Red Hat Security: Linux in Physical, Virtual, and Cloud

Verify that an additional disk is available on servera. Use this disk to create a storage partition.

1. Log in to servera as student. No password is required.

   [student@workstation ~]$ ssh student@servera
   [student@servera ~]$ 

2. Use the sudo -i command to change to the root user. Use student as the password.

   [student@servera ~]$ sudo -i
   [sudo] password for student: student
   [root@servera ~]# 

3. Verify that the /dev/vdb disk is available and has no partitions.

   [root@servera ~]# parted -l
   ...output omitted...
   Error: /dev/vdb: unrecognised disk label
   Model: Virtio Block Device (virtblk)
   Disk /dev/vdb: 1074MB
   Sector size (logical/physical): 512B/512B
   Partition Table: unknown
   Disk Flags:

Create a 1 GB partition on the additional disk on servera.

1. Use the parted command to create a partition on the additional disk on servera. Use the whole disk for the partition.

   [root@servera ~]# parted /dev/vdb \
   > mklabel msdos \
   > mkpart primary xfs 1M 1G
   ...output omitted...

2. Verify that the partition is available.

   [root@servera ~]# parted /dev/vdb print
   Model: Virtio Block Device (virtblk)
   Disk /dev/vdb: 1074MB
   Sector size (logical/physical): 512B/512B
   Partition Table: msdos
   Disk Flags:
   
   Number  Start   End     Size    Type     File system  Flags
   1      1049kB  1074MB  1073MB  primary
   

Encrypt the /dev/vdb1 partition with LUKS. Use redhatRHT as the password for the encryption.

1. Use the cryptsetup luksFormat command to encrypt the /dev/vdb1 partition with LUKS.

   [root@servera ~]# cryptsetup luksFormat /dev/vdb1
   
   WARNING!
   ========
   This will overwrite data on /dev/vdb1 irrevocably.
   
   Are you sure? (Type uppercase yes): YES
   Enter passphrase: redhatRHT
   Verify passphrase: redhatRHT

Name the storage partition storage.

1. Use the cryptsetup luksOpen command to name the storage partition storage.

   [root@servera ~]# cryptsetup luksOpen /dev/vdb1 storage
   Enter passphrase for /dev/vdb1: redhatRHT

2. Verify that the partition is now available at /dev/mapper/storage

   [root@servera ~]# ls /dev/mapper/storage
   /dev/mapper/storage
   

Create an XFS file system on the storage partition, and then mount the new file system on the /storage directory. In that directory create a new text file named encryption-test.txt.

1. Create an XFS file system on /dev/mapper/storage.

   [root@servera ~]# mkfs.xfs /dev/mapper/storage
   meta-data=/dev/mapper/storage isize=512    agcount=4, agsize=65344 blks
            =                       sectsz=512   attr=2, projid32bit=1
            =                       crc=1        finobt=0, sparse=0
   data     =                       bsize=4096   blocks=261376, imaxpct=25
            =                       sunit=0      swidth=0 blks
   naming   =version 2              bsize=4096   ascii-ci=0 ftype=1
   log      =internal log           bsize=4096   blocks=855, version=2
            =                       sectsz=512   sunit=0 blks, lazy-count=1
   realtime =none                   extsz=4096   blocks=0, rtextents=0

2. Create the /storage directory.

   [root@servera ~]# mkdir /storage

3. Mount /dev/mapper/storage on the /storage directory.

   [root@servera ~]# mount -t xfs /dev/mapper/storage /storage

4. Verify that the /dev/vdb1 partition is correctly mounted.

   [root@servera ~]# mount | grep /storage
   /dev/mapper/storage on /storage type xfs (rw,relatime,seclabel,attr2,inode64,noquota)
   

5. Create a text file named encryption-test.txt.

   [root@servera ~]# touch /storage/encryption-test.txt

Unmount the file system and lock the storage partition.

1. Unmount the file system from /storage.

   [root@servera ~]# umount /storage

2. Lock the storage partition.

   [root@servera ~]# cryptsetup luksClose storage

3. When done, log off from serverb.

   [root@servera ~]# logout
   [student@servera ~]$ logout
   [student@workstation ~]$ 

Install Tang servers on serverb, serverc, and serverd. Configure the firewall on those nodes to allow connections to the default port for Tang servers (80/TCP).

1. Log in to serverb as student. No password is required.

   [student@workstation ~]$ ssh student@serverb
   [student@serverb ~]$ 

2. Use the sudo -i command to change to the root user. Use student as the password.

   [student@serverb ~]$ sudo -i
   [sudo] password for student: student
   [root@serverb ~]# 

3. Install the tang package.

   [root@serverb ~]# yum install tang
   ...output omitted...
   Is this ok [y/d/N]: y
   ...output omitted...
   Installed:
   tang.x86_64 0:6-1.el7
   ...output omitted...
   Complete!
   

4. Enable socket activation for the Tang server.

   [root@serverb ~]# systemctl enable tangd.socket --now
   Created symlink from /etc/systemd/system/multi-user.target.wants/tangd.socket to /usr/lib/systemd/system/tangd.socket.

5. Confirm that firewalld allows connections to TCP port 80. When done, log off from serverb.

   [root@serverb ~]# firewall-cmd --zone=public --add-port=80/tcp \
   > --permanent
   Warning: ALREADY_ENABLED: 80:tcp
   success
   [root@serverb ~]# firewall-cmd --reload
   success
   [root@serverb ~]# logout
   [student@serverb ~]$ logout
   [student@workstation ~]$ 

6. Perform the same steps for serverc and serverd.

   Note

   If you do not want to repeat the steps to configure the Tang servers for serverc and serverd as practice, an Ansible Playbook is available to accelerate this part of the solution.

   On workstation as student, change your working directory to /home/student/RH415/labs/nbde-cr. Run the install_tang.yml playbook.

   [student@workstation ~]$ cd ~/RH415/labs/nbde-cr
   [student@workstation nbde-cr]$ ansible-playbook install_tang.yml

On servera as the root user, associate the LUKS-encrypted storage partition /dev/vdb1 with the Tang servers on serverb, serverc, and serverd. Configure SSS on servera so that three Tang servers must be available to automatically decrypt the partition.

1. Log in to servera as student. No password is required.

   [student@workstation ~]$ ssh student@servera
   [student@servera ~]$ 

2. Use the sudo -i command to change to the root user. Use student as the password.

   [student@servera ~]$ sudo -i
   [sudo] password for student: student
   [root@servera ~]# 

3. Install the packages required to configure servera as a Clevis client.

   [root@servera ~]# yum install clevis clevis-luks clevis-dracut
   ...output omitted...
   Is this ok [y/d/N]: y
   ...output omitted...
   Installed:
     clevis.x86_64 0:7-4.el7               clevis-dracut.x86_64 0:7-4.el7
     clevis-luks.x86_64 0:7-4.el7
   ...output omitted...
   Complete!

4. Associate the LUKS-encrypted storage partition available on /dev/vdb1 with the Tang servers on serverc and serverd. Configure the SSS encryption so that three Tang servers must be available to decrypt the partition.

   [root@servera ~]# cfg=$'{"t":3,"pins":{"tang":[\n
   > {"url":"http://serverb.lab.example.com"},\n
   > {"url":"http://serverc.lab.example.com"},\n
   > {"url":"http://serverd.lab.example.com"}]}}'
   [root@servera ~]# clevis luks bind -d /dev/vdb1 sss "$cfg"
   The advertisement contains the following signing keys:
   
   gks_IaVo1yog0KuQei95rg_yGns
   
   Do you wish to trust these keys? [ynYN] Y
   The advertisement contains the following signing keys:
   
   mtrjAU6q2CfG3g3gu8yHmwLrctg
   
   Do you wish to trust these keys? [ynYN] Y
   The advertisement contains the following signing keys:
   
   vA5xAeUiKPqvkg4UyR4TemzXoAw
   Do you wish to trust these keys? [ynYN] Y
   You are about to initialize a LUKS device for metadata storage.
   Attempting to initialize it may result in data loss if data was
   already written into the LUKS header gap in a different format.
   A backup is advised before initialization is performed.
   
   Do you wish to initialize /dev/vdb1? [yn] y
   Enter existing LUKS password: redhatRHT

On servera, enable the clevis-luks-askpass.path systemd unit in order to support non-root LUKS-encrypted storage partitions.

1. Use the systemctl enable clevis-luks-askpass.path command to enable clevis-luks-askpass.path.

   [root@servera ~]# systemctl enable clevis-luks-askpass.path
   Created symlink from /etc/systemd/system/remote-fs.target.wants/clevis-luks-askpass.path to /usr/lib/systemd/system/clevis-luks-askpass.path.

Configure the storage partition on servera so that it is automatically decrypted and mounted on the /storage directory at boot time.

1. Modify the /etc/crypttab file to open the storage partition at boot time.

   [root@servera ~]# vi /etc/crypttab
   storage       /dev/vdb1  none   _netdev

2. Update the /etc/fstab file to mount the storage partition on the /storage directory. When done, log off from servera.

   [root@servera ~]# vi /etc/fstab
   ...output omitted...
   /dev/mapper/storage   /storage       xfs    _netdev        1 2
   [root@servera ~]# logout
   [student@servera ~]$ logout
   [student@workstation ~]$ 

Reboot servera to confirm that it automatically decrypts and mounts the XFS file system in the LUKS-encrypted partition, /dev/vdb1, on the /storage directory at boot time.

1. Click Actions → Shutdown for servera to stop that virtual machine, and wait until the status for servera is STOPPED. When done, click Actions → Start for servera to start that virtual machine, and wait until the status for servera is STARTED.

2. Log in to servera as student. No password is required.

   [student@workstation ~]$ ssh student@servera
   [student@servera ~]$ 

3. Use the sudo -i command to change to the root user. Use student as the password.

   [student@servera ~]$ sudo -i
   [sudo] password for student: student
   [root@servera ~]# 

4. Verify that the storage partition is mounted on the /storage directory.

   [root@servera ~]# mount | grep /storage
   /dev/mapper/storage on /storage type xfs (rw,relatime,seclabel,attr2,inode64,noquota,_netdev)

5. Verify that the previously created file is still available in the /storage directory. When done, log off from servera.

   [root@servera ~]# ls /storage
   encryption-test.txt
   [root@servera ~]# logout
   [student@servera ~]$ logout
   [student@workstation ~]$ 
   

Rotate the keys for the Tang server on serverc. Generate a new signature key called signature.jwk. Generate a new exchange key called exchange.jwk.

1. Log in to serverc as student. No password is required.

   [student@workstation ~]$ ssh student@serverc
   [student@serverc ~]$ 

2. Use the sudo -i command to change to the root user. Use student as the password.

   [student@serverc ~]$ sudo -i
   [sudo] password for student: student
   [root@serverc ~]# 

3. Generate new signature and exchange keys in the directory for the Tang server key database, /var/db/tang. The Tang server uses the new keys automatically for new client bindings.

   [root@serverc ~]# cd /var/db/tang
   [root@serverc tang]# jose jwk gen -i '{"alg":"ES512"}' \
   > -o signature.jwk
   [root@serverc tang]# jose jwk gen -i '{"alg":"ECMR"}' \
   > -o exchange.jwk

4. Rename the old keys with a . as a prefix. The names of your old keys may be different. When done, log off from serverc.

   [root@serverc tang]# mv gxB7oqYiEu3zrLayhymtD10sV9E.jwk \
   > .gxB7oqYiEu3zrLayhymtD10sV9E.jwk
   [root@serverc tang]# mv k25k6PbmgUu-pWWUb210xgBelhfQ.jwk \
   > .k25k6PbmgUu-pWWUb210xgBelhfQ.jwk
   [root@serverc tang]# logout
   [student@serverc ~]$ logout
   [student@workstation ~]$