磁盘加密

2013年3月11日 星期一 晴

磁盘加密

一、创建磁盘

[root@desktop7 ~]# fdisk /dev/sda

The number of cylinders for this disk is set to 60801.

There is nothing wrong with that, but this is larger than 1024,

and could in certain setups cause problems with:

1) software that runs at boot time (e.g., old versions of LILO)

2) booting and partitioning software from other OSs

   (e.g., DOS FDISK, OS/2 FDISK)

Command (m for help): n

First cylinder (12788-60801, default 12788):

Using default value 12788

Last cylinder or +size or +sizeM or +sizeK (12788-60801, default 60801): +100M

Command (m for help): p

Disk /dev/sda: 500.1 GB, 500107862016 bytes

255 heads, 63 sectors/track, 60801 cylinders

Units = cylinders of 16065 * 512 = 8225280 bytes

   Device Boot      Start         End      Blocks   Id  System

/dev/sda1   *           1          13      104391   83  Linux

/dev/sda2              14        6387    51199155   8e  Linux LVM

/dev/sda3            6388       12761    51199155   8e  Linux LVM

/dev/sda4           12762       60801   385881300    5  Extended

/dev/sda5           12762       12774      104391   83  Linux

/dev/sda6           12775       12787      104391   83  Linux

/dev/sda7           12788       12800      104391   83  Linux

Command (m for help): w

The partition table has been altered!

Calling ioctl() to re-read partition table.

WARNING: Re-reading the partition table failed with error 16: Device or resource busy.

The kernel still uses the old table.

The new table will be used at the next reboot.

Syncing disks.

[root@desktop7 ~]# partprobe /dev/sda

二、为磁盘加密

[root@desktop7 ~]# cryptsetup luksFormat /dev/sda7

WARNING!

========

This will overwrite data on /dev/sda7 irrevocably.

Are you sure? (Type uppercase yes): YES

Enter LUKS passphrase:

Verify passphrase:

Command successful.

三、进入磁盘

[root@desktop7 ~]# cryptsetup luksOpen /dev/sda7 secret

Enter LUKS passphrase for /dev/sda7:

key slot 0 unlocked.

Command successful.

[root@desktop7 ~]#

四、格式化

[root@desktop7 ~]# mkfs -t ext3 /dev/mapper/secret

mke2fs 1.39 (29-May-2006)

Filesystem label=

OS type: Linux

Block size=1024 (log=0)

Fragment size=1024 (log=0)

26000 inodes, 103872 blocks

5193 blocks (5.00%) reserved for the super user

First data block=1

Maximum filesystem blocks=67371008

13 block groups

8192 blocks per group, 8192 fragments per group

2000 inodes per group

Superblock backups stored on blocks:

        8193, 24577, 40961, 57345, 73729

Writing inode tables: done                            

Creating journal (4096 blocks): done

Writing superblocks and filesystem accounting information: done

This filesystem will be automatically checked every 32 mounts or

180 days, whichever comes first.  Use tune2fs -c or -i to override.

[root@desktop7 ~]#

五、挂载

[root@desktop7 ~]# mount /dev/mapper/secret /mnt

验证

[root@desktop7 ~]# mount

/dev/mapper/Vol0-vol_root on / type ext3 (rw)

proc on /proc type proc (rw)

sysfs on /sys type sysfs (rw)

devpts on /dev/pts type devpts (rw,gid=5,mode=620)

/dev/sda1 on /boot type ext3 (rw)

tmpfs on /dev/shm type tmpfs (rw)

none on /proc/sys/fs/binfmt_misc type binfmt_misc (rw)

sunrpc on /var/lib/nfs/rpc_pipefs type rpc_pipefs (rw)

/dev/sdb on /media/disk type vfat (rw,nosuid,nodev,shortname=winnt,uid=0)

/dev/mapper/secret on /mnt type ext3 (rw)

[root@desktop7 ~]#

六、使用磁盘

1、编辑一个文件

[root@desktop7 ~]# vim ceshi

[root@desktop7 ~]#

2、复制文件

（1）错误做法（不能对加密磁盘进行操作）

 

[root@desktop7 ~]# cp ceshi /dev/mapper/secret

cp: overwrite `/dev/mapper/secret'? y

（2）正确做法（对挂载到的盘符进行操作）

[root@desktop7 ~]# cp ceshi /chenglong

[root@desktop7 ~]# cat /chenglong/ceshi

[root@instructor ~]# echo "hello the world" | awk '{print $1}'

hello

[root@instructor ~]# echo "hello the world" | awk '{print $1,$2}'

hello the

[root@instructor ~]# echo "hello the world" | awk '{print $1,$2,$3}'

hello the world

[root@instructor ~]# echo "hello the world" | awk '{print $0}'

hello the world

[root@desktop7 ~]#

3、其他操作

七、卸载磁盘

[root@desktop7 mapper]# umount /dev/mapper/secret

[root@desktop7 mapper]# mount

/dev/mapper/Vol0-vol_root on / type ext3 (rw)

proc on /proc type proc (rw)

sysfs on /sys type sysfs (rw)

devpts on /dev/pts type devpts (rw,gid=5,mode=620)

/dev/sda1 on /boot type ext3 (rw)

tmpfs on /dev/shm type tmpfs (rw)

none on /proc/sys/fs/binfmt_misc type binfmt_misc (rw)

sunrpc on /var/lib/nfs/rpc_pipefs type rpc_pipefs (rw)

/dev/sdb on /media/disk type vfat (rw,nosuid,nodev,shortname=winnt,uid=0)

[root@desktop7 mapper]#