Hmmm, having some partitions gives me an idea. Why
don't we encrypt those partitions?
Yes, we can encrypt our partitions to make our data a little bit more
secure, even before we add the data on. Now this is most likely to be on
your laptop devices where they perhaps could be left in public and
somebody could, then obtain your data.
Now we've got the steps shown in the slide. We're going to duplicate
these steps through the demonstrations in a few moments, but the idea
of having them in the slides, it gives you then a written reference to
the steps that are required.
As we go through, we're gaining root privileges, we're installing the
package, if required. We can then go through and run our encryption
through the cryptsetup tool. That's going to ask us for a passphrase
to be able to access that.
And then when we open it, we have to put in our passphrase. But look, when we
open it, we're creating a virtual device called my‑data.
The name we give the device is down to us.
When it's open, we can then use the device.
One of the things we might want to do is check the status of the device.
We can also write data to it. Here, we're using our dd
command again and writing a string of 0s.
The idea of writing to the complete device once it has been, then set up is
that we're going to get encrypted data across the whole of the device rather
than just waiting for when we write data to the device. In this way, it makes
it very difficult for anyone who's trying to break into the data to see where
the data is stored on the disk.
All of the disk now is going to have encrypted data, so it
makes it very difficult to locate your data.
We can add a filesystem. We'll see more on managing our filesystems later.
But here, we're adding in the ext4 filesystem through to our device.
But remember, we access it now through our device name, /dev/mapper/my‑data.
Once we're finished with our device, we can shut the
laptop down. And obviously, that's going to close our
access to the encrypted partition.
But if we don't need to close our device down, but we're finished with this
filesystem, we can then go through and use the luksClose, so we can then go
through and lock our encrypted filesystem.
We're going to move out now to our command line, so we can see the demonstration
where we're going to go in for added security, encrypt the partition of our disk
file. Now working at the command line, I've left myself as root so I can get
straight into the installation, yum install ‑y cryptsetup, and the package name
should be similar across Ubuntu and openSUSE. So we can allow this to run
through, but that's given me the desired command to be able to go through and
run my encryption.
I start this one with cryptsetup, and I can go through and specify
luksFormat, so I want to then format with my key encryption.
The default will be luks2, but I want to make sure and it's clear that
we're using the luks2 rather than the luks1 formatting. And we can go
through and specify the device, so /dev/loop1p1.
It doesn't really matter which device that we're using.
We're not using any so far for data, so we could start pretty much with any
of our new partitions, but just make sure you know. So just to be certain
you want to do this, we have to type YES in uppercase, and then we're going
to be prompted for a passphrase.
This has to be a secure passphrase.
If I try something simple just like say password, it's not going to accept it.
So as I go through and put my password twice, it's not going to
accept it, and it fails the quality check.
So I have to go through the process again.
So let's go through and put a more secure passphrase.
So again, typing YES, now putting a more secure passphrase. Again,
typing it correctly twice, we can then go through and we
formatted and encrypted our partition.
Now having done that, we can go through and open up the
encrypted partition, and opening up, we'll give a device
name that we will use to access it.
So we go through and use luksOpen. Simple enough, isn't it? Open sesame.
And as we go through, we then specify that we open up, then our device
/dev/loop1p1 through to, then a virtual name, so a dev mapper device, and
we'll see how this fits in in a few moments. We've got to put in our
passphrase and carefully type that passphrase in again, and then we will
have access through to our device file.
We can go through and check the status, so we can go
‑v for verbose, and then status.
Now we use the device name that we assigned, so my‑data. We can use any name
when we're creating it, but we can then see that we've set it up with luks2,
and it's using a yes encryption with 512 bits in our key size. To try and
obfuscate the data that's being stored on the encrypted device, we're going to
write to the complete device.
So this is going to give, then a full encrypted pattern across the whole
of the surface of the disk, so people can't see where our data is going
to be stored. So you can see, then that we're reading in from dev/zero,
writing a string of 0s through to our dev mapper device, so
/dev/mapper/my‑data. So we're going to write to the complete disk, so
500 MB, or whatever size.
Don't worry about the error at the top where the disk is now full.
We've just written through to the complete disk, so
508 MB, as it's showing here.
So that gives us, then a clear encrypted pattern across the
whole of the disk to obfuscate any of our data.
We can now go through and add a filesystem. Adding a filesystem is a
traditional format, so we're then able to use this. Again, I'm just using,
then escape and dot to bring up my last argument. I just need to adjust
this so we don't have the of in front of it.
We'll see more on the mkfs command in managing our filesystems later, but
this now makes the system usable where we could add data to it. For the
moment though, we are finished with this.
We've done everything we need to get this up and running,
so I'm going to close the device. I can use Ctrl+R to
search for previous commands.
I'm just looking for open because we want to, instead of now
opening it, we want to close it, but we only need to close
our virtual dev mapper device, not the physical.
Once we've closed it, we'd have to put the passphrase in to be able to access
again. This would be done automatically if we shut the system down. But if we
are finished with the filesystem such as we are,
we might as well close it.
And now, having learned all about encrypting our partitions,
why don't we move back to our slides so we can summarize just a little of what we've looked at?