Luks - Historial de revisió

Marti: /* Backup the LUKS header */

2018-11-27T12:28:11Z

Backup the LUKS header

← Versió més antiga		Revisió del 12:28, 27 nov 2018
Línia 36:		Línia 36:

	# cryptsetup luksHeaderBackup /dev/sdb2 --header-backup-file /root/sdb2-header-backup		# cryptsetup luksHeaderBackup /dev/sdb2 --header-backup-file /root/sdb2-header-backup

			# cryptsetup luksHeaderBackup /dev/disk/by-uuid/ea7a9525-0881-4a4e-9c2a-dc82c21bdc50 --header-backup-file /backupfiles/disks/luks/M3000LUKSA-ea7a9525-0881-4a4e-9c2a-dc82c21bdc50

	Important note: a LUKS header backup can grant access to most or all data, therefore we need to make sure that nobody has access to it or at least reduce the possibility for that to happen. Storing a LUKS header backup file on a n encrypted cloud storage (such as Spideroak) wouldn’t be a bad idea.		Important note: a LUKS header backup can grant access to most or all data, therefore we need to make sure that nobody has access to it or at least reduce the possibility for that to happen. Storing a LUKS header backup file on a n encrypted cloud storage (such as Spideroak) wouldn’t be a bad idea.

Marti: /* Use a key-file instead of passphrase */

2017-10-29T20:46:25Z

Use a key-file instead of passphrase

← Versió més antiga		Revisió del 20:46, 29 oct 2017
Línia 5:		Línia 5:
	dd if=/dev/random of=/etc/keys/clauluks bs=1 count=32		dd if=/dev/random of=/etc/keys/clauluks bs=1 count=32
	dd if=/dev/random of=/etc/keys/clauluks bs=1 count=4096		dd if=/dev/random of=/etc/keys/clauluks bs=1 count=4096
			dd if=/dev/urandom of=./clauluksocell1 bs=1024 count=4
	sudo cryptsetup luksAddKey /dev/sdb1 /etc/keys/clauluks		sudo cryptsetup luksAddKey /dev/sdb1 /etc/keys/clauluks
	sudo cryptsetup --key-file /etc/keys/clauluks luksOpen /dev/sdb1 X1000LUKS		sudo cryptsetup --key-file /etc/keys/clauluks luksOpen /dev/sdb1 X1000LUKS

Marti: /* Use a key-file instead of passphrase */

2017-10-29T20:43:19Z

Use a key-file instead of passphrase

← Versió més antiga		Revisió del 20:43, 29 oct 2017
Línia 4:		Línia 4:
	cryptsetup luksDump /dev/sdb1		cryptsetup luksDump /dev/sdb1
	dd if=/dev/random of=/etc/keys/clauluks bs=1 count=32		dd if=/dev/random of=/etc/keys/clauluks bs=1 count=32
			dd if=/dev/random of=/etc/keys/clauluks bs=1 count=4096
	sudo cryptsetup luksAddKey /dev/sdb1 /etc/keys/clauluks		sudo cryptsetup luksAddKey /dev/sdb1 /etc/keys/clauluks
	sudo cryptsetup --key-file /etc/keys/clauluks luksOpen /dev/sdb1 X1000LUKS		sudo cryptsetup --key-file /etc/keys/clauluks luksOpen /dev/sdb1 X1000LUKS
Línia 13:		Línia 14:

	More info: http://www.finnie.org/2009/07/26/keyfile-based-luks-encryption-in-debian/		More info: http://www.finnie.org/2009/07/26/keyfile-based-luks-encryption-in-debian/


	==List devices==		==List devices==

Marti a 20:35, 29 oct 2017

2017-10-29T20:35:16Z

← Versió més antiga		Revisió del 20:35, 29 oct 2017
Línia 17:		Línia 17:
	==List devices==		==List devices==
	lsblk --fs		lsblk --fs


			==Backup the LUKS header==

			Backup and Restore a LUKS Header

			From the cryptsetup man page:

			“LUKS header: If the header of a LUKS volume gets damaged, all data is permanently lost unless you have a header-backup. If a key-slot is damaged, it can only be restored from a header-backup or if another active key-slot with k nown passphrase is undamaged. Damaging the LUKS header is something people manage to do with surprising frequency. This risk is the result of a trade-off between security and safety, as LUKS is designed for fast and secure wipin g by just overwriting header and key-slot area.”

			Referencing LUKS FAQ, there are two critical components for decryption: the salt values in the header itself and the key-slots. If the salt values are overwritten or changed, nothing (in the cryptographically strong sense) can b e done to access the data, unless there is a backup of the LUKS header. If a key-slot is damaged, the data can still be read with a different key-slot, if there is a remaining undamaged and used key-slot.

			Making the long story short, if our LUKS header gets damaged, all data is gone. To prevent this from happening, we need to create a header backup. This can be done by issuing the following command:

			# cryptsetup luksHeaderBackup <device> --header-backup-file <file>
			Where <device> is a LUKS volume disk and <file> is a name of a header backup file to be created. In our case:

			# cryptsetup luksHeaderBackup /dev/sdb2 --header-backup-file /root/sdb2-header-backup
			Important note: a LUKS header backup can grant access to most or all data, therefore we need to make sure that nobody has access to it or at least reduce the possibility for that to happen. Storing a LUKS header backup file on a n encrypted cloud storage (such as Spideroak) wouldn’t be a bad idea.

			In case of disaster where our LUKS header gets broken, we can restore it by issuing the following command:

			# cryptsetup luksHeaderRestore <device> --header-backup-file <file>
			WARNING: LUKS header restoration procedure will replace all key-slots, therefore only the passphrases from the backup will work afterwards!

Marti a 02:10, 29 oct 2017

2017-10-29T02:10:48Z

← Versió més antiga		Revisió del 02:10, 29 oct 2017
Línia 13:		Línia 13:

	More info: http://www.finnie.org/2009/07/26/keyfile-based-luks-encryption-in-debian/		More info: http://www.finnie.org/2009/07/26/keyfile-based-luks-encryption-in-debian/


			==List devices==
			lsblk --fs

Marti: Es crea la pàgina amb « ==Use a key-file instead of passphrase== cryptsetup luksDump /dev/sdb1 dd if=/dev/random of=/etc/keys/clauluks bs=1 count=32 sudo cryptsetup luksAddKey /dev/sdb1...».

2016-03-28T14:29:40Z

Es crea la pàgina amb « ==Use a key-file instead of passphrase== cryptsetup luksDump /dev/sdb1 dd if=/dev/random of=/etc/keys/clauluks bs=1 count=32 sudo cryptsetup luksAddKey /dev/sdb1...».

Pàgina nova

==Use a key-file instead of passphrase==

cryptsetup luksDump /dev/sdb1
dd if=/dev/random of=/etc/keys/clauluks bs=1 count=32
sudo cryptsetup luksAddKey /dev/sdb1 /etc/keys/clauluks
sudo cryptsetup --key-file /etc/keys/clauluks luksOpen /dev/sdb1 X1000LUKS
sudo mount /dev/mapper/X1000LUKS /media/X1000LUKS

You can use the UUID: /dev/disk/by-uuid/e9d308a7-3a0e-4c92-ac79-601384754081 instead of /dev/sdb1

More info: http://www.finnie.org/2009/07/26/keyfile-based-luks-encryption-in-debian/