磁盤加密

2013年3月11日 星期一 晴

磁盤加密

一、建立磁盤

[root@desktop7 ~]# fdisk /dev/sda

The number of cylinders for this disk is set to 60801.

There is nothing wrong with that, but this is larger than 1024,

and could in certain setups cause problems with:

1) software that runs at boot time (e.g., old versions of LILO)

2) booting and partitioning software from other OSs

   (e.g., DOS FDISK, OS/2 FDISK)

Command (m for help): n

First cylinder (12788-60801, default 12788):

Using default value 12788

Last cylinder or +size or +sizeM or +sizeK (12788-60801, default 60801): +100M

Command (m for help): p

Disk /dev/sda: 500.1 GB, 500107862016 bytes

255 heads, 63 sectors/track, 60801 cylinders

Units = cylinders of 16065 * 512 = 8225280 bytes

   Device Boot      Start         End      Blocks   Id  System

/dev/sda1   *           1          13      104391   83  Linux

/dev/sda2              14        6387    51199155   8e  Linux LVM

/dev/sda3            6388       12761    51199155   8e  Linux LVM

/dev/sda4           12762       60801   385881300    5  Extended

/dev/sda5           12762       12774      104391   83  Linux

/dev/sda6           12775       12787      104391   83  Linux

/dev/sda7           12788       12800      104391   83  Linux

Command (m for help): w

The partition table has been altered!

Calling ioctl() to re-read partition table.

WARNING: Re-reading the partition table failed with error 16: Device or resource busy.

The kernel still uses the old table.

The new table will be used at the next reboot.

Syncing disks.

[root@desktop7 ~]# partprobe /dev/sda

二、為磁盤加密

[root@desktop7 ~]# cryptsetup luksFormat /dev/sda7

WARNING!

========

This will overwrite data on /dev/sda7 irrevocably.

Are you sure? (Type uppercase yes): YES

Enter LUKS passphrase:

Verify passphrase:

Command successful.

三、進入磁盤

[root@desktop7 ~]# cryptsetup luksOpen /dev/sda7 secret

Enter LUKS passphrase for /dev/sda7:

key slot 0 unlocked.

[root@desktop7 ~]#

四、格式化

[root@desktop7 ~]# mkfs -t ext3 /dev/mapper/secret

mke2fs 1.39 (29-May-2006)

Filesystem label=

OS type: Linux

Block size=1024 (log=0)

Fragment size=1024 (log=0)

26000 inodes, 103872 blocks

5193 blocks (5.00%) reserved for the super user

First data block=1

Maximum filesystem blocks=67371008

13 block groups

8192 blocks per group, 8192 fragments per group

2000 inodes per group

Superblock backups stored on blocks:

        8193, 24577, 40961, 57345, 73729

Writing inode tables: done                            

Creating journal (4096 blocks): done

Writing superblocks and filesystem accounting information: done

This filesystem will be automatically checked every 32 mounts or

180 days, whichever comes first.  Use tune2fs -c or -i to override.

五、挂載

[root@desktop7 ~]# mount /dev/mapper/secret /mnt

驗證

[root@desktop7 ~]# mount

/dev/mapper/Vol0-vol_root on / type ext3 (rw)

proc on /proc type proc (rw)

sysfs on /sys type sysfs (rw)

devpts on /dev/pts type devpts (rw,gid=5,mode=620)

/dev/sda1 on /boot type ext3 (rw)

tmpfs on /dev/shm type tmpfs (rw)

none on /proc/sys/fs/binfmt_misc type binfmt_misc (rw)

sunrpc on /var/lib/nfs/rpc_pipefs type rpc_pipefs (rw)

/dev/sdb on /media/disk type vfat (rw,nosuid,nodev,shortname=winnt,uid=0)

/dev/mapper/secret on /mnt type ext3 (rw)

六、使用磁盤

1、編輯一個檔案

[root@desktop7 ~]# vim ceshi

2、複制檔案

（1）錯誤做法（不能對加密磁盤進行操作）

[root@desktop7 ~]# cp ceshi /dev/mapper/secret

cp: overwrite `/dev/mapper/secret'? y

（2）正确做法（對挂載到的盤符進行操作）

[root@desktop7 ~]# cp ceshi /chenglong

[root@desktop7 ~]# cat /chenglong/ceshi

[root@instructor ~]# echo "hello the world" | awk '{print $1}'

hello

[root@instructor ~]# echo "hello the world" | awk '{print $1,$2}'

hello the

[root@instructor ~]# echo "hello the world" | awk '{print $1,$2,$3}'

hello the world

[root@instructor ~]# echo "hello the world" | awk '{print $0}'

3、其他操作

七、解除安裝磁盤

[root@desktop7 mapper]# umount /dev/mapper/secret

[root@desktop7 mapper]# mount