{"id":35652,"date":"2019-10-31T22:05:33","date_gmt":"2019-10-31T19:05:33","guid":{"rendered":"https:\/\/prohoster.info\/blog\/rasshifrovka-luks-kontejnera-v-moment-zagruzki-sistemy\/"},"modified":"2019-10-31T22:05:33","modified_gmt":"2019-10-31T19:05:33","slug":"rasshifrovka-luks-kontejnera-v-moment-zagruzki-sistemy","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/rasshifrovka-luks-kontejnera-v-moment-zagruzki-sistemy","title":{"rendered":"Dek\u00f3dov\u00e1n\u00ed LUKS kontejneru b\u011bhem startu syst\u00e9mu","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

V\u0161em p\u0159eji dobr\u00fd den \u010di noc! Tento p\u0159\u00edsp\u011bvek bude u\u017eite\u010dn\u00fd t\u011bm, kte\u0159\u00ed pou\u017e\u00edvaj\u00ed \u0161ifrov\u00e1n\u00ed dat LUKS a cht\u011bj\u00ed prov\u00e1d\u011bt de\u0161ifrov\u00e1n\u00ed disk\u016f pod Linuxem (Debian, Ubuntu) na st\u00e1diu de\u0161ifrov\u00e1n\u00ed root odd\u00edlu<\/b>. A takov\u00e9 informace jsem na internetu nemohl naj\u00edt.<\/p>\n

Ned\u00e1vno jsem se p\u0159i zvy\u0161ov\u00e1n\u00ed po\u010dtu disk\u016f v polic\u00edch setkal s probl\u00e9mem de\u0161ifrov\u00e1n\u00ed disk\u016f pomoc\u00ed dob\u0159e zn\u00e1m\u00e9 metody p\u0159es \/etc\/crypttab. Osobn\u011b vyzdvihuji n\u011bkolik probl\u00e9m\u016f s pou\u017e\u00edv\u00e1n\u00edm t\u00e9to metody, a to, \u017ee soubor se \u010dte pouze po na\u010dten\u00ed (mount) root-odd\u00edlu<\/b>, co\u017e negativn\u011b ovliv\u0148uje import ZFS, zejm\u00e9na pokud byly sestaveny z odd\u00edl\u016f na *_crypt za\u0159\u00edzen\u00ed, nebo mdadm RAIDy, kter\u00e9 byly tak\u00e9 sestaveny z odd\u00edl\u016f. V\u0161ichni v\u00edme, \u017ee lze pou\u017e\u00edt parted na LUKS kontejnerech?<\/i> A tak\u00e9 probl\u00e9m brzk\u00e9ho spou\u0161t\u011bn\u00ed dal\u0161\u00edch slu\u017eeb, kdy\u017e pole je\u0161t\u011b neexistuj\u00ed, a pou\u017e\u00edt<\/b> u\u017e je n\u011bco pot\u0159eba (pracuji s clusterovan\u00fdm Proxmox VE 5.x a ZFS p\u0159es iSCSI).<\/p>\n

Trochu o ZFS over iSCSI<\/b>iSCSI u m\u011b funguje p\u0159es LIO, a kdy\u017e se spou\u0161t\u00ed iSCSI c\u00edl a nevid\u00ed ZVOL za\u0159\u00edzen\u00ed, prost\u011b je odstran\u00ed z konfigurace, co\u017e br\u00e1n\u00ed startov\u00e1n\u00ed hostitelsk\u00fdch syst\u00e9m\u016f. Odtud bu\u010f obnova z\u00e1lohy json souboru, nebo ru\u010dn\u00ed p\u0159id\u00e1n\u00ed za\u0159\u00edzen\u00ed s identifik\u00e1tory ka\u017ed\u00e9 VM, co\u017e je skute\u010dn\u011b hrozn\u00e9, kdy\u017e t\u011bchto stroj\u016f je deset a v konfiguraci ka\u017ed\u00e9ho je v\u00edce ne\u017e 1 disk.<\/p>\n

A druh\u00e1 ot\u00e1zka, kterou budu zva\u017eovat, je, \u010d\u00edm prov\u00e1d\u011bt de\u0161ifrov\u00e1n\u00ed (to je kl\u00ed\u010dov\u00fd bod \u010dl\u00e1nku). O tom budeme hovo\u0159it n\u00ed\u017ee, poj\u010fte d\u00e1l!
\n<\/a><\/noindex>
\nNej\u010dast\u011bji se na internetu pou\u017e\u00edv\u00e1 kl\u00ed\u010dov\u00fd soubor (samoz\u0159ejm\u011b d\u0159\u00edve p\u0159idan\u00fd do slotu p\u0159\u00edkazem \u2014 cryptsetup luksAddKey), nebo v raritn\u00edch v\u00fdjimk\u00e1ch (v rusky mluv\u00edc\u00edm internetu je velmi skromn\u00e9 mno\u017estv\u00ed informac\u00ed) \u2014 skript decrypt_derived, kter\u00fd le\u017e\u00ed v \/lib\/cryptsetup\/script\/ (samoz\u0159ejm\u011b existuj\u00ed i dal\u0161\u00ed zp\u016fsoby, ale pr\u00e1v\u011b tyto dva jsem pou\u017eil, co\u017e se stalo z\u00e1kladem \u010dl\u00e1nku). Tak\u00e9 jsem usiloval o plnou autonomn\u00ed aktivaci po restartu, bez jak\u00fdchkoli dal\u0161\u00edch p\u0159\u00edkaz\u016f v konzoli, abych m\u011bl v\u0161e \u201evzh\u016fru\u201c okam\u017eit\u011b. Tak pro\u010d \u010dekat? \u2014 <\/p>\n

Za\u010d\u00edn\u00e1me!<\/p>\n

P\u0159edpokl\u00e1d\u00e1me syst\u00e9m, nap\u0159\u00edklad Debian, nainstalovan\u00fd na crypto-partici sda3_crypt a des\u00edtku disk\u016f p\u0159ipraven\u00fdch k \u0161ifrov\u00e1n\u00ed a vytvo\u0159en\u00ed \u010dehokoli, co si p\u0159ejeme. M\u00e1me kl\u00ed\u010dovou fr\u00e1zi (passphrase) pro odemknut\u00ed sda3_crypt a pr\u00e1v\u011b z t\u00e9to partice budeme na spu\u0161t\u011bn\u00e9m (de\u0161ifrovan\u00e9m) syst\u00e9mu generovat \u201ehash\u201c z hesla a p\u0159id\u00e1vat ho na ostatn\u00ed disky. V\u0161echno je element\u00e1rn\u00ed, v konzoli provedeme:<\/p>\n

\/lib\/cryptsetup\/scripts\/decrypt_derived sda3_crypt | cryptsetup luksFormat \/dev\/sdX<\/code><\/pre>\n
\nkde X jsou na\u0161e disky, partition a tak d\u00e1le.<\/p>\n
Po \u0161ifrov\u00e1n\u00ed disk\u016f \u201eheshem\u201c na\u0161\u00ed kl\u00ed\u010dov\u00e9 fr\u00e1ze je nutn\u00e9 zjistit UUID nebo ID \u2014 podle toho, co kdo preferuje. Bereme data z \/dev\/disk\/by-uuid a by-id odpov\u00eddaj\u00edc\u00edmi.<\/p>\n
Dal\u0161\u00edm krokem je p\u0159\u00edprava soubor\u016f a mini-skript\u016f pro pot\u0159ebn\u00e9 funkce, za\u010d\u00edn\u00e1me:<\/p>\n
cp -p \/usr\/share\/initramfs-tools\/hooks\/cryptroot \/etc\/initramfs-tools\/hooks\/\ncp -p \/usr\/share\/initramfs-tools\/scripts\/local-top\/cryptroot \/etc\/initramfs-tools\/scripts\/local-top\/<\/code><\/pre>\n
\nd\u00e1le<\/p>\n
touch \/etc\/initramfs-tools\/hooks\/decrypt && chmod +x \/etc\/initramfs-tools\/hooks\/decrypt<\/code><\/pre>\n
\nObsah .. \/decrypt<\/b><\/p>\n
#!\/bin\/sh\n\ncp -p \/lib\/cryptsetup\/scripts\/decrypt_derived \"$DESTDIR\/bin\/decrypt_derived\"<\/code><\/pre>\n
d\u00e1le<\/p>\n
touch \/etc\/initramfs-tools\/hooks\/partcopy && chmod +x \/etc\/initramfs-tools\/hooks\/partcopy<\/code><\/pre>\n
\nObsah .. \/partcopy<\/b><\/p>\n
#!\/bin\/sh\n\ncp -p \/sbin\/partprobe \"$DESTDIR\/bin\/partprobe\"\ncp -p \/lib\/x86_64-linux-gnu\/libparted.so.2 \"$DESTDIR\/lib\/x86_64-linux-gnu\/libparted.so.2\"\ncp -p \/lib\/x86_64-linux-gnu\/libreadline.so.7 \"$DESTDIR\/lib\/x86_64-linux-gnu\/libreadline.so.7\"<\/code><\/pre>\n
je\u0161t\u011b trochu<\/p>\n
touch \/etc\/initramfs-tools\/scripts\/local-bottom\/partprobe && chmod +x \/etc\/initramfs-tools\/scripts\/local-bottom\/partprobe<\/code><\/pre>\n
\nObsah .. \/partprobe<\/b><\/p>\n
#!\/bin\/sh\n\n$DESTDIR\/bin\/partprobe<\/code><\/pre>\n
a posledn\u00ed v\u011bc, p\u0159ed update-initramfs, je pot\u0159eba upravit soubor \/etc\/initramfs-tools\/scripts\/local-top\/cryptroot, za\u010d\u00ednaj\u00edc\u00ed od \u0159\u00e1dku ~360, kousek k\u00f3du n\u00ed\u017ee<\/p>\n
Origin\u00e1l<\/b><\/p>\n
\n                # decrease $count by 1, apparently last try was successful.\n                count=$(( $count - 1 ))\n                \n                message \"cryptsetup ($crypttarget): set up successfully\"\n                break\n<\/code><\/pre>\n
a p\u0159iv\u00e9st k tomuto form\u00e1tu<\/p>\n
Upraven\u00fd<\/b><\/p>\n
\n                # decrease $count by 1, apparently last try was successful.\n                count=$(( $count - 1 ))\n                \n\n                \/bin\/decrypt_derived $crypttarget | cryptsetup luksOpen \/dev\/disk\/by-uuid\/ *CRYPT_MAP*\n                \/bin\/decrypt_derived $crypttarget | cryptsetup luksOpen \/dev\/disk\/by-id\/ *CRYPT_MAP*\n\n                message \"cryptsetup ($crypttarget): set up successfully\"\n                break<\/code><\/pre>\n
V\u0161imn\u011bte si, \u017ee zde lze pou\u017e\u00edt bu\u010f UUID, nebo ID. Hlavn\u011b, aby pot\u0159ebn\u00e9 ovlada\u010de na za\u0159\u00edzen\u00edch HDD\/SSD byly p\u0159id\u00e1ny do \/etc\/initramfs-tools\/modules. Zjistit pou\u017e\u00edvan\u00fd ovlada\u010d lze p\u0159\u00edkazem udevadm info -a -n \/dev\/sdX | egrep 'looking|DRIVER'<\/i>.<\/p>\n
Te\u010f, kdy\u017e jsme hotovi a v\u0161echny soubory jsou na sv\u00e9m m\u00edst\u011b, spou\u0161t\u00edme update-initramfs -u -k all -v<\/i>, v logov\u00e1n\u00ed by nem\u011bly b\u00fdt<\/b> chyby vykon\u00e1v\u00e1n\u00ed na\u0161ich skript\u016f. Restartujeme, zad\u00e1me kl\u00ed\u010dovou fr\u00e1zi a trochu po\u010dk\u00e1me, v z\u00e1vislosti na po\u010dtu disk\u016f. Pot\u00e9 se syst\u00e9m spust\u00ed a ve fin\u00e1ln\u00ed f\u00e1zi spu\u0161t\u011bn\u00ed, konkr\u00e9tn\u011b po \u201emountov\u00e1n\u00ed\u201c root-partice, se provede p\u0159\u00edkaz partprobe \u2014 ten najde a p\u0159ipoj\u00ed v\u0161echny vytvo\u0159en\u00e9 partition na LUKS za\u0159\u00edzen\u00edch a jak\u00e9koliv pole, a\u0165 u\u017e ZFS nebo mdadm, se sestav\u00ed bez probl\u00e9m\u016f! A to v\u0161e p\u0159ed na\u010dten\u00edm<\/b> hlavn\u00edch slu\u017eeb a servis\u016f, kter\u00e9 pot\u0159ebuj\u00ed tyto disky\/pole.<\/p>\n
update1<\/b>: Jak poznamenal<\/a><\/noindex> AEP<\/a><\/noindex>, tento zp\u016fsob funguje pouze pro LUKS1.
\n
Zdroj: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u0412\u0441\u0435\u043c \u0434\u043e\u0431\u0440\u043e\u0433\u043e \u0434\u043d\u044f, \u043d\u043e\u0447\u0438! \u042d\u0442\u043e\u0442 \u043f\u043e\u0441\u0442 \u0431\u0443\u0434\u0435\u0442 \u043f\u043e\u043b\u0435\u0437\u0435\u043d \u0442\u0435\u043c, \u043a\u0442\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0434\u0430\u043d\u043d\u044b\u0445 LUKS \u0438 \u0445\u043e\u0447\u0435\u0442 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u044c decrypt\u0434\u0435\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0443 \u0434\u0438\u0441\u043a\u043e\u0432 \u043f\u043e\u0434 Linux (Debian, Ubuntu) \u043d\u0430 \u0441\u0442\u0430\u0434\u0438\u0438 \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0438 root \u0440\u0430\u0437\u0434\u0435\u043b\u0430. \u0418 \u0442\u0430\u043a\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0432 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0435 \u044f \u043d\u0430\u0439\u0442\u0438 \u043d\u0435 \u0441\u043c\u043e\u0433. \u0421\u043e\u0432\u0441\u0435\u043c \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0441 \u0443\u0432\u0435\u043b\u0438\u0447\u0435\u043d\u0438\u0435\u043c \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u0430 \u0434\u0438\u0441\u043a\u043e\u0432 \u0432 \u043f\u043e\u043b\u043a\u0430\u0445, \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0441\u044f \u0441 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u043e\u0439 \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0438 \u0434\u0438\u0441\u043a\u043e\u0432 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0431\u043e\u043b\u0435\u0435 \u0447\u0435\u043c \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e\u0433\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-35652","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Dek\u00f3dov\u00e1n\u00ed LUKS kontejneru p\u0159i spu\u0161t\u011bn\u00ed syst\u00e9mu | ProHoster","description":"V\u0161em dobr\u00fd den, noc! Tento p\u0159\u00edsp\u011bvek bude u\u017eite\u010dn\u00fd pro ty, kte\u0159\u00ed pou\u017e\u00edvaj\u00ed \u0161ifrov\u00e1n\u00ed dat LUKS a cht\u011bj\u00ed de\u0161ifrovat disky pod Linuxem (Debian, Ubuntu) ve st\u00e1diu de\u0161ifrov\u00e1n\u00ed root partition.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/rasshifrovka-luks-kontejnera-v-moment-zagruzki-sistemy","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0430 LUKS \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430 \u0432 \u043c\u043e\u043c\u0435\u043d\u0442 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u044b | ProHoster","og:description":"\u0412\u0441\u0435\u043c \u0434\u043e\u0431\u0440\u043e\u0433\u043e \u0434\u043d\u044f, \u043d\u043e\u0447\u0438! \u042d\u0442\u043e\u0442 \u043f\u043e\u0441\u0442 \u0431\u0443\u0434\u0435\u0442 \u043f\u043e\u043b\u0435\u0437\u0435\u043d \u0442\u0435\u043c, \u043a\u0442\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0434\u0430\u043d\u043d\u044b\u0445 LUKS \u0438 \u0445\u043e\u0447\u0435\u0442 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u044c decrypt\u0434\u0435\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0443 \u0434\u0438\u0441\u043a\u043e\u0432 \u043f\u043e\u0434 Linux (Debian, Ubuntu) \u043d\u0430 \u0441\u0442\u0430\u0434\u0438\u0438 \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0438 root \u0440\u0430\u0437\u0434\u0435\u043b\u0430.","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/rasshifrovka-luks-kontejnera-v-moment-zagruzki-sistemy","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:05:33+00:00","article:modified_time":"2019-10-31T19:05:33+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"35652","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 00:12:43","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:58:29","updated":"2026-01-22 00:12:43","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/35652","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=35652"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/35652\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=35652"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=35652"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=35652"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}