1

I created a separate partition on a CentOS install (VirtualBox), and am attempting to encrypt it using cryptsetup and LUKS.

I'm using the following commands to get this set up:

cryptsetup luksOpen /dev/mapper/VolGroup-db00 db_fips (no error, all clear)
mkfs -t ext4 /dev/mapper/db_fips (no error, all clear)
e2fsck -f /dev/mapper/db_fips

e2fsck 1.41.12 (17-May-2010)
Pass 1: Checking inodes, blocks, and sizes
Pass 2: Checking directory structure
Pass 3: Checking directory connectivity
Pass 4: Checking reference counts
Pass 5: Checking group summary information
/dev/mapper/db_fips: 11/131072 files (0.0% non-contiguous), 17196/523776 blocks

Ok, the volume is created.
So next I reboot.

After logging in, the /dev/mapper/db_fips volume is gone.

[root@dhcp ~]# ll /dev/mapper/db_fips/

ls: cannot access /dev/mapper/db_fips/: No such file or directory

# lvs
  LV       VG       Attr       LSize    Pool Origin Data%  Meta%  Move Log Cpy%Sync Convert
  LogVol01 VolGroup -wi-ao----    1.46g                                                    
  LogVol02 VolGroup -wi-ao----  500.00m                                                    
  LogVol03 VolGroup -wi-ao---- 1000.00m                                                    
  LogVol04 VolGroup -wi-ao----  500.00m                                                    
  LogVol05 VolGroup -wi-ao----  300.00m                                                    
  LogVol06 VolGroup -wi-ao----    3.00g                                                    
  db00     VolGroup -wi-a-----    2.00g           

Why is the db_fips volume I just created gone?

/dev/mapper/VolGroup-db00 still exists, and shows to be encrypted (?)

blkid /dev/mapper/VolGroup-db00 
/dev/mapper/VolGroup-db00: UUID="some uuid" TYPE="crypto_LUKS" 

If /dev/mapper/VolGroup-db00 is what I actually encrypted, why did I need to issue cryptsetup /dev/mapper/VolGroup-db00 luksOpen db_fips, and why is that no longer available?

  • /dev/mapper/db_fips/ has one / too many. Also did you ever luksOpen or enter your passphrase after reboot? An encrypted volume has to be opened first. – frostschutz Jun 22 '15 at 18:56
  • I issued cryptsetup luksOpen /dev/VolGroup/db00 db_fips just now after reboot and was prompted for password, and am now able to see the volume. Will this have to be manually entered on every reboot? What if I encrypt a system volume (such as /var/log/)? – a coder Jun 22 '15 at 19:01
  • 1
    Put it in your crypttab + fstab and have an initramfs that opens it before everything else. – frostschutz Jun 22 '15 at 19:09
  • Dropping this here for others: wiki.centos.org/HowTos/EncryptedFilesystem#line-110 – a coder Jun 22 '15 at 19:41
1

Creating an encrypted volume does just that: create an encrypted volume on the disk. Using the volume on your live system is a concept that only makes sense as long as the system remains live: it needs to be done all over again if the system reboots. So you need to arrange for the volume to be brought up during the system startup. To do that, list it in the file /etc/crypttab. Add a line like this:

db_fips /dev/VolGroup/db00

Your system startup scripts will take care of calling cryptsetup luksOpen; you'll be prompted for the password. This is analogous to listing a filesystem in /etc/fstab so that it is mounted during startup.

  • What do people do when encrypting volumes on a remote server without a drac? I see where to specify a cred file, but that seems foolish since anyone would be able to read it on boot. – a coder Jun 23 '15 at 2:44
  • @acoder What's a drac? The main useful way to encrypt a remote server is to have it prompt for a password when it boots (over a virtual serial console). Another way is to have the server download the key from some other server in a more physically secure location (but typically with less bandwidth or power), and block the download if the encrypted server is compromised. – Gilles Jun 23 '15 at 12:13
  • DRAC is Dell's device to allow monitoring/interaction of systems before/during boot. – a coder Jun 23 '15 at 12:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.