Disk encryption LUKS in Linux

LUKS (Linux Unified Key Setup) provides a standard for Linux hard disk partition encryption. It not only applies to different Linux Release versions, but also supports multiple users/passwords. Because its encryption key is independent of the password, if the password is lost, we can quickly change the password without re-encrypting the entire hard disk. By providing a standard disk format, it not only facilitates the compatibility between distributions, but also provides security management for multiple user passwords. You must decrypt the encrypted volume before mounting the file system.

Tool: cryptsetup (installed by default)

Common parameters: luksFormat, luksOpen, luksClose, and luksAddKey

After the partition is encrypted using cryptsetup, the partition is no longer allowed to be directly mounted. LUKS is also an encryption scheme based on device mapper mechanism. To use this partition, you must map it to the/dev/mapper directory. We can only mount this ing for use. However, during the ing, you need to enter the decryption password.

Note: To unencrypt the data, you need to back up the files in the partition and format the LUKS partition again.

Encryption features of the Crypsetup tool:

Ø cannot be directly mounted after Encryption

Do not worry about data theft if the encrypted hard disk is lost

Ø after encryption, you must map the data to be mounted.

Format LUKS partitions
[Root @ rhel6 ~] # Cryptsetup luksFormat/dev/vda8 // convert the partition into LUKS format)
WARNING!
==========
This will overwrite data on/dev/vda8 irrevocably.

Are you sure? (Type uppercase yes): YES // The value in uppercase is YES.
Enter LUKS passphrase: // Enter the password twice
Verify passphrase:

Ing Partition
[Root @ rhel6 ~] # Cryptsetup luksOpen/dev/vda8 luks_test // open the LUKS partition and generate a luks_test file in the/dev/mapper/directory.
Enter passphrase for/dev/vda8: // you must Enter the luks password to open the LUKS partition.

Format, mount, and use partitions
[Root @ rhel6 ~] # Mkfs. ext4/dev/mapper/luks_test
[Root @ rhel6 ~] # Mount/dev/mapper/luks_test/luks/

Close the ing. Uninstall the ing first and then disable it.
[Root @ rhel6 ~] # Umount/luks/
[Root @ rhel6 ~] # Cryptsetup luksClose luks_test // disable the LUKS Partition
[Root @ rhel6 ~] # Mount/dev/vda8/luks // The/dev/vda8 partition cannot be mounted directly
Mount: unknown filesystem type 'crypto _ luk'

Automatically mount LUKS partitions at startup:
[Root @ rhel6 ~] # Dd if =/dev/urandom of = keyfile bs = 1 k count = 4
4 + 0 records in
4 + 0 records out
4096 bytes (4.1 kB) copied, 0.00206882 s, 2.0 MB/s
[Root @ rhel6 ~] # Cryptsetup luksAddKey/dev/vda8 keyfile
Enter any passphrase:
[Root @ rhel6 ~] # Vi/etc/crypttab
Name/dev/vda8/root/keyfile luks
[Root @ rhel6 ~] # Vi/etc/fstab
/Dev/mapper/name/luks ext4 _ netdev 0 0

Add/Remove/modify LUKS Password
[Root @ rhel6 ~] # Cryptsetup luksAddKey/dev/vda8
Enter any passphrase:
Enter new passphrase for key slot:
Verify passphrase:
[Root @ rhel6 ~] # Cryptsetup luksRemoveKey/dev/vda8
Enter LUKS passphrase to be deleted:
[Root @ rhel6 ~] # Cryptsetup luksAddKey/dev/vda8 keyfile
Enter any passphrase: