KVM has a number of features that are not always obvious. I would like to show how to use encrypted hard drive images with KVM / QEMU .

Encryption is only supported with the qcow format.

This option is hinted at in the man pages, but actual use is obscure.

To create a disk image use qemu-img. See man qemu-img for additional information.

Create an encrypted disk

qemu-img create -e -f qcow2 image.qcow2 10G

If you pass the option -e or -o encryption when you create an image, the resulting image will be encrypted, with an empty (blank) password – there is no option to set a password in a single step at the time of creation.

To set a password, again use qemu-img , but this time with the convert option

qemu-img convert -e -O qcow2 image.qcow2 encrypted.qcow2

You will be asked to give a password twice. At the first prompt hit enter (as the password is blank), at the second prompt you will set the password for your resulting encrypted disk.

Examples (pay attention to the output !!!)

Create and unencrypted image.qcow, then convert an encrypted.qcow


bodhi@Succubus$ qemu-img create -f qcow2 image.qcow2 10G
Formatting 'image.qcow2', fmt=qcow2 size=10737418240 encryption=off cluster_size=0


bodhi@Succubus$ qemu-img convert -e -O qcow2 image.qcow2 encrypted.qcow2
Disk image 'encrypted.qcow2' is encrypted.
password:

Create an encrypted image.qcow2 (empty password) and add a password to an encrypted.qcow2


bodhi@Succubus$ qemu-img create -e -f qcow2 image.qcow2 10G
Formatting 'image.qcow2', fmt=qcow2 size=10737418240 encryption=on cluster_size=0


bodhi@Succubus$ qemu-img convert -e -O qcow2 image.qcow2 encrypted.qcow2
Disk image 'image.qcow2' is encrypted.
password: <-- Hit the enter key here
Disk image 'encrypted.qcow2' is encrypted.
password: <-- Enter your password here.

Determine if you qcow image is encrypted

You can review the details of your images with qemu-img info

qemu-img info encrypted.qcow2


bodhi@Succubus$ qemu-img info encrypted.qcow2
image: encrypted.qcow2 <-- Note encryption
file format: qcow2
virtual size: 10G (10737418240 bytes)
disk size: 136K
encrypted: yes <-- Note encryption
cluster_size: 65536

Using the images

This step is confusing, more so if you are not familiar with qemu / kvm and the “qemu monitor”. With a guest running, access the monitor with Ctrl-Alt-2 . Return to the graphical guest interface with Ctrl-Alt-1

For information on how to use the monitor , use the built in help (enter help or hit the tab key).

Start your guest :

kvm -cdrom linux.iso -hda encrypted.qcow2

You will see the guest does not start, the kvm (QEMU) window reads “Stopped”

What now you ask ???

You can hit Ctrl-Alt-2 to access the qemu monitor.

At the (qemu monitor) prompt enter

cont

You will then be asked to enter your password. Once you enter the correct password return to the guest with Ctrl-alt-1

If you wish to use detach to start your guest, you can skip the above step by redirecting the qemu monitor to your terminal with the -monitor-stdio option:

dtach -c /tmp/crypt kvm -boot d -cdrom lucid-desktop-amd64.iso -hda encrypted.qcow2 -m 512 -monitor stdio

It looks like this (in the terminal)


QEMU 0.11.0 monitor - type 'help' for more information
(qemu) cont
ide0-hd0 (encrypted.qcow2) is encrypted.
Password: ********
(qemu)

You then detach from the kvm session with Ctrl-\