15 managing disk - understanding encrypted LUKS partitions / dmsetup status / swapon -s

By OK -


1. on device level you use fdisk to create a partition
2. once you created a partition, you use cryptsetup luksFormat\ to create encryption layer
3. after creation of encryption layer, you need to open a device cryptsetup luksOpen\ 
3.1. it creates a devices /dev/mapper/secret and brings to luks level
4. mkfs should be done on /dev/mapper/secretedevicename instead of on /dev/sdb1
5. mount /dev/mapper/secret and put your files there

 check if there are any encrypted LUKS partitions

 [root@svn ~]# blkid
/dev/sda1: UUID="6e3708b2-09ea-43f3-b0f0-9b43a157b3b1" TYPE="xfs" 
/dev/sda2: UUID="98h644-2gqM-2SsL-q0lA-qUEE-Ivz8-TUZULc" TYPE="LVM2_member" 
/dev/sdb1: LABEL="myfs" UUID="05dbcff3-e639-40cb-bbe7-0da595186f1a" TYPE="xfs" 
/dev/sr0: UUID="2016-12-05-13-52-39-00" LABEL="CentOS 7 x86_64" TYPE="iso9660" PTTYPE="dos" 
/dev/mapper/cl-root: UUID="da05cdf9-1418-4e5a-80d7-7757ab1b9a9d" TYPE="xfs" 
/dev/mapper/cl-swap: UUID="8ac067b9-d1e7-4180-9a2f-2a3a929362f4" TYPE="swap" 
[root@svn ~]# dmsetup status
cl-swap: 0 4194304 linear 
cl-root: 0 35643392 linear 
--------------
ubuntu-home: 0 195305472 linear 
ubuntu-swap_1: 0 8364032 linear 
sda5_crypt: 0 624637944 crypt 
ubuntu-root: 0 48824320 linear
The line marked "crypt" shows that sda5 has been encrypted. You can see which filesystems are on that via the lvm tools.
#check real device name of swap
[root@svn ~]# swapon -s
Filename Type Size Used Priority
/dev/dm-1                               partition 2097148 3124 -1
[root@svn ~]# 

If the partition is not encrypted, and assuming that you are NOT trying to encrypt the / partition, you have to:
  • Make a backup of the data on that partition
  • Initialize the partition as encrypted
    $ cryptsetup luksFormat /dev/sdb1
BEWARE: this command will wipe all the contents of the partition!!! It will ask you for a passphrase to open the volume; now if you try to run blkid, the output should be TYPE="crypto_LUKS"
  • Open the encrypted partition to use it
    $ cryptsetup luksOpen /dev/sdb1 secret
where "secret" is the name of the volume we are opening
  • Format the new "secret" volume
    $ mkfs.ext4 /dev/mapper/secret
  • Mount it providing the passphrase created before
    $ mount /dev/mapper/secret /whereyouwant
    Now you should be able to use the encrypted partition!
Optionally, if you want to mount it at reboot, you should edit /etc/crypttab and insert a line similar to this (it will request the password at boot):
secret /dev/sdb1 none
Where secret is the name of the volume we created before.
Or something like this, if you want to put your password in some plain text file:
secret /dev/sdb1 /whereyouwant-sdb1-luks-pwdfile
Just keep in mind for this, you also have to add the key:
$ cryptsetup luksAddKey /dev/sdb1 /whereyouwant-sdb1-luks-pwdfile
And edit the /etc/fstab and insert a line similar to this:
/dev/mapper/secret /whereyouwant ext4 defaults 1 2

Comments

Post a Comment

Popular posts from this blog

HAproxy logging

By OK -
ubuntu@ubuntu:/etc/haproxy$ cat /etc/rsyslog.d/haproxy.conf # Create an additional socket in haproxy's chroot in order to allow logging via # /dev/log to chroot'ed HAProxy processes $ModLoad imudp $UDPServerRun 514 local0.* -/var/log/haproxy-0.log local1.* -/var/log/haproxy-1.log ### keep logs in localhost ## $AddUnixListenSocket /var/lib/haproxy/dev/log ------------------- ubuntu@ubuntu:/etc/haproxy$ cat /etc/haproxy/haproxy.cfg global chroot /var/lib/haproxy user haproxy group haproxy log 127.0.0.1   local0         log 127.0.0.1   local1 notice daemon frontend www     bind 192.168.40.128:8282    # haproxy public IP     default_backend as-backend    # backend used backend as-backend    balance leastconn    mode http  server as1 192.168.40.128:8082 check    # application srv 1 defaults log global mode http option httplog option dontlognull         contimeout 5000    
Read more

tomcat catalina coyote jasper cluster

By OK -
Tomcat Component are Catalina Coyote Jasper Cluster Catalina :  Catalina is the name of the servlet container of Apache Tomcat since version 4.x. Tomcat implements Sun Microsystems' specifications for servlet and JavaServer Pages (JSP), which are important Java-based Web technologies. Tomcat's servlet container was redesigned as Catalina in Tomcat version 4.x. other components of the Tomcat engine are: Tomcat Jasper which converts the code portions within JavaServer Pages into servlets and pass them to Catalina to process. Tomcat Coyote which is an HTTP connector based on HTTP/1.1 specifications that receives and transmits web requests to the Tomcat engine by listening to a TCP/IP port and returns requests back to the requesting client. Coyote :  The Coyote JK Connector element represents a Connector component that communicates with a web connector via the JK protocol (also known as the AJP protocol). This is used for cases where you wish to invisibly integr
Read more

NFS mount add in fstab _netdev instead of default | firewall-cmd --list-all

By OK -
Redhat recommends us to add  _netdev  option for NFS file system in /etc/fstab. So that they can be mounted after starting the networking service. Alternative ways to refer to partitions: Label : LABEL=label Network ID Samba : //server/share NFS : server:/share SSHFS : sshfs#user@server:/share Device : /dev/sdxy (not recommended) Example #1 //192.168.1.134/share_name /mnt/share_name cifs username=server_user,password=server_password,_netdev 0 0 ^ Path to your share ^ Mountpoint ^ Username ^ Password ^ See note A Note A: The  _netdev  options makes sure the mount is only attempted AFTER a network connection has been established. Example #2 10.10.10.1:/vol1/fs1 /data nfs defaults,_netdev 0 0 ============================ [root@localhost ~]# firewall-cmd --list-all public   target: default   icmp-block-inversion: no   interfaces:   sources:   services: dhcpv6-client high-availability ssh   ports:   protocols:   masquera
Read more