# Linux Disk Encryption Audits via Hexnode UEM

**Technical Summary:** Automated Linux Disk Encryption Verification with scripts utilizes **lsblk device mapping** and **dm-crypt status checks** to validate Full Disk Encryption (FDE). By executing remote Bash scripts with **root-level authority**, administrators can detect the crypto\_LUKS signature and verify active mapping status across a distributed fleet. This telemetry ensures “Proof of Encryption” for **GDPR, HIPAA, and SOC2 compliance**, providing a centralized audit trail in the Hexnode Action History.

This guide provides a technical framework for security administrators to validate **LUKS (Linux Unified Key Setup)** encryption across distributed Linux fleets using Hexnode’s [Execute Custom Script ](https://www.hexnode.com/mobile-device-management/help/executing-custom-scripts-for-windows/)action.

The Security Mandate: Why Verification Overrides Assumption 
------------------------------------------------------------

In enterprise environments, “Encryption at Rest” is a non-negotiable compliance requirement (GDPR, HIPAA, SOC2). However, manual verification is unscalable. Unencrypted Linux endpoints represent a “Silent Risk” where data remains in plain text if a device is decommissioned, lost, or subjected to a col d-boot attack.

Hexnode’s Role: Hexnode UEM transforms this manual audit into an automated telemetry gathering process. By deploying the verification script as a remote action, Hexnode ensures that the “Proof of Encryption” is centralized and actionable.

Technical Execution: LUKS/dm-crypt Status Script 
-------------------------------------------------

The following Bash script utilizes lsblk for device mapping and cryptsetup for status validation. It is designed to be non-intrusive, requiring no modifications to the disk structure.

Bash Script to check drive encryption in linux

\#!/usr/bin/env bash # Header for Hexnode Action Logs echo "--- Linux Disk Encryption Audit ---" echo "Timestamp: $(date)" # 1. Broad Device Mapping # Identifies all block devices and their associated filesystem types (FSTYPE) echo "Block Device Topology:" lsblk -o NAME,TYPE,FSTYPE,MOUNTPOINT # 2. Targeted LUKS Detection # Filters for the 'crypto\_LUKS' signature, the standard for Linux Full Disk Encryption (FDE) echo -e "\\nLUKS-Encrypted Devices Detected:" echo "--------------------------------" encrypted\_devs=$(lsblk -o NAME,FSTYPE | grep -i "luks") if \[ -z "$encrypted\_devs" \]; then echo "\[ALERT\] No LUKS-encrypted partitions identified." else echo "$encrypted\_devs" fi # 3. Active Mapping Status # Uses dm-crypt to verify if the volumes are currently unlocked and active echo -e "\\nActive dm-crypt Mapping Details:" echo "--------------------------------" if command -v cryptsetup >/dev/null 2>&1; then sudo cryptsetup status --all 2>/dev/null || echo "No active dm-crypt mappings found." else echo "\[ERROR\] 'cryptsetup' utility not found. Cannot verify active mapping status." fi

   1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

  \#!/usr/bin/env bash 

\# Header for Hexnode Action Logs 

echo "--- Linux Disk Encryption Audit ---"

echo "Timestamp: $(date)"

\# 1. Broad Device Mapping 

\# Identifies all block devices and their associated filesystem types (FSTYPE) 

echo "Block Device Topology:"

lsblk -o NAME,TYPE,FSTYPE,MOUNTPOINT

\# 2. Targeted LUKS Detection 

\# Filters for the 'crypto\_LUKS' signature, the standard for Linux Full Disk Encryption (FDE) 

echo -e "\\nLUKS-Encrypted Devices Detected:"

echo "--------------------------------"

encrypted\_devs=$(lsblk -o NAME,FSTYPE | grep -i "luks")

if \[ -z "$encrypted\_devs" \]; then

 echo "\[ALERT\] No LUKS-encrypted partitions identified."

else

 echo "$encrypted\_devs"

fi

\# 3. Active Mapping Status 

\# Uses dm-crypt to verify if the volumes are currently unlocked and active 

echo -e "\\nActive dm-crypt Mapping Details:"

echo "--------------------------------"

if command -v cryptsetup >/dev/null 2>&1; then

 sudo cryptsetup status --all 2>/dev/null || echo "No active dm-crypt mappings found."

else

 echo "\[ERROR\] 'cryptsetup' utility not found. Cannot verify active mapping status."

fi

   

 

  

[![](https://cdn.hexnode.com/mobile-device-management/help/wp-content/uploads/2026/04/Output-received-for-the-check-drive-encryption-in-linux-scaled.png%22%20alt=)](https://cdn.hexnode.com/mobile-device-management/help/wp-content/uploads/2026/04/Output-received-for-the-check-drive-encryption-in-linux-scaled.png%22%20title=)

Strategic Audit Matrix 
-----------------------

Audit MetricLinux CommandSecurity SignificancePartition Signaturelsblk -o NAME,FSTYPEConfirms if LUKS headers exist on the physical disk.Mapping Statuscryptsetup statusVerifies if the encrypted volume is active and correctly mapped.Device Topologylsblk -o MOUNTPOINTIdentifies which system paths (like /home or /) are protected.Utility Availabilitycommand -v cryptsetupEnsures the required security tools are installed on the endpoint.Streamlining Multi-Environment Implementation with Hexnode UEM Scripts 
-----------------------------------------------------------------------

Hexnode UEM helps enterprises handle everyday needs by using its script deployment setup. It makes implementation easy across different environments — and now, let’s look at some scenarios.

ScenarioHexnode Utility & Impact**Fleet-Wide Compliance Audit**Use the Execute Custom Script action to target specific Linux User Groups. The output is captured in the Hexnode “Action History,” providing an audit trail for compliance officers.**Pre-Decommissioning Sanitization**Before a device is retired, admins run this script to ensure the disk was indeed encrypted, mitigating the risk of data leakage during hardware disposal.Deployment Workflow in Hexnode 
-------------------------------

Follow these streamlined steps to audit or manage your Linux’s Disk Encryption:

1. **Script Integration** 
    1. Log in to the **Hexnode UEM Portal**.
    2. Navigate to **Content > My Files** and upload your .sh script, or prepare to use the Hexnode Repository.
    3. Alternatively, use **Hexnode Genie** within the Script Editor to refine the logic.
2. **Targeting & Execution**
    1. Go to the **Manage** tab and select your target Linux devices or Device Groups.
    2. Select Actions > Execute Custom Script.
    3. Choose the Bash platform.
    4. Select your script from the repository. The **Binary Path** (usually /bin/bash) will be auto-populated.
3. **Monitoring & Validation** 
    1. Once deployed, navigate to Manage > \[Device Name\] > Action History.
    2. Click Show Output next to the “Execute Custom Script” action.
 Note:Scripts executed via Hexnode run with **root privileges**, meaning they can modify system-level NetworkManager files without requiring any user intervention or password prompts.