Linux Foo - Manage LUKS key


I assume this is a bit of a dated set of procedures... as-in, there is probably a better way to deal with LUKS nowadays.  Also - at some point I will (hopefully) be writing a blog entry about LUKS key accessed from centralized key server.

Assessment
cryptsetup luksDump /dev/sda1
cryptsetup luksOpen --test-passphrase --key-slot 3 --key-file /root/.keyfile /dev/sda1

Setup

# If there is already a crypttab, update it... otherwise, create a new one
if [ -f /etc/crypttab ]
then 
  sed -i -e '1i# <target name>    <source device>        <key file>    <options>' /etc/crypttab
else
  echo "# <target name>    <source device>        <key file>    <options> " > /etc/crypttab
fi

# Create a "key file" and add it to the device (interactive step)
dd if=/dev/urandom of=/root/.keyfile bs=32 count=1
chmod 0400 /root/.keyfile
cryptsetup luksFormat /dev/sdb
for DEV in `lsblk | grep -B1 luks | egrep 'lvm|part' | awk '{ print $1 }' | sed 's/├─//g' | sed 's/└─//g'`
do
  echo cryptsetup luksAddKey /dev/mapper/${DEV} /root/.keyfile
done

# If there is already entries in the cryptab file
sed -i -e 's/none/\/root\/.keyfile/g' /etc/crypttab
chmod 0744 /etc/crypttab
dracut --force --install /root/.keyfile /boot/initramfs-`uname -r`.img

echo "cryptsetup luksAddKey /dev/sdb1 /root/.keyfile"
echo "cryptsetup --key-file /root/.keyfile luksOpen /dev/sdb1 DATA"
echo "DATA UUID=c963bd90-a5bf-4616-b44e-24dc41af2fba /root/.keyfile luks" >> /etc/crypttab
mkdir /data
echo "/dev/mapper/DATA /data xfs rw,nosuid,nodev,relatime,nofail 1 2" >> /etc/fstab
mount -a

Comments

Post a Comment

Popular posts from this blog

Apple OSX Catalina and VMware vCenter Server Appliance.. ugh

OSX Catalina came with some rather annoying challenges: dropped support for 32-bit apps.  I don't play Steam games that much on my Mac now that I am stuck at home all the time.  So, not a big deal. implemented a bunch of "gatekeeper" security measures.  Now, typically I would say:  if you need to circumvent security ("Disable SELinux" - for example), you're probably doing it wrong.  But, the case of all the hand-holdy, lockdown stuff, it's pretty annoying.  Several things you cannot simply "accept the risk" and move on, you get constant reminders.  And it is interesting that whenever Microsoft does this sort of thing, it's widely discussed they are vilified.  Somehow, when Apple does this.. meh, just the cost of doing business. The challenges, themselves, are not the point of this post.  The point is you need to do some stuff if you expect to use Mac OSX Catalina to deploy VMware vSphere 6.7 U3 - vCenter Server Appliance. Download the ISO (...
Read more

HomeLab - Sophos XG SSL VPN and Comcast

Ugh... Comcast.  This sucked particularly much as this was my first attempt to configure a VPN back to my HomeLab and therefore was not sure what options I should have *known* would work.  Anywho... Sophos SSL VPN uses 8443 by default.  I spent a few hours trying to get through the config on the Sophos and my Linux client.  Nothing was working. For giggles I changed the Sophos to use 443, and then updated my client on my Linux workstation.  And suddenly it all works.  Fowk.  Tried 8443 again.  No love. I don't want to utilize port 443 as I intend to actually host some web apps for testing.  So, I have finalized on an "alternate" port which had to be configured on both the Sophos and the Linux client. I'l be doing a better write-up about this later.  I still need to figure out how to configure all this via the Gnome Network-Manager GUI.
Read more

Software RAID via kickstart (not cloud, sorry)

A bunch of the following specifics are out of scope, but I am including them anyhow # System bootloader configuration bootloader --location=mbr --boot-drive=sda --append=" crashkernel=auto hpsa.hpsa_allow_any=1 hpsa.hpsa_simple_mode=1 console=tty0 console=ttyS0,9600n8" # Partition clearing information #ignoredisk --only-use=sda zerombr clearpart --all --initlabel --drives=sda,sdb,sdc # Disk partitioning information part /boot/efi --fstype="efi" --fsoptions="umask=0077,shortname=winnt" --ondisk=sda --size=256 part /boot --fstype="xfs" --ondisk=sda --size=1024 part pv.01 --fstype="lvmpv" --ondisk=sda --size=51200 --grow volgroup vg_rhel7 --pesize=4096 pv.01 logvol /              --fstype="xfs"  --size=10240 --name=root     --vgname=vg_rhel7 logvol /home          --fstype="xfs"  --size=1024  --name=home     --vgname=vg_rhel7 logvol /tmp           --fstyp...
Read more