[置顶] RH413企业安全加固 第4章 创建文件系统(加密解密)
第4章 创建文件系统(加密解密)
LUKS(是文件系统的一种加密方式)
可以对文件系统分区进行加密，它是针对单个数据块进行加密(超级块的信息)
1、创建分区
Disk /dev/sdb: 16.1 GB, 16106127360 bytes
255 heads, 63 sectors/track, 1958 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x9bc2b239
Device Boot Start End Blocks Id System
/dev/sdb1 1 1958 15727603+ 5 Extended
Command (m for help): n
Command action
l logical (5 or over)
p primary partition (1-4)
l
First cylinder (1-1958, default 1): 1
Last cylinder, +cylinders or +size{K,M,G} (1-1958, default 1958): +1G
Command (m for help): P
Disk /dev/sdb: 16.1 GB, 16106127360 bytes
255 heads, 63 sectors/track, 1958 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x9bc2b239
Device Boot Start End Blocks Id System
/dev/sdb1 1 1958 15727603+ 5 Extended
/dev/sdb5 1 132 1060227 83 Linux
Command (m for help): W
The partition table has been altered!
Calling ioctl() to re-read partition table.
Syncing disks.
2、使用cryptsetup luksFormat加密分区
[root@student ~]# cryptsetup luksFormat /dev/sdb5
WARNING!
========
This will overwrite data on /dev/sdb5 irrevocably.
Are you sure? (Type uppercase yes): YES ---这里设置必须大写
Enter LUKS passphrase: ---输入加密分区密码
Verify passphrase: ---在次输入加密分区密码
3、使用cryptsetup luksOpen 解密分区
[root@student ~]# cryptsetup luksOpen /dev/sdb5 sdd5 ---sdd5 代表盘符设备
Enter passphrase for /dev/sdb5: ---输入加密的密码
4、查看对应的设备
[root@student ~]# ll /dev/mapper/sdd5
lrwxrwxrwx. 1 root root 7 Jan 17 08:13 /dev/mapper/sdd5 -> ../dm-0
5、格式化挂载加密的设备
[root@student ~]# mkfs.ext4 /dev/mapper/sdd5
mke2fs 1.41.12 (17-May-2010)
Filesystem label=
OS type: Linux
Block size=4096 (log=2)
Fragment size=4096 (log=2)
Stride=0 blocks, Stripe width=0 blocks
66240 inodes, 264544 blocks
13227 blocks (5.00%) reserved for the super user
First data block=0
Maximum filesystem blocks=272629760
9 block groups
32768 blocks per group, 32768 fragments per group
7360 inodes per group
Superblock backups stored on blocks:
32768, 98304, 163840, 229376
Writing inode tables: done
Creating journal (8192 blocks): done
Writing superblocks and filesystem accounting information: done
This filesystem will be automatically checked every 36 mounts or
180 days, whichever comes first. Use tune2fs -c or -i to override.
6、将加密设备写入到/etc/fstab文件下
# /etc/fstab
# Created by anaconda on Sat Jan 16 06:56:47 2016
#
# Accessible filesystems, by reference, are maintained under '/dev/disk'
# See man pages fstab(5), findfs(8), mount(8) and/or blkid(8) for more info
#
/dev/mapper/sdd5 /mnt ext4 defaults 0 0
加入以上加密设备挂载
7、使用加密密钥
1)使用dd命令产生一个随机数密钥(urandom安全性更高)
[root@student ~]# dd if=/dev/urandom of=/root/keys count=4096 bs=1
4096+0 records in
4096+0 records out
4096 bytes (4.1 kB) copied, 0.0541865 s, 75.6 kB/s
2)将生成的随机密钥更改权限
[root@student ~]# chmod 600 keys
3)使用cryptsetup luksAddKey命令添加加密文件
[root@student ~]# cryptsetup luksAddKey /dev/sdb5 /root/keys
Enter any passphrase:
4)编辑/etc/crypttab
[root@student ~]# vim /etc/crypttab
sdd5 /dev/sdb5 /root/keys
--sdd5是加密后的设备，sdb5是原始设备，keys是加密文件
(如果改为none的话开机会提示你输入密码)
5)使用losetup挂载img镜像
① 创建img镜像
[root@teachers ~]# dd if=/dev/zero of=/root/mydisk.img bs=1M count=250
250+0 records in
250+0 records out
262144000 bytes (262 MB) copied, 7.01153 s, 37.4 MB/s
② 使用losetup挂载回环设备
[root@teachers ~]# losetup /dev/loop0 /root/mydisk.img
[root@teachers ~]# losetup /dev/loop0 ---检测挂载的设备
/dev/loop0: [0803]:528651 (/root/mydisk.img)
③ 可以使用cryptsetup命令进行回环加密解密(重复第2节和第3节的命令)
④ 开机挂载将(第6节、第7节写入/etc/rc.local文件中)
⑤ 删除挂载回环设置
[root@teachers ~]# losetup -d /dev/loop0
[root@teachers ~]# losetup /dev/loop0
loop: can't get info on device /dev/loop0: No such device or address