Red Hat Security: Linux in Physical, Virtual, and Cloud

Red Hat Enterprise Linux supports block device encryption with Linux Unified Key Setup (LUKS).

When installing the operating system automatically, Kickstart can create encrypted block devices.

You can use the cryptsetup command to encrypt existing devices after installation.

A passphrase is required at boot time to decrypt a LUKS-encrypted block device.

NBDE automates the decryption of LUKS-encrypted disks without manually entering a passphrase at boot time.

You can automate NBDE configuration with Ansible by using the rhel-system-roles.nbde_client and rhel-system-roles.nbde_server Ansible Roles.

NBDE uses the Clevis framework on the client side (decryption), and queries Tang servers to determine whether the client is running on a secure network.

The Clevis framework provides binding policies that enable the use of multiple Tang servers.

Red Hat recommends that you periodically rotate the signature and exchange keys for a Tang server.