Red Hat Security: Linux in Physical, Virtual, and Cloud

Log in to serverb as student. You do not need to enter any password.

[student@workstation ~]$ ssh student@serverb
[student@serverb ~]$ 

Use the sudo -i command to change to the root user. Use student as the password.

[student@serverb ~]$ sudo -i
[sudo] password for student: student
[root@serverb ~]# 

Verify that the vdb disk is available, and has no partition.

[root@serverb ~]# parted -l
...output omitted...
Error: /dev/vdb: unrecognised disk label
Model: Virtio Block Device (virtblk)
Disk /dev/vdb: 1074MB
Sector size (logical/physical): 512B/512B
Partition Table: unknown
Disk Flags:

Use the parted command to create a partition on the additional disk on serverb. Use the whole disk for the partition.

[root@serverb ~]# parted /dev/vdb \
> mklabel msdos \
> mkpart primary xfs 1M 1G
...output omitted...

Verify that the partition is available.

[root@serverb ~]# parted /dev/vdb print
Model: Virtio Block Device (virtblk)
Disk /dev/vdb: 1074MB
Sector size (logical/physical): 512B/512B
Partition Table: msdos
Disk Flags:

Number  Start   End     Size    Type     File system  Flags
1      1049kB  1074MB  1073MB  primary

Use the cryptsetup luksFormat command to encrypt the vdb1 partition with LUKS.

[root@serverb ~]# cryptsetup luksFormat /dev/vdb1

WARNING!
========
This will overwrite data on /dev/vdb1 irrevocably.

Are you sure? (Type uppercase yes): YES
Enter passphrase: redhatRHT
Verify passphrase: redhatRHT

Use the cryptsetup luksOpen command to name the encrypted partition encryptedvdb1.

[root@serverb ~]# cryptsetup luksOpen /dev/vdb1 encryptedvdb1
Enter passphrase for /dev/vdb1: redhatRHT

Verify that the partition is now available at /dev/mapper/encryptedvdb1

[root@serverb ~]# ls /dev/mapper/encryptedvdb1
/dev/mapper/encryptedvdb1

Create an XFS file system on /dev/mapper/encryptedvdb1.

[root@serverb ~]# mkfs.xfs /dev/mapper/encryptedvdb1
meta-data=/dev/mapper/encryptedvdb1 isize=512    agcount=4, agsize=65344 blks
         =                       sectsz=512   attr=2, projid32bit=1
         =                       crc=1        finobt=0, sparse=0
data     =                       bsize=4096   blocks=261376, imaxpct=25
         =                       sunit=0      swidth=0 blks
naming   =version 2              bsize=4096   ascii-ci=0 ftype=1
log      =internal log           bsize=4096   blocks=855, version=2
         =                       sectsz=512   sunit=0 blks, lazy-count=1
realtime =none                   extsz=4096   blocks=0, rtextents=0

Create the /encrypted directory.

[root@serverb ~]# mkdir /encrypted

Mount /dev/mapper/encryptedvdb1 on the /encrypted directory.

[root@serverb ~]# mount -t xfs /dev/mapper/encryptedvdb1 /encrypted

Verify that the /dev/vdb1 partition is correctly mounted.

[root@serverb ~]# mount | grep /encrypted
/dev/mapper/encryptedvdb1 on /encrypted type xfs (rw,relatime,seclabel,attr2,inode64,noquota)

Create a file in the /encrypted directory.

[root@serverb ~]# touch /encrypted/testfile

Unmount the file system from /encrypted.

[root@serverb ~]# umount /encrypted

Lock the encrypted partition.

[root@serverb ~]# cryptsetup luksClose encryptedvdb1

Install the packages required to configure serverb as a Clevis client.

[root@serverb ~]# yum install clevis clevis-luks clevis-dracut
...output omitted...
Is this ok [y/d/N]: y
...output omitted...
Installed:
  clevis.x86_64 0:7-4.el7               clevis-dracut.x86_64 0:7-4.el7
  clevis-luks.x86_64 0:7-4.el7
...output omitted...
Complete!

Associate the LUKS-encrypted partition available on /dev/vdb1 with the Tang servers on serverc, and serverd. Configure the SSS encryption so that the two Tang servers must be available to decrypt the partition.

[root@serverb ~]# cfg=$'{"t":2,"pins":{"tang":[\n
> {"url":"http://serverc.lab.example.com"},\n
> {"url":"http://serverd.lab.example.com"}]}}'
[root@serverb ~]# clevis luks bind -d /dev/vdb1 sss "$cfg"
The advertisement contains the following signing keys:

gks_IaVo1yog0KuQei95rg_yGns

Do you wish to trust these keys? [ynYN] Y
The advertisement contains the following signing keys:

vA5xAeUiKPqvkg4UyR4TemzXoAw

Do you wish to trust these keys? [ynYN] Y
You are about to initialize a LUKS device for metadata storage.
Attempting to initialize it may result in data loss if data was
already written into the LUKS header gap in a different format.
A backup is advised before initialization is performed.

Do you wish to initialize /dev/vdb1? [yn] y
Enter existing LUKS password: redhatRHT

Use the systemctl enable clevis-luks-askpass.path command to enable clevis-luks-askpass.path.

[root@serverb ~]# systemctl enable clevis-luks-askpass.path
Created symlink from /etc/systemd/system/remote-fs.target.wants/clevis-luks-askpass.path to /usr/lib/systemd/system/clevis-luks-askpass.path.

Modify the /etc/crypttab file to open the encrypted partition at boot time.

[root@serverb ~]# vi /etc/crypttab
encryptedvdb1       /dev/vdb1  none   _netdev

Update the /etc/fstab file to mount the encrypted partition on the /encrypted directory. When done, log out from serverb.

[root@serverb ~]# vi /etc/fstab
...output omitted...
/dev/mapper/encryptedvdb1   /encrypted       xfs    _netdev        1 2
[root@serverb ~]# logout
[student@serverb ~]$ logout
[student@workstation ~]$ 

Click Actions → Shutdown for serverb to stop that virtual machine, and wait until the status for serverb is STOPPED. When done, click Actions → Start for serverb to start that virtual machine, and wait until the status for serverb is STARTED.

Log in to serverb as student. You do not need to enter any password.

[student@workstation ~]$ ssh student@serverb
[student@serverb ~]$ 

Use the sudo -i command to change to the root user. Use student as the password.

[student@serverb ~]$ sudo -i
[sudo] password for student: student
[root@serverb ~]# 

Verify that the encrypted partition is mounted on the /encrypted directory.

[root@serverb ~]# mount | grep /encrypted
/dev/mapper/encryptedvdb1 on /encrypted type xfs (rw,relatime,seclabel,attr2,inode64,noquota,_netdev)

Verify that the previously created file is still available in the /encrypted directory. When done, log out from serverb.

[root@serverb ~]# ls /encrypted
testfile
[root@serverb ~]# logout
[student@serverb ~]$ logout
[student@workstation ~]$ 

Log in to serverc as student. You do not need to enter any password.

[student@workstation ~]$ ssh student@serverc
[student@serverc ~]$ 

Use the sudo -i command to change to the root user. Use student as the password.

[student@serverc ~]$ sudo -i
[sudo] password for student: student
[root@serverc ~]# 

Generate new signature and exchange keys in the directory for the Tang server key database, /var/db/tang. The Tang server uses the new keys automatically for new client bindings.

[root@serverc ~]# cd /var/db/tang
[root@serverc tang]# jose jwk gen -i '{"alg":"ES512"}' \
> -o signature.jwk
[root@serverc tang]# jose jwk gen -i '{"alg":"ECMR"}' \
> -o exchange.jwk

Rename the old keys with a . as a prefix. The names of your old keys may be different. When done, log out from serverc.

[root@serverc tang]# mv gxB7oqYiEu3zrLayhymtD10sV9E.jwk \
> .gxB7oqYiEu3zrLayhymtD10sV9E.jwk
[root@serverc tang]# mv k25k6PbmgUu-pWWUb210xgBelhfQ.jwk \
> .k25k6PbmgUu-pWWUb210xgBelhfQ.jwk
[root@serverc tang]# logout
[student@serverc ~]$ logout
[student@workstation ~]$