LUKS or a Linux Unified Key Setups is a partition encrypted system. encrypted file system are extremely useful and ensure that your
data is stored on partition and on your removable drives is safe when its lost or stolen.
Setting up encrypted filesystem on RHEL6 system is a part of RHCSA exam and you may ask to setup a encrypted partition asking password
so we will demonstrate you how to setup encrypted partition that will prompt for password at system boot time.
Warning: Do not setup encryption on a partition that already has data on it as you will lose all ofÂ your data on that partition. If you want to encrypt a partition that has data on it so you must backup all of your data before you attempt encryption.
we have a separate hard drive and on it we created a new partition that has no data on it.
For encrypt this partition we run :
[[email protected] ~]# cryptsetup luksFormat /dev/sdb1 WARNING! ======== This will overwrite data on /dev/sdb1 irrevocably. Are you sure? (Type uppercase yes): YES Enter LUKS passphrase: Verify passphrase:
its warning screen that we will lose all of our data that has on this partition we know we are using a brand new partition that has no
data so we will continue on it and type YES
then we enter password for LUKS
Then we can open our new encrypted partition with the following command:
[[email protected] ~]# cryptsetup luksOpen /dev/sdb1 secret Enter passphrase for /dev/sdb1:
At last we use word secret (you can use your own) its a name for our partition after we open it.
we can check our encrypted paretition is opened by checking in /dev/mapper directory with the following command:
[[email protected] ~]# ls -l /dev/mapper | grep secret lrwxrwxrwx. 1 root root 7 Nov 21 00:32 secret -> ../dm-2
now we can create a filesystem in our new encrypted partition.
[[email protected] ~]# mkfs.ext4 /dev/mapper/secret mke2fs 1.41.12 (17-May-2010) Filesystem label= OS type: Linux Block size=4096 (log=2) Fragment size=4096 (log=2) Stride=0 blocks, Stripe width=0 blocks 131072 inodes, 523600 blocks 26180 blocks (5.00%) reserved for the super user First data block=0 Maximum filesystem blocks=536870912 16 block groups 32768 blocks per group, 32768 fragments per group 8192 inodes per group Superblock backups stored on blocks: 32768, 98304, 163840, 229376, 294912 Writing inode tables: done Creating journal (8192 blocks): done Writing superblocks and filesystem accounting information: done This filesystem will be automatically checked every 25 mounts or 180 days, whichever comes first. Use tune2fs -c or -i to override.
now lets create a new directory to mount our encrypted partition
[[email protected] ~]# mkdir /secret
next we will mount our encrypted partition on previously created directory
[[email protected] ~]# mount /dev/mapper/secret /secret
To verify our mount point we can use this command:
[[email protected] ~]# df -kh Filesystem Size Used Avail Use% Mounted on /dev/mapper/vg_server-lv_root 18G 6.7G 9.8G 41% / tmpfs 504M 328K 503M 1% /dev/shm /dev/sda1 485M 31M 429M 7% /boot /dev/mapper/secret 2.0G 35M 1.9G 2% /secret
We also need to edit /etc/fstab file and add an entry to automatically mount our partition at boot time.
[[email protected] ~]# vi /etc/fstab
/dev/sdb1 /secret ext4 default 0 0
in order to mount our encrypted partition at boot with password promted we need to edit /etc/crypttab file.
[[email protected] ~]# vi /etc/crypttab
add this line in /etc/crypttab file.
secret /dev/sdb1 none
first word is our encrypted partition name and then partition path at end word none mean ask password at boot time
now reboot your system you will ask password for open your encrypted partition at boot time.
When you enter password boot process should continue and you can verify your encrypted partition is open and mounted with following command :
[[email protected] ~]# df -kh Filesystem Size Used Avail Use% Mounted on /dev/mapper/vg_server-lv_root 18G 6.7G 9.8G 41% / tmpfs 504M 100K 504M 1% /dev/shm /dev/sda1 485M 31M 429M 7% /boot /dev/mapper/secret 2.0G 35M 1.9G 2% /secret