2013年3月11日 星期一 晴
磁盤加密
一、創建磁盤
[root@desktop7 ~]# fdisk /dev/sda
The number of cylinders for this disk is set to 60801.
There is nothing wrong with that, but this is larger than 1024,
and could in certain setups cause problems with:
1) software that runs at boot time (e.g., old versions of LILO)
2) booting and partitioning software from other OSs
(e.g., DOS FDISK, OS/2 FDISK)
Command (m for help): n
First cylinder (12788-60801, default 12788):
Using default value 12788
Last cylinder or +size or +sizeM or +sizeK (12788-60801, default 60801): +100M
Command (m for help): p
Disk /dev/sda: 500.1 GB, 500107862016 bytes
255 heads, 63 sectors/track, 60801 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Device Boot Start End Blocks Id System
/dev/sda1 * 1 13 104391 83 Linux
/dev/sda2 14 6387 51199155 8e Linux LVM
/dev/sda3 6388 12761 51199155 8e Linux LVM
/dev/sda4 12762 60801 385881300 5 Extended
/dev/sda5 12762 12774 104391 83 Linux
/dev/sda6 12775 12787 104391 83 Linux
/dev/sda7 12788 12800 104391 83 Linux
Command (m for help): w
The partition table has been altered!
Calling ioctl() to re-read partition table.
WARNING: Re-reading the partition table failed with error 16: Device or resource busy.
The kernel still uses the old table.
The new table will be used at the next reboot.
Syncing disks.
[root@desktop7 ~]# partprobe /dev/sda
二、爲磁盤加密
[root@desktop7 ~]# cryptsetup luksFormat /dev/sda7
WARNING!
========
This will overwrite data on /dev/sda7 irrevocably.
Are you sure? (Type uppercase yes): YES
Enter LUKS passphrase:
Verify passphrase:
Command successful.
三、進入磁盤
[root@desktop7 ~]# cryptsetup luksOpen /dev/sda7 secret
Enter LUKS passphrase for /dev/sda7:
key slot 0 unlocked.
Command successful.
[root@desktop7 ~]#
四、格式化
[root@desktop7 ~]# mkfs -t ext3 /dev/mapper/secret
mke2fs 1.39 (29-May-2006)
Filesystem label=
OS type: Linux
Block size=1024 (log=0)
Fragment size=1024 (log=0)
26000 inodes, 103872 blocks
5193 blocks (5.00%) reserved for the super user
First data block=1
Maximum filesystem blocks=67371008
13 block groups
8192 blocks per group, 8192 fragments per group
2000 inodes per group
Superblock backups stored on blocks:
8193, 24577, 40961, 57345, 73729
Writing inode tables: done
Creating journal (4096 blocks): done
Writing superblocks and filesystem accounting information: done
This filesystem will be automatically checked every 32 mounts or
180 days, whichever comes first. Use tune2fs -c or -i to override.
[root@desktop7 ~]#
五、掛載
[root@desktop7 ~]# mount /dev/mapper/secret /mnt
驗證
[root@desktop7 ~]# mount
/dev/mapper/Vol0-vol_root on / type ext3 (rw)
proc on /proc type proc (rw)
sysfs on /sys type sysfs (rw)
devpts on /dev/pts type devpts (rw,gid=5,mode=620)
/dev/sda1 on /boot type ext3 (rw)
tmpfs on /dev/shm type tmpfs (rw)
none on /proc/sys/fs/binfmt_misc type binfmt_misc (rw)
sunrpc on /var/lib/nfs/rpc_pipefs type rpc_pipefs (rw)
/dev/sdb on /media/disk type vfat (rw,nosuid,nodev,shortname=winnt,uid=0)
/dev/mapper/secret on /mnt type ext3 (rw)
[root@desktop7 ~]#
六、使用磁盤
1、編輯一個文件
[root@desktop7 ~]# vim ceshi
[root@desktop7 ~]#
2、複製文件
（1）錯誤做法（不能對加密磁盤進行操作）
[root@desktop7 ~]# cp ceshi /dev/mapper/secret
cp: overwrite `/dev/mapper/secret'? y
（2）正確做法（對掛載到的盤符進行操作）
[root@desktop7 ~]# cp ceshi /chenglong
[root@desktop7 ~]# cat /chenglong/ceshi
[root@instructor ~]# echo "hello the world" | awk '{print $1}'
hello
[root@instructor ~]# echo "hello the world" | awk '{print $1,$2}'
hello the
[root@instructor ~]# echo "hello the world" | awk '{print $1,$2,$3}'
hello the world
[root@instructor ~]# echo "hello the world" | awk '{print $0}'
hello the world
[root@desktop7 ~]#
3、其他操作
七、卸載磁盤
[root@desktop7 mapper]# umount /dev/mapper/secret
[root@desktop7 mapper]# mount
/dev/mapper/Vol0-vol_root on / type ext3 (rw)
proc on /proc type proc (rw)
sysfs on /sys type sysfs (rw)
devpts on /dev/pts type devpts (rw,gid=5,mode=620)
/dev/sda1 on /boot type ext3 (rw)
tmpfs on /dev/shm type tmpfs (rw)
none on /proc/sys/fs/binfmt_misc type binfmt_misc (rw)
sunrpc on /var/lib/nfs/rpc_pipefs type rpc_pipefs (rw)
/dev/sdb on /media/disk type vfat (rw,nosuid,nodev,shortname=winnt,uid=0)
[root@desktop7 mapper]#