Disk encryption under Linux

Disk encryption under Linux

LUKS (Linux Unified Key Setup) provides a standard for Linux hard disk encryption, which is not only common to different Linux distributions, but also supports multi-user/password. Because its encryption key is independent of the password, if the password is compromised, we can quickly change the password without having to re-encrypt the hard drive. By providing a standard on-disk format, it not only facilitates the compatibility between distributions, but also provides security management for multiple user passwords. The encrypted volume must be decrypted before the file system can be mounted.

Tool: Cryptsetup (default already installed)

Common parameters: Luksformat, Luksopen, Luksclose, Luksaddkey

Once the partition has been encrypted with Cryptsetup, the partition is no longer allowed to mount directly. Luks is also an encryption scheme based on the device mapper mechanism. If you want to use this partition, you must map the partition to the/dev/mapper directory, and we can only mount the map to use it. However, when mapping, it is necessary to enter the decryption password.

Features of Crypsetup tool encryption:

cannot be mounted directly after encryption

Lose your hard drive after encryption and don't worry about data theft

Mapping must be done after encryption to mount

Steps:

1. Create partitions and encrypt partitions

2. Mapping partitions

3. Format the partition and mount the use

4. Turn off mapped partitions

Create a disk partition/DEV/SDB1, not formatted

1. Encrypted partition

# cryptsetup-v-y-c aes-cbc-plain luksformat/dev/sdb1 warning! ======== This would overwrite data on/dev/sdb1 irrevocably. Is you sure? (Type uppercase Yes): Yes--note this must be uppercase Yes Enter LUKS Passphrase: Verify Passphrase: Command successful. #

2. Mapping partitions

# Cryptsetup luksopen/dev/sdb1 sx_disk //Map SDB1 to Sx_disk Enter Passphrase FOR/DEV/SDB1: # ll-d/dev/mapper/sx_disk lrwxrwxrwx. 1 root root 7 June 03:24/dev/mapper/sx_disk. /dm-0 # Cryptsetup status/dev/mapper/sx_disk //view map partition status /dev/mapper//dev/mapper/sx_disk is active. Type:luks1 Cipher:aes-cbc-plain keysize:256 bits Device:/DEV/SDB1 offset:4096 Sectors size:16767701 Sectors Mode:read/write #

3, Mount use

# Mkdir/mnt/sx_disk # Mkfs.ext3/dev/mapper/sx_disk # mount/dev/sdb1/mnt/sx_disk/ //Direct mount is not possible Mount:unknown filesystem type ' Crypto_luks ' # mount/dev/mapper/sx_disk/mnt/sx_disk/ //Mount mapped device, Mount succeeded

4, close the mapping, first uninstall and then close

# umount/mnt/sx_disk/ # Cryptsetup luksclose sx_disk //Close map # ll/dev/mapper/ //mapping device is gone. Total dosage 0 CRW-RW----. 1 root root 10, 58 June 03:01 Control #

5. Set up auto mount on boot

Generate the key file, if you want to enter the password manually can not be generated

# TOUCH/ROOT/CRYPTPASSWD # Cryptsetup luksaddkey/dev/sdb1/root/cryptpasswd Enter any passphrase: # CAT/ROOT/CRYPTPASSWD //Direct view key is empty #

Set boot up

# Vim/etc/crypttab # Cat/etc/crypttab sx_disk/dev/sdb1/root/cryptpasswd Sx_disk for the mapping name,/DEV/SDB1 is the encryption device device,/ROOT/CRYPTPASSWD for the password file, if you want to power on manually enter the password, the password file space can be # Vim/etc/fstab # Tail-1/etc/fstab /dev/mapper/sx_disk/mnt/sx_disk EXT4 Defaults 0 0

Disk encryption under Linux