Understanding the steps needed to create and mount an encrypted filesystem is valuable, in order to keep data secure. In this hands-on lab, we will work with filesystem utilities to create a partition, encrypt it, and format it to make it available for mounting as an encrypted filesystem. At the conclusion, we will verify that the encrypted filesystem is ready for daily use by decrypting it, mounting it, using it, unmounting it, and then encrypting it again.
Learning Objectives
Successfully complete this lab by achieving the following learning objectives:
- Install cryptsetup Software Package
Use
yumto install the cryptsetup package:sudo -i yum -y install cryptsetup- Create a Partition Using All Space on the /dev/xvdg Device
Use
fdiskto create a new default partition:fdisk /dev/nvme1n1Press n and use all the defaults to create a new partition:
Command (m for help): n Partition Type: p Partition number (1-4, default 1): Press Enter to accept the default First sector: Press Enter to accept the default Last sector: Press Enter to accept the defaultPress w to write the changes to the partition table and exit:
Command (m for help): w- Use cryptsetup luksFormat to Format the Partition to be Encrypted
Format the
/dev/nvme1n1p1partition to be encrypted with the passphrase TALK3nkrpTED:cryptsetup -y luksFormat /dev/nvme1n1p1- Open the Encrypted Device, Create an ext4 Filesystem, Close the Encrypted Device, and then Create the /mnt/keys Directory
Use
cryptsetup luksOpento decrypt the device and view its symlink in the/dev/mapperdirectory with thelscommand. Usemkfsto create an ext4 filesystem, andmkdirto create the/mnt/keysdirectory:cryptsetup luksOpen /dev/nvme1n1p1 cryptvolUse the passphrase TALK3nkrpTED:
ls -l /dev/mapper mkfs -t ext4 /dev/mapper/cryptvol cryptsetup luksClose cryptvol mkdir /mnt/keys/- Demonstrate the Daily Use of the Encrypted Partition by Opening, Mounting, Accessing, Unmounting, and Closing It
For daily use, run
cryptsetup(usingluksOpen) to decrypt the partition andluksCloseto encrypt it. When the partition is decrypted, it can be mounted, and it should be unmounted before it is closed or encrypted. Usetouchto create an/mnt/keys/accessfile, andlsto display it:cryptsetup luksOpen /dev/nvme1n1p1 cryptvolUse the passphrase TALK3nkrpTED, then:
mount /dev/mapper/cryptvol /mnt/keys touch /mnt/keys/access ls -l /mnt/keys/ umount /mnt/keys cryptsetup luksClose cryptvol
