linux——管理系统设备之磁盘的加密、加密磁盘的挂载及磁盘阵列、配额-原创手记-慕课网

一、磁盘加密

1.磁盘加密

命令祥解：

[root@localhost ~]# cryptsetup luksFormat /dev/vdb1 ##对设备/dev/vdb1进行加密

WARNING!
========
This will overwrite data on /dev/vdb1 irrevocably.

Are you sure? (Type uppercase yes): yes    ##小写的yes，直接退出，无效
[root@localhost ~]# cryptsetup luksFormat /dev/vdb1

WARNING!
========
This will overwrite data on /dev/vdb1 irrevocably.

Are you sure? (Type uppercase yes): YES   ##大写的YES，确认并添加加密密码
Enter passphrase:
Verify passphrase:
[root@localhost ~]# mount /dev/vdb1 /mnt/   ##挂载设备/dev/vdb1
mount: unknown filesystem type 'crypto_LUKS'   ##挂载失败，设备已被加密
[root@localhost ~]# ls /dev/mapper/    ##查看/dev/mapper/目录
control
[root@localhost ~]# cryptsetup open /dev/vdb1 butterfly    ##对设备解密
Enter passphrase for /dev/vdb1:             ##需手动输入密码
[root@localhost ~]# ls /dev/mapper/
butterfly control
[root@localhost ~]# mkfs.xfs /dev/mapper/butterfly   ##将解密后生成的设备butterfly格式化

[root@localhost ~]# mount /dev/mapper/butterfly /mnt/    ##挂载设备butterfly
[root@localhost ~]# touch /mnt/tutu{1..3}   ##对设备进行读写操作
[root@localhost ~]# ls /mnt/
tutu1 tutu2 tutu3
[root@localhost ~]# umount /mnt/   ##卸载设备
[root@localhost ~]# ls /mnt/
[root@localhost ~]# cryptsetup close butterfly    ##将设备butterfly关闭
[root@localhost ~]# ll /dev/mapper/
total 0
crw-------. 1 root root 10, 236 May 2 06:23 control
[root@localhost ~]# mount /dev/mapper/butterfly /mnt/
mount: special device /dev/mapper/butterfly does not exist
[root@localhost ~]# mount /dev/vdb1 /mnt/
mount: unknown filesystem type 'crypto_LUKS'
[root@localhost ~]# cryptsetup open /dev/vdb1 butterfly
Enter passphrase for /dev/vdb1:
[root@localhost ~]# mount /dev/vdb1 /mnt/
mount: unknown filesystem type 'crypto_LUKS'
[root@localhost ~]# mount /dev/mapper/butterfly /mnt/
[root@localhost ~]# df
[root@localhost ~]#

磁盘加密，就像把设备放在一个有盖子的容器中，命令cryptsetup open /dev/vdb1 butterfly 就是打开盖子，将设备拿出来，进行一系列操作后，再用命令cryptsetup close butterfly 将设备放回容器中并盖上盖子。这样，可以提高安全性能。

图解：

2.加密磁盘的永久挂载

[root@localhost ~]# vim /root/diskpass    ##加密字符存放处
[root@localhost ~]# chmod 600 /root/diskpass   ##给该文件加权限
[root@localhost ~]# cryptsetup luksAddKey /dev/vdb1 /root/diskpass    ##将密码文件做成容器的"盖子"
Enter any passphrase:
[root@localhost ~]# vim /etc/crypttab     ##设置设备解密后的管理文件
[root@localhost ~]# vim /etc/fstab   ##永久挂载设置
[root@localhost ~]# df

[root@localhost ~]# umount /mnt/
[root@localhost ~]# reboot
[root@localhost ~]# df

[root@localhost ~]#

编写的三份文件的内容：

[root@localhost ~]# cat /root/diskpass
147westos
[root@localhost ~]# cat /etc/crypttab
butterfly        /dev/vdb1    /root/diskpass
解密后设备管理文件      设备    加密字符存放文件
[root@localhost ~]# cat /etc/fstab | tail -n 2
UUID=9bf6b9f7-92ad-441b-848e-0257cbb883d1 /                       xfs     defaults        1 1   ##文件本身存在
/dev/mapper/butterfly /mnt xfs defaults 0 0 ##编写内容
[root@localhost ~]#

3.加密清除

[root@localhost ~]# vim /etc/fstab
[root@localhost ~]# > /etc/crypttab
[root@localhost ~]# rm -fr /root/diskpass
[root@localhost ~]# umount /mnt/
[root@localhost ~]# cryptsetup close butterfly
[root@localhost ~]# mkfs.xfs /dev/vdb1
mkfs.xfs: /dev/vdb1 appears to contain an existing filesystem (crypto_LUKS).
mkfs.xfs: Use the -f option to force overwrite.
[root@localhost ~]# cat /etc/fstab
#
# /etc/fstab
# Created by anaconda on Wed May 7 01:22:57 2014
#
# Accessible filesystems, by reference, are maintained under '/dev/disk'
# See man pages fstab(5), findfs(8), mount(8) and/or blkid(8) for more info
#
UUID=9bf6b9f7-92ad-441b-848e-0257cbb883d1 / xfs defaults 1 1
[root@localhost ~]#