磁盘加密保护

五.磁盘加密保护

• LUKS ( Linux 统一密钥设置 ) 是标准的设备加密格式
• LUKS 可以对分区或卷进行加密
• 必须首先对加密的卷进行解密 , 才能挂载其中的文件系统


创建新加密的卷
• 使用 fdisk 创建新分区
• cryptsetup luksFormat /dev/vdaN 可对新分区进行加密 ,并设置解密密码
• 您输入正确的解密密码之后 , cryptsetup luksOpen/dev/vdaN name 会将加密的卷 /dev/vdaN 解锁为/dev/mapper/name
• 解密的卷上创建 xfs 文件系统 : mkfs -t xfs /dev/mapper/name
• 创建目录挂载点 , 并挂载文件系统 : 
  mkdir /secret
  mount /dev/mapper/name /secret
• 完成之后  umount /dev/mapper/name 并运行
  cryptsetup luksClose name 以锁定加密的卷




    1  fdisk /dev/vdb ##分区
    2  partprobe 
    3  cryptsetup luksFormat /dev/vdb1 ##加密
    4  cryptsetup open /dev/vdb1 westos ##打开加密层并命名
    5  ll /dev/mapper/westos 
    6  mkfs.xfs /dev/mapper/westos ##初始化
    7  mount /dev/mapper/westos /mnt ##挂载
    8  cd /mnt/
    9  ls
   10  touch file{1..10} ##在/mnt目录下创建10个文件
   11  df ##查看此时挂载情况
   12  ls
   15  umount /mnt ##取消挂载
   16  df
   17  cd /mnt/
   18  ls
   19  cd
   20  mount /dev/mapper/westos  /mnt/ ##挂载
   21  cd /mnt
   22  ls ##查看挂载与否文件的情况
   23  umount /mnt/
   24  cd
   25  umount /mnt/
   26  ll /dev/mapper/
   27  cryptsetup close westos ##关闭加密层
   28  ll /dev/mapper/
## 29  mount /dev/vdb1 /mnt
## 30  mount /dev/mapper/westos /mnt
   31  cryptsetup open /dev/vdb1 westos ##先打开加密层再挂载
   32  mount /dev/mapper/westos /mnt
   33  cd /mnt
   34  ls
 


------------------------------------------------------------------------------
[root@desktop5 ~]# fdisk /dev/vdb
Welcome to fdisk (util-linux 2.23.2).


Changes will remain in memory only, until you decide to write them.
Be careful before using the write command.


Device does not contain a recognized partition table
Building a new DOS disklabel with disk identifier 0x6fb16d36.


Command (m for help): n
Partition type:
   p   primary (0 primary, 0 extended, 4 free)
   e   extended
Select (default p): 
Using default response p
Partition number (1-4, default 1): 
First sector (2048-20971519, default 2048): 
Using default value 2048
Last sector, +sectors or +size{K,M,G} (2048-20971519, default 20971519): +1G
Partition 1 of type Linux and of size 1 GiB is set


Command (m for help): wq
The partition table has been altered!


Calling ioctl() to re-read partition table.
Syncing disks.
[root@desktop5 ~]# partprobe 
[root@desktop5 ~]# cryptsetup luksFormat /dev/vdb1


WARNING!
========
This will overwrite data on /dev/vdb1 irrevocably.


Are you sure? (Type uppercase yes): yes
[root@desktop5 ~]# cryptsetup luksFormat /dev/vdb1


WARNING!
========
This will overwrite data on /dev/vdb1 irrevocably.


Are you sure? (Type uppercase yes): YES
Enter passphrase: 
Verify passphrase: 
[root@desktop5 ~]# cryptsetup open /dev/vdb1 westos
Enter passphrase for /dev/vdb1: 
[root@desktop5 ~]# ll /dev/mapper/westos 
lrwxrwxrwx. 1 root root 7 Apr 22 21:20 /dev/mapper/westos -> ../dm-0
[root@desktop5 ~]# mkfs.xfs /dev/mapper/westos 
meta-data=/dev/mapper/westos     isize=256    agcount=4, agsize=65408 blks
         =                       sectsz=512   attr=2, projid32bit=1
         =                       crc=0
data     =                       bsize=4096   blocks=261632, imaxpct=25
         =                       sunit=0      swidth=0 blks
naming   =version 2              bsize=4096   ascii-ci=0 ftype=0
log      =internal log           bsize=4096   blocks=853, version=2
         =                       sectsz=512   sunit=0 blks, lazy-count=1
realtime =none                   extsz=4096   blocks=0, rtextents=0
[root@desktop5 ~]# mount /dev/mapper/westos /mnt
[root@desktop5 ~]# cd /mnt/
[root@desktop5 mnt]# ls
[root@desktop5 mnt]# touch file{1..10}
[root@desktop5 mnt]# df
Filesystem         1K-blocks    Used Available Use% Mounted on
/dev/vda1           10473900 3805140   6668760  37% /
devtmpfs              927072       0    927072   0% /dev
tmpfs                 942660     140    942520   1% /dev/shm
tmpfs                 942660   17032    925628   2% /run
tmpfs                 942660       0    942660   0% /sys/fs/cgroup
/dev/mapper/westos   1043116   32928   1010188   4% /mnt
[root@desktop5 mnt]# ls
file1  file10  file2  file3  file4  file5  file6  file7  file8  file9
[root@desktop5 mnt]# umount /mnt
umount: /mnt: target is busy.
        (In some cases useful info about processes that use
         the device is found by lsof(8) or fuser(1))
[root@desktop5 mnt]# cd
[root@desktop5 ~]# umount /mnt
[root@desktop5 ~]# df
Filesystem     1K-blocks    Used Available Use% Mounted on
/dev/vda1       10473900 3805140   6668760  37% /
devtmpfs          927072       0    927072   0% /dev
tmpfs             942660     140    942520   1% /dev/shm
tmpfs             942660   17032    925628   2% /run
tmpfs             942660       0    942660   0% /sys/fs/cgroup
[root@desktop5 ~]# cd /mnt/
[root@desktop5 mnt]# ls
[root@desktop5 mnt]# cd
[root@desktop5 ~]# mount /dev/mapper/westos  /mnt/
[root@desktop5 ~]# cd /mnt
[root@desktop5 mnt]# ls
file1  file10  file2  file3  file4  file5  file6  file7  file8  file9
[root@desktop5 mnt]# umount /mnt/
umount: /mnt: target is busy.
        (In some cases useful info about processes that use
         the device is found by lsof(8) or fuser(1))
[root@desktop5 mnt]# cd
[root@desktop5 ~]# umount /mnt/
[root@desktop5 ~]# ll /dev/mapper/
total 0
crw-------. 1 root root 10, 236 Apr 22 21:00 control
lrwxrwxrwx. 1 root root       7 Apr 22 21:21 westos -> ../dm-0
[root@desktop5 ~]# cryptsetup close westos
[root@desktop5 ~]# ll /dev/mapper/
total 0
crw-------. 1 root root 10, 236 Apr 22 21:00 control
[root@desktop5 ~]# mount /dev/vdb1 /mnt
mount: unknown filesystem type 'crypto_LUKS'
[root@desktop5 ~]# mount /dev/mapper/westos /mnt
mount: special device /dev/mapper/westos does not exist
[root@desktop5 ~]# cryptsetup open /dev/vdb1 westos
Enter passphrase for /dev/vdb1: 
[root@desktop5 ~]# mount /dev/mapper/westos /mnt
[root@desktop5 ~]# cd /mnt
[root@desktop5 mnt]# ls
file1  file10  file2  file3  file4  file5  file6  file7  file8  file9
-------------------------------------------------------------------------------------




2.开机自动挂载这个加密
[root@desktop5 mnt]# history
    1  vim /etc/crypttab 
    3  vim /root/diskpass ##diskpass是自己取的名字，里面直接放加密的密码
    4  ll
    5  chmod 600 /root/diskpass ##使别人不能有任何权限
    6  cryptsetup luksAddKey /dev/vdb1 /root/diskpass ##输入加密的密码
    9  cat /etc/crypttab 
   10  cat /etc/fstab 






[root@desktop5 mnt]# vim /etc/crypttab
[root@desktop5 mnt]# vim /etc/crypttab 
[root@desktop5 mnt]# vim /root/diskpass
[root@desktop5 mnt]# ll
total 0
-rw-r--r--. 1 root root 0 Apr 22 21:21 file1
-rw-r--r--. 1 root root 0 Apr 22 21:21 file10
-rw-r--r--. 1 root root 0 Apr 22 21:21 file2
-rw-r--r--. 1 root root 0 Apr 22 21:21 file3
-rw-r--r--. 1 root root 0 Apr 22 21:21 file4
-rw-r--r--. 1 root root 0 Apr 22 21:21 file5
-rw-r--r--. 1 root root 0 Apr 22 21:21 file6
-rw-r--r--. 1 root root 0 Apr 22 21:21 file7
-rw-r--r--. 1 root root 0 Apr 22 21:21 file8
-rw-r--r--. 1 root root 0 Apr 22 21:21 file9
[root@desktop5 mnt]# chmod 600 /root/diskpass
[root@desktop5 mnt]# cryptsetup luksAddKey /dev/vdb1 /root/diskpass
Enter any passphrase: 
[root@desktop5 mnt]# vim /etc/crypttab 
[root@desktop5 mnt]# vim /etc/fstab 
[root@desktop5 mnt]# cat /etc/crypttab 
westos /dev/vdb1 /root/diskpass
[root@desktop5 mnt]# cat /etc/fstab 


#
# /etc/fstab
# Created by anaconda on Wed May  7 01:22:57 2014
#
# Accessible filesystems, by reference, are maintained under '/dev/disk'
# See man pages fstab(5), findfs(8), mount(8) and/or blkid(8) for more info
#
UUID=9bf6b9f7-92ad-441b-848e-0257cbb883d1 /                       xfs     defaults        1 1
/dev/mapper/westos /mnt xfs defaults 0 0