linux 磁盘加密保护

一：制作加密磁盘分区

1：分区

[root@ftp-server ~]# fdisk /dev/vdb
Welcome to fdisk (util-linux 2.23.2).

Changes will remain in memory only, until you decide to write them.
Be careful before using the write command.

Command (m for help): n
Partition type:
p   primary (1 primary, 0 extended, 3 free)
e   extended
Select (default p):
Using default response p
Partition number (2-4, default 2):
First sector (4196352-20971519, default 4196352):
Using default value 4196352
Last sector, +sectors or +size{K,M,G} (4196352-20971519, default 20971519): +200M
Partition 2 of type Linux and of size 200 MiB is set

Command (m for help): p

Disk /dev/vdb: 10.7 GB, 10737418240 bytes, 20971520 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk label type: dos
Disk identifier: 0x000ccf0e

Device Boot      Start         End      Blocks   Id  System
/dev/vdb1            2048     4196351     2097152   82  Linux swap / Solaris
/dev/vdb2         4196352     4605951      204800   83  Linux

Command (m for help): wq

同步分区表

[root@ftp-server ~]# partprobe
[root@ftp-server ~]# cat /proc/partitions
major minor  #blocks  name

253        0   10485760 vda
253        1   10484142 vda1
253       16   10485760 vdb
253       17    2097152 vdb1
253       18     204800 vdb2

2：磁盘加密

[root@ftp-server mapper]# cryptsetup luksFormat /dev/vdb2

WARNING!
========
This will overwrite data on /dev/vdb2 irrevocably.

Are you sure? (Type uppercase yes): YES     ##注：此处必须是大写YES
Enter passphrase:
Verify passphrase:

3：映射磁盘

[root@ftp-server mapper]# cryptsetup open /dev/vdb2 hahaha
Enter passphrase for /dev/vdb2:

4：查看映射：/etc/mapper/

[root@ftp-server mapper]# ls
control  hahaha              ##出现刚刚的映射设备hahaha

5：格式化映射

[root@ftp-server mapper]# mkfs.xfs /dev/mapper/hahaha
meta-data=hahaha                 isize=256    agcount=4, agsize=12672 blks
=                       sectsz=512   attr=2, projid32bit=1
=                       crc=0
data     =                       bsize=4096   blocks=50688, imaxpct=25
=                       sunit=0      swidth=0 blks
naming   =version 2              bsize=4096   ascii-ci=0 ftype=0
log      =internal log           bsize=4096   blocks=853, version=2
=                       sectsz=512   sunit=0 blks, lazy-count=1
realtime =none                   extsz=4096   blocks=0, rtextents=0

6：挂载

[root@ftp-server mapper]# mount /dev/mapper/hahaha /mnt/

二：卸载

[root@ftp-server mapper]# umount /mnt        ##一定要卸载
[root@ftp-server mapper]# cryptsetup close hahaha  ##关闭映射设备
[root@ftp-server mapper]# ls              ##查看/etc/mapper/映射设备消失
control

三：自动挂载加密设备
由于加密设备在打开时需要密码，所以不可能直接单纯的挂载
1:设置开机加密

[root@ftp-server mapper]# vim /etc/crypttab
解密后名称    设备           密码文件
test    /dev/vdb2       /root/passwd       ##注：此处的名字任意，但必须与
你映射设备的名字的相同

2：开机自动挂载

[root@ftp-server mapper]# vim /etc/fstab

/dev/mapper/test        /mnt    xfs     defaults        0       0
注：此处的名字是映射设备的名字

3：制作设备密码文件

[root@ftp-server mapper]# vim /root/passwd     #里面写入当前加密设备的密码

4：把密码记录文件与设备关联

[root@ftp-server mapper]# cryptsetup luksAddKey /dev/vdb2  /root/passwd
Enter any passphrase:        ##加密设备密码