rhel6.0磁盤分區加密3--自動掛載

 

 

使加密分區自動掛載，

1.查看分區的uuid 如下圖：也可以使用blkid查看，

[root@server1 ~]# ll /dev/disk/by-uuid/

total 0

lrwxrwxrwx. 1 root root 10 Jul 16 05:57 3c5611fe-9d40-44f1-aaae-63fd12b88586 -> ../../dm-0

lrwxrwxrwx. 1 root root 10 Jul 16 05:59 79a9a7b6-bfca-46b3-80d5-1323e82c38df -> ../../sda7

lrwxrwxrwx. 1 root root 10 Jul 16 05:57 912a609f-1ddc-4c72-932a-c55ea18c934d -> ../../sda6

lrwxrwxrwx. 1 root root 10 Jul 16 05:48 a7a09bba-751f-427a-b3a7-b91ee6eb3a5a -> ../../sda1

lrwxrwxrwx. 1 root root 10 Jul 16 05:48 b714dd11-0c1e-4d9a-9541-9512286bb56d -> ../../sda3

lrwxrwxrwx. 1 root root 10 Jul 16 05:48 bf88fead-5856-4500-8913-a3ceb4d620ff -> ../../sda2

lrwxrwxrwx. 1 root root 10 Jul 16 05:48 d010c333-c041-42b3-98c2-c5bc89983229 -> ../../sda5

lrwxrwxrwx. 1 root root 10 Jul 16 06:02 ee8915c1-0aca-470c-ac31-d13131792fef -> ../../dm-1

 

[root@server1 ~]# blkid

/dev/sda1: UUID="a7a09bba-751f-427a-b3a7-b91ee6eb3a5a" TYPE="ext4"

/dev/sda2: UUID="bf88fead-5856-4500-8913-a3ceb4d620ff" TYPE="ext4"

/dev/sda3: UUID="b714dd11-0c1e-4d9a-9541-9512286bb56d" TYPE="ext4"

/dev/sda5: UUID="d010c333-c041-42b3-98c2-c5bc89983229" TYPE="swap"

/dev/sda6: UUID="912a609f-1ddc-4c72-932a-c55ea18c934d" TYPE="crypto_LUKS"

/dev/sda7: UUID="79a9a7b6-bfca-46b3-80d5-1323e82c38df" TYPE="crypto_LUKS"

/dev/mapper/udisks-luks-uuid-912a609f-1ddc-4c72-932a-c55ea18c934d-uid500: LABEL="opt" UUID="3c5611fe-9d40-44f1-aaae-63fd12b88586" TYPE="ext4"

/dev/mapper/rhel: UUID="ee8915c1-0aca-470c-ac31-d13131792fef" TYPE="ext4"

2.在/etc/fstab文件中添加自動掛載項。如下圖

[root@server1 ~]# vim /etc/fstab #

# /etc/fstab

# Created by anaconda on Thu Jul 14 10:07:44 2011

#

# Accessible filesystems, by reference, are maintained under '/dev/disk'

# See man pages fstab(5), findfs(8), mount(8) and/or blkid(8) for more info

#

UUID=bf88fead-5856-4500-8913-a3ceb4d620ff /                       ext4    defaults        1 1

UUID=a7a09bba-751f-427a-b3a7-b91ee6eb3a5a /boot                   ext4    defaults        1 2

UUID=b714dd11-0c1e-4d9a-9541-9512286bb56d /home                   ext4    defaults        1 2

UUID=d010c333-c041-42b3-98c2-c5bc89983229 swap                    swap    defaults        0 0

tmpfs                   /dev/shm                tmpfs   defaults        0 0

devpts                  /dev/pts                devpts  gid=5,mode=620  0 0

sysfs                   /sys                    sysfs   defaults        0 0

proc                    /proc                   proc    defaults        0 0

UUID=ee8915c1-0aca-470c-ac31-d13131792fef /rhel   ext4    defaults        0 0

3. 但是在系統重新啓動時，不會自動掛載此分區，啓動過程提示如下錯誤，

4.登錄後，不會自動掛載，如下圖：

[root@server1 ~]# mount 

/dev/sda2 on / type ext4 (rw)

proc on /proc type proc (rw)

sysfs on /sys type sysfs (rw)

devpts on /dev/pts type devpts (rw,gid=5,mode=620)

tmpfs on /dev/shm type tmpfs (rw,rootcontext="system_u:object_r:tmpfs_t:s0")

/dev/sda1 on /boot type ext4 (rw)

/dev/sda3 on /home type ext4 (rw)

none on /proc/sys/fs/binfmt_misc type binfmt_misc (rw)

sunrpc on /var/lib/nfs/rpc_pipefs type rpc_pipefs (rw)

 

[root@server1 ~]# mount -a

mount: special device UUID=ee8915c1-0aca-470c-ac31-d13131792fef does not exist

 

[root@server1 ~]# df -hl

Filesystem            Size  Used Avail Use% Mounted on

/dev/sda2              20G  4.0G   15G  22% /

tmpfs                 250M  260K  250M   1% /dev/shm

/dev/sda1             194M   24M  161M  13% /boot

/dev/sda3             4.9G  140M  4.5G   3% /home

5.查看映射狀態，提示沒有此映射，如下圖：

[root@server1 ~]# cryptsetup status rhel

/dev/mapper/rhel is inactive.

[root@server1 ~]# ll /dev/mapper/

total 0

crw-rw----. 1 root root 10, 58 Jul 16 07:41 control

6.需要手動重新映射纔可以成功，如下圖：

[root@server1 ~]# cryptsetup luksOpen /dev/sda7 rhel

Enter passphrase for /dev/sda7:

[root@server1 ~]# mount –a   重新讀取/etc/fstab掛載

[root@server1 ~]# df -hl

Filesystem            Size  Used Avail Use% Mounted on

/dev/sda2              20G  4.0G   15G  22% /

tmpfs                 250M  260K  250M   1% /dev/shm

/dev/sda1             194M   24M  161M  13% /boot

/dev/sda3             4.9G  139M  4.5G   3% /home

/dev/mapper/rhel      492M   11M  457M   3% /rhel

 

如果希望在系統啓動時自動掛載加密分區，需要做如下配置，

1.建立加密分區的密鑰文件，如下圖：

[root@server1 ~]# cat rhel_pass

123456

[root@server1 ~]# cryptsetup luksAddKey /dev/sda7 /root/rhel_pass

Enter any passphrase:

2.修改配置文件/etc/crypttab，如下圖：

[root@server1 ~]# cat /etc/crypttab

rhel    /dev/sda7       /root/rhel_pass

映射名   分區                   密碼文件位置