Hey guys and welcome back, so at the end of this skill what I just want to do is to pivot
subjects and make a brief point on the concept of encryption.
Since this is something that the LPIC 2 examination requires that we have a fairly basic understanding
of, so what that means is that we don't have to concern ourselves too much with having
to configure and set up an encrypted file system, but we do have to be aware of the
concepts and why we would want to use an encrypted file system to begin with.
Now you imagine you happen to have your laptop and because it is a laptop you like to travel
with it and let's say you leave it on the train and then suddenly you realise that you
have left your laptop, but even more problematic than the worrying thought that you may have
lost some expensive device, is the realisation that anyone who happens to grab your computer
who may have found it, they could potentially go in and read all your data.
This can be a quite worrying thought, especially if this happens to be a laptop that you have
for work and it has a whole bunch of super sensitive and supposedly super secret documents
on it.
They think, well hey they don't actually know the password to log into my account, but what
the attacker could do is they could side load a live system, which would be a live running
operating system via a USB stick or via a CD-ROM, or they could just pull out the hard
drive entirely and ultimately they could conduct forensics if they had the know-how.
So this little basic password that you have as your Windows splash screen or your MacBook
splash screen, whatever it may be, that really isn't going to protect the data that much
at all.
So the reality is you want your data to be unreadable to anyone that isn't you effectively.
In other words, what you want is when your laptop is switched off, you want all that
data to be completely protected and unreadable so that even if someone happened to use forensic
tools all they could see was this scrambled and indecipherable data.
So this is what we're talking about when we're talking about encryption.
Now we actually can encrypt files on a file by file basis.
That means if you happen to get a very sensitive file you can encrypt that file and store it
on your system.
But as you can imagine, if you work for an enterprise whereby you're dealing with lots
of sensitive data, maybe every piece of data should be protected.
Obviously it would be pretty tedious to have to go through the process of encrypting each
file one by one by one by one.
And as new files come in, continually repeat that process.
Instead, it would be much more advantageous to encrypt the entire file system itself.
What this would mean therefore is that when the system is switched off, it would be fully
encrypted.
When you turn that system on, you would be prompted for some type of decryption phrase.
And that would mean that the data would decrypt itself and become available to you.
The cool thing about that is that it would mean that all the data on the device would
be protected if you happen to download a file from your email on your encrypted file system.
Whilst it would be readable to you as the computer was on, once you shut down that computer,
that downloaded file, just like the rest of the files on the file system, will be protected
by encryption and unreadable.
So if in the event you lost your laptop or someone happened to access your computer in
your office unknowingly, unless they had the decryption passphrase, they would not be
able to access that data.
So clearly in the world of modern computing, when security is absolutely at the forefront,
encryption is one of those technologies that we do want to be aware of and certainly employing
when we can.
Now, one thing we do want to be aware of is LUX.
This is the Linux Unified Key Setup.
And what this is, is ultimately a specification for encryption, meaning that it describes
how systems should be encrypted on Linux.
It doesn't actually give you the software to do such a thing.
So clearly you will have to find a particular tool that can encrypt your system that adheres
to the LUX specification.
And one of those tools that we want to be aware of is something called DMCrypt.
Now what DMCrypt is, is ultimately a module.
And it's a module that is going to be used by the kernel so that when you happen to invoke
encryption, the kernel is going to be able to interact and utilise the encrypted file
system.
Now, with respect to DMCrypt, we have the ability to encrypt the entire disk.
This would be known as full disk encryption.
Like I say, this can encrypt absolutely everything so that no matter what you do on your computer,
it's always going to be protected.
Or you could choose to encrypt particular partitions.
Or if you so wish, you could choose to encrypt removable media.
So let's say you had a USB thumb drive with some sensitive information on it.
You could use DMCrypt to encrypt that drive.
Similarly, DMCrypt can also be used to encrypt software RAID volumes, which relates to what
we talked about in the previous skill.
Now, even though the examination does not require us to actually be able to configure
such a setup, we do want to be aware of that the DMCrypt utility has a command called
CryptSetup.
And this command here is the command that you could use to ultimately create and mount
an encrypted file system using DMCrypt.
So really, like I say, for the purposes of the examination, we just want to have a high-level
understanding of what encryption is and understand the benefits of not just being able to encrypt
on a file-by-file basis, but being able to encrypt an entire file system or an entire
disk.
We want to be aware of the LUX specification and the DMCrypt kernel module, which will
allow us to create and configure a Linux-based encrypted file system.
And like I said, the way we can do that with the DMCrypt utility is via the CryptSetup
command.
And those are the core components that we want to understand for the purposes of the
L-Pick 2 objective on encryption.
So I hope this has been informative for you and I'd like to thank you for viewing.