{"id":35652,"date":"2019-10-31T22:05:33","date_gmt":"2019-10-31T19:05:33","guid":{"rendered":"https:\/\/prohoster.info\/blog\/rasshifrovka-luks-kontejnera-v-moment-zagruzki-sistemy\/"},"modified":"2019-10-31T22:05:33","modified_gmt":"2019-10-31T19:05:33","slug":"rasshifrovka-luks-kontejnera-v-moment-zagruzki-sistemy","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/rasshifrovka-luks-kontejnera-v-moment-zagruzki-sistemy","title":{"rendered":"LUKS-konteineri dekr\u00fcpteerimine s\u00fcsteemi k\u00e4ivitamise ajal","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Tere k\u00f5igile, olgu p\u00e4ev v\u00f5i \u00f6\u00f6! See postitus on kasulik neile, kes kasutavad LUKS-andmete kr\u00fcpteerimist ja soovivad Linuxis (Debian, Ubuntu) kettasid dekr\u00fcpteerida root-partitsiooni dekr\u00fcpteerimise etapis<\/b>. Sellist teavet internetist ei leidnud.<\/p>\n

Hiljuti, seoses kettade arvu suurenemisega riiulitel, sattusin probleemile, et dekodeerida kettaid tuntud meetodi kaudu \/etc\/crypttab. Isiklikult toin v\u00e4lja mitu probleemi selle meetodi kasutamisel, nimelt see, et faili loetakse ainult p\u00e4rast root-partitsiooni laadimist<\/b>, mis m\u00f5jutab negatiivselt ZFS-i importimist, eriti kui need on koostatud *_crypt seadmetelt v\u00f5i mdadm RAID-idelt, mis on samuti koostatud partitsioonidelt. Me k\u00f5ik teame, et LUKS-konteinerite puhul saab kasutada parted'i?<\/i> Ja samuti on probleem varase k\u00e4ivitamisega teiste teenuste puhul, kui massiive ei ole veel, aga kasutama<\/b> kui juba on midagi vajalik (t\u00f6\u00f6tan klastritud Proxmox VE 5.x ja ZFS \u00fcle iSCSI).<\/p>\n

Veidi ZFS over iSCSI-st<\/b>iSCSI t\u00f6\u00f6tab mul l\u00e4bi LIO ja kui iscsi-k_target k\u00e4ivitub ning ei n\u00e4e ZVOL seadmeid, siis eemaldab ta need lihtsalt konfiguratsioonist, mis ei v\u00f5imalda k\u00fclaliss\u00fcsteemidel k\u00e4ivituda. Sellest tulenevalt on kas json-faili varundamine v\u00f5i seadmete k\u00e4sitsi lisamine iga VM-i identifikaatoritega, mis on lihtsalt kohutav, kui selliseid masinaid on k\u00fcmneid ja iga konfiguratsioonis rohkem kui 1 ketas.<\/p>\n

Ja teine k\u00fcsimus, mida k\u00e4sitlen, on see, millega dekr\u00fcpteerida (see on artikli v\u00f5tme punkt). Ja sellest r\u00e4\u00e4gime allpool, tulge lugema!
\n<\/a><\/noindex>
\nSageli kasutatakse internetis v\u00f5tme faili (loomulikult eelnevalt antud slotti k\u00e4suga \u2014 cryptsetup luksAddKey), v\u00f5i harvadel juhtudel (venekeelses internetis on teave v\u00e4ga piiratud) \u2014 skripti decrypt_derived, mis asub \/lib\/cryptsetup\/script\/ (loomulikult on veel meetodeid, kuid ma kasutasin just neid kahte, mis on artikli aluseks). Samuti sihiksin t\u00e4ielikku autonoomset k\u00e4ivitamist p\u00e4rast taask\u00e4ivitusi, ilma et peaksin terminalis t\u00e4iendavalt k\u00e4ske sisestama, et k\u00f5ik minu jaoks kohe \u201et\u00f6\u00f6taks\u201d. Nii et, miks oodata? \u2014 <\/p>\n

Alustame!<\/p>\n

Oletame, et meil on s\u00fcsteem, n\u00e4iteks Debian, paigaldatud kr\u00fcpteeritud osale sda3_crypt ja tosin ketast, mis on valmis kr\u00fcpteerimiseks ja mille kohta on k\u00f5ik, mida s\u00fcdame soovib. Meil on v\u00f5tme fraas (passphrase) sda3_crypti avamiseks ja just sellest osast me v\u00f5tame t\u00f6\u00f6tava (dekr\u00fcpteeritud) s\u00fcsteemi pealt paroolilt \u201ehashi\u201d ja lisame selle teistele ketastele. K\u00f5ik on elementaarne, sisestame konsoolis:<\/p>\n

\/lib\/cryptsetup\/scripts\/decrypt_derived sda3_crypt | cryptsetup luksFormat \/dev\/sdX<\/code><\/pre>\n
\nkus X on meie kettad, osad jne.<\/p>\n
P\u00e4rast ketaste kr\u00fcpteerimist meie v\u00f5tme-fraasi \u201eheshiga\u201d on vajalik teada UUID-d v\u00f5i ID-d \u2014 s\u00f5ltuvalt sellest, kes ja millega harjunud on. Saame andmed aadressilt \/dev\/disk\/by-uuid ja by-id vastavalt.<\/p>\n
J\u00e4rgmiseks etapiks on failide ja mini-skriptide ettevalmistamine, et meie vajalikud funktsioonid t\u00f6\u00f6taksid, alustame:<\/p>\n
cp -p \/usr\/share\/initramfs-tools\/hooks\/cryptroot \/etc\/initramfs-tools\/hooks\/ \ncp -p \/usr\/share\/initramfs-tools\/scripts\/local-top\/cryptroot \/etc\/initramfs-tools\/scripts\/local-top\/<\/code><\/pre>\n
\nedasi<\/p>\n
touch \/etc\/initramfs-tools\/hooks\/decrypt && chmod +x \/etc\/initramfs-tools\/hooks\/decrypt<\/code><\/pre>\n
\nSisu ..decrypt<\/b><\/p>\n
#!\/bin\/sh\n\ncp -p \/lib\/cryptsetup\/scripts\/decrypt_derived \"$DESTDIR\/bin\/decrypt_derived\"<\/code><\/pre>\n
edasi<\/p>\n
touch \/etc\/initramfs-tools\/hooks\/partcopy && chmod +x \/etc\/initramfs-tools\/hooks\/partcopy<\/code><\/pre>\n
\nSisu ..partcopy<\/b><\/p>\n
#!\/bin\/sh\n\ncp -p \/sbin\/partprobe \"$DESTDIR\/bin\/partprobe\"\ncp -p \/lib\/x86_64-linux-gnu\/libparted.so.2 \"$DESTDIR\/lib\/x86_64-linux-gnu\/libparted.so.2\"\ncp -p \/lib\/x86_64-linux-gnu\/libreadline.so.7 \"$DESTDIR\/lib\/x86_64-linux-gnu\/libreadline.so.7\"<\/code><\/pre>\n
veel natuke<\/p>\n
touch \/etc\/initramfs-tools\/scripts\/local-bottom\/partprobe && chmod +x \/etc\/initramfs-tools\/scripts\/local-bottom\/partprobe<\/code><\/pre>\n
\nSisu ..partprobe<\/b><\/p>\n
#!\/bin\/sh\n\n$DESTDIR\/bin\/partprobe<\/code><\/pre>\n
ja viimane, enne update-initramfs-i, peame redigeerima faili \/etc\/initramfs-tools\/scripts\/local-top\/cryptroot, alustades reast ~360, allpool olev koodin\u00e4ide<\/p>\n
Originaal<\/b><\/p>\n
\n                # decrease $count by 1, apparently last try was successful.\n                count=$(( $count - 1 ))\n                \n                message \"cryptsetup ($crypttarget): set up successfully\"\n                break\n<\/code><\/pre>\n
ja viima sellisesse vormi<\/p>\n
Redigeeritud<\/b><\/p>\n
\n                # decrease $count by 1, apparently last try was successful.\n                count=$(( $count - 1 ))\n                \n\n                \/bin\/decrypt_derived $crypttarget | cryptsetup luksOpen \/dev\/disk\/by-uuid\/ *CRYPT_MAP*\n                \/bin\/decrypt_derived $crypttarget | cryptsetup luksOpen \/dev\/disk\/by-id\/ *CRYPT_MAP*\n\n                message \"cryptsetup ($crypttarget): set up successfully\"\n                break<\/code><\/pre>\n
Pange t\u00e4hele, et siin saab kasutada nii UUID-d kui ka ID-d. Oluline on, et vajalikud draiverid HDD\/SSD seadmetele oleksid lisatud \/etc\/initramfs-tools\/modules. Kasutatava draiveri selgitamiseks saab kasutada k\u00e4sku udevadm info -a -n \/dev\/sdX | egrep 'looking|DRIVER'<\/i>.<\/p>\n
N\u00fc\u00fcd, kui oleme l\u00f5petanud ja k\u00f5ik failid on kohal, k\u00e4ivitame update-initramfs -u -k all -v<\/i>, logimises ei tohi olla<\/b> meie skriptide t\u00e4itmise vigu. Taask\u00e4ivitame, sisestame v\u00f5tme-fraasi ja ootame natuke, s\u00f5ltuvalt ketaste arvust. Edasi k\u00e4ivitub s\u00fcsteem ja k\u00e4ivitamise l\u00f5ppstaadiumis, nimelt p\u00e4rast root-osade \u201emountimist\u201d, t\u00e4idetakse k\u00e4sk partprobe \u2014 see leiab ja \u00fchendab k\u00f5ik LUKS seadmetes loodud osad ning k\u00f5ik massiivid, olgu need ZFS v\u00f5i mdadm, koosnevad ilma probleemideta! Ja k\u00f5ik see enne p\u00f5hiteenuste ja -teenuste laadimist, mis vajavad neid kettaid\/massiive.<\/b> update1<\/p>\n
: Kuidas<\/b>AEP , et tihti ei kasutata nende lihtsate toimingute t\u00e4itmiseks k\u00f5ige optimaalsemaid lahendusi: alates<\/a><\/noindex> , see meetod t\u00f6\u00f6tab ainult LUKS1 jaoks.<\/a><\/noindex>Windows, PowerShell ja pikad teed
\n
Allikas: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u0412\u0441\u0435\u043c \u0434\u043e\u0431\u0440\u043e\u0433\u043e \u0434\u043d\u044f, \u043d\u043e\u0447\u0438! \u042d\u0442\u043e\u0442 \u043f\u043e\u0441\u0442 \u0431\u0443\u0434\u0435\u0442 \u043f\u043e\u043b\u0435\u0437\u0435\u043d \u0442\u0435\u043c, \u043a\u0442\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0434\u0430\u043d\u043d\u044b\u0445 LUKS \u0438 \u0445\u043e\u0447\u0435\u0442 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u044c decrypt\u0434\u0435\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0443 \u0434\u0438\u0441\u043a\u043e\u0432 \u043f\u043e\u0434 Linux (Debian, Ubuntu) \u043d\u0430 \u0441\u0442\u0430\u0434\u0438\u0438 \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0438 root \u0440\u0430\u0437\u0434\u0435\u043b\u0430. \u0418 \u0442\u0430\u043a\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0432 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0435 \u044f \u043d\u0430\u0439\u0442\u0438 \u043d\u0435 \u0441\u043c\u043e\u0433. \u0421\u043e\u0432\u0441\u0435\u043c \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0441 \u0443\u0432\u0435\u043b\u0438\u0447\u0435\u043d\u0438\u0435\u043c \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u0430 \u0434\u0438\u0441\u043a\u043e\u0432 \u0432 \u043f\u043e\u043b\u043a\u0430\u0445, \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0441\u044f \u0441 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u043e\u0439 \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0438 \u0434\u0438\u0441\u043a\u043e\u0432 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0431\u043e\u043b\u0435\u0435 \u0447\u0435\u043c \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e\u0433\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-35652","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 LUKS konteineri dekodeerimine s\u00fcsteemi k\u00e4ivitamise hetkel | ProHoster","description":"Tere p\u00e4evast, \u00f6\u00f6st! See postitus on kasulik neile, kes kasutavad LUKS-andmete kr\u00fcpteerimist ja soovivad Linuxis (Debian, Ubuntu) dekodeerida kettaruume root jaotises.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/rasshifrovka-luks-kontejnera-v-moment-zagruzki-sistemy","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0430 LUKS \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430 \u0432 \u043c\u043e\u043c\u0435\u043d\u0442 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u044b | ProHoster","og:description":"\u0412\u0441\u0435\u043c \u0434\u043e\u0431\u0440\u043e\u0433\u043e \u0434\u043d\u044f, \u043d\u043e\u0447\u0438! \u042d\u0442\u043e\u0442 \u043f\u043e\u0441\u0442 \u0431\u0443\u0434\u0435\u0442 \u043f\u043e\u043b\u0435\u0437\u0435\u043d \u0442\u0435\u043c, \u043a\u0442\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0434\u0430\u043d\u043d\u044b\u0445 LUKS \u0438 \u0445\u043e\u0447\u0435\u0442 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u044c decrypt\u0434\u0435\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0443 \u0434\u0438\u0441\u043a\u043e\u0432 \u043f\u043e\u0434 Linux (Debian, Ubuntu) \u043d\u0430 \u0441\u0442\u0430\u0434\u0438\u0438 \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0438 root \u0440\u0430\u0437\u0434\u0435\u043b\u0430.","og:url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/rasshifrovka-luks-kontejnera-v-moment-zagruzki-sistemy","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:05:33+00:00","article:modified_time":"2019-10-31T19:05:33+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"35652","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 00:12:43","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:58:29","updated":"2026-01-22 00:12:43","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/35652","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=35652"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/35652\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=35652"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=35652"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=35652"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}