} -n ${TARGETDISKNAME} --query encryptionSettingsCollection.encryptionSettings[].diskEncryptionKey.secretUrl -o tsv; \
280+
echo -ne "key Encryption Key: "; az disk show -g ${RGNAME} -n ${TARGETDISKNAME} --query encryptionSettingsCollection.encryptionSettings[].keyEncryptionKey.keyUrl -o tsv; \
281+
echo "============================================================================================================================================================="
282+
```
283+
### Unmanaged disks
284+
285+
Unmanaged disks are VHD files that are stored as page blobs in Azure storage accounts.
286+
287+
To get the details of a specific disk, you need to provide:
288+
289+
The ID of the storage account that contains the disk.
290+
A connection string for that particular storage account.
291+
The name of the container that stores the disk.
292+
The disk name.
293+
294+
This command lists all the IDs for all your storage accounts:
295+
296+
```bash
297+
az storage account list --query [].[id] -o tsv
298+
```
299+
The storage account IDs are listed in the following form:
300+
301+
/subscriptions/\<subscription id>/resourceGroups/\<resource group name>/providers/Microsoft.Storage/storageAccounts/\<storage account name>
302+
303+
Select the appropriate ID and store it on a variable:
304+
```bash
305+
id="/subscriptions/<subscription id>/resourceGroups/<resource group name>/providers/Microsoft.Storage/storageAccounts/<storage account name>"
306+
```
307+
The connection string.
308+
309+
This command gets the connection string for one particular storage account and stores it on a variable:
310+
311+
```bash
312+
ConnectionString=$(az storage account show-connection-string --ids $id --query connectionString -o tsv)
313+
```
314+
315+
The container name.
316+
317+
The following command lists all the containers under a storage account:
318+
```bash
319+
az storage container list --connection-string $ConnectionString --query [].[name] -o tsv
320+
```
321+
The container used for disks is normally named "vhds"
322+
323+
Store the container name on a variable
324+
```bash
325+
ContainerName="name of the container"
326+
```
327+
328+
The disk name.
329+
330+
Use this command to list all the blobs on a particular container
331+
```bash
332+
az storage blob list -c ${ContainerName} --connection-string $ConnectionString --query [].[name] -o tsv
333+
```
334+
Choose the disk you want to query and store its name on a variable.
335+
```bash
336+
DiskName="diskname.vhd"
337+
```
338+
Query the disk encryption settings
339+
```bash
340+
az storage blob show -c ${ContainerName} --connection-string ${ConnectionString} -n ${DiskName} --query metadata.DiskEncryptionSettings
341+
```
342+
343+
## From the OS
344+
Validate if the data disk partitions are encrypted (and the OS disk isn't)
345+
346+
When a partition/disk is encrypted it's displayed as **crypt** type, when it's not encrypted it's displayed as **part/disk** type
253347

254348
``` bash
255349
lsblk
256350
```
257351

258352
![Os Crypt layer ](./media/disk-encryption/verify-encryption-linux/verify-os-crypt-layer.png)
259353

260-
You can get further details using the following "lsblk" variant. Using this one, you'll see a **crypt** type layer that is mounted by the extension, the following example shows Logical Volumes and normal disks having a **crypto\_LUKS FSTYPE**.
354+
You can get further details using the following "lsblk" variant.
355+
356+
You'll see a **crypt** type layer that is mounted by the extension.
357+
358+
The following example shows Logical Volumes and normal disks having a "**crypto\_LUKS FSTYPE**".
261359

262360
```bash
263361
lsblk -o NAME,TYPE,FSTYPE,LABEL,SIZE,RO,MOUNTPOINT
264362
```
265363
![Os Crypt layer 2](./media/disk-encryption/verify-encryption-linux/verify-os-crypt-layer-2.png)
266364

267-
As an extra step, you can also validate if the data disk has any dmcrypt keys loaded
365+
As an extra step, you can also validate if the data disk has any keys loaded
268366

269367
``` bash
270368
cryptsetup luksDump /dev/VGNAME/LVNAME
@@ -282,4 +380,4 @@ dmsetup ls --target crypt
282380

283381
## Next Steps
284382

285-
- [Azure Disk Encryption troubleshooting](disk-encryption-troubleshooting.md)
383+
- [Azure Disk Encryption troubleshooting](disk-encryption-troubleshooting.md)

0 commit comments

Comments
 (0)