Red Hat Security: Linux in Physical, Virtual, and Cloud

Verify that an additional disk is available on servera. In this exercise, you use this disk to create an encrypted partition.

1. Log in to servera as student. No password is required.

   [student@workstation ~]$ ssh student@servera
   [student@servera ~]$ 

2. Use the sudo -i command to change to the root user. Use student as the password.

   [student@servera ~]$ sudo -i
   [sudo] password for student: student
   [root@servera ~]# 

3. Verify that the vdb disk is available, and has no partition.

   [root@servera ~]# parted -l
   ...output omitted...
   Error: /dev/vdb: unrecognised disk label
   Model: Virtio Block Device (virtblk)
   Disk /dev/vdb: 1074MB
   Sector size (logical/physical): 512B/512B
   Partition Table: unknown
   Disk Flags:

Create a partition on the additional disk on servera.

1. Use the parted command to create a partition on the additional disk on servera. Use the whole disk for the partition.

   [root@servera ~]# parted /dev/vdb \
   > mklabel msdos \
   > mkpart primary xfs 1M 1G
   ...output omitted...

2. Verify that the partition is available.

   [root@servera ~]# parted /dev/vdb print
   Model: Virtio Block Device (virtblk)
   Disk /dev/vdb: 1074MB
   Sector size (logical/physical): 512B/512B
   Partition Table: msdos
   Disk Flags:
   
   Number  Start   End     Size    Type     File system  Flags
   1      1049kB  1074MB  1073MB  primary
   

Encrypt the vdb1 partition with LUKS.

[root@servera ~]# cryptsetup luksFormat /dev/vdb1

WARNING!
========
This will overwrite data on /dev/vdb1 irrevocably.

Are you sure? (Type uppercase yes): YES
Enter passphrase: redhatRHT
Verify passphrase: redhatRHT

Name the encrypted partition encryptedvdb1.

1. Use the cryptsetup luksOpen command to map the encrypted partition to the logical device encryptedvdb1.

   [root@servera ~]# cryptsetup luksOpen /dev/vdb1 encryptedvdb1
   Enter passphrase for /dev/vdb1: redhatRHT

2. Verify that the partition is now available at /dev/mapper/encryptedvdb1.

   [root@servera ~]# ls /dev/mapper/encryptedvdb1
   /dev/mapper/encryptedvdb1
   

Create an XFS file system on the encrypted partition, and mount this file system on the /encrypted directory. When done, create a file in that directory.

1. Create an XFS file system on the /dev/mapper/encryptedvdb1 device.

   [root@servera ~]# mkfs.xfs /dev/mapper/encryptedvdb1
   ...output omitted...

2. Create the /encrypted directory.

   [root@servera ~]# mkdir /encrypted

3. Mount /dev/mapper/encryptedvdb1 on the /encrypted directory.

   [root@servera ~]# mount -t xfs /dev/mapper/encryptedvdb1 /encrypted

4. Verify that the /dev/vdb1 partition is correctly mounted.

   [root@servera ~]# mount | grep /encrypted
   /dev/mapper/encryptedvdb1 on /encrypted type xfs (rw,relatime,seclabel,attr2,inode64,noquota)
   

5. Create a file in the /encrypted directory.

   [root@servera ~]# touch /encrypted/testfile

Unmount the file system and lock the encrypted partition.

1. Unmount the file system from the /encrypted directory.

   [root@servera ~]# umount /encrypted

2. Lock the encrypted partition.

   [root@servera ~]# cryptsetup luksClose encryptedvdb1

3. Log out from servera.

   [root@servera ~]# logout
   [student@servera ~]$ logout
   [student@workstation ~]$