{"id":35652,"date":"2019-10-31T22:05:33","date_gmt":"2019-10-31T19:05:33","guid":{"rendered":"https:\/\/prohoster.info\/blog\/rasshifrovka-luks-kontejnera-v-moment-zagruzki-sistemy\/"},"modified":"2019-10-31T22:05:33","modified_gmt":"2019-10-31T19:05:33","slug":"rasshifrovka-luks-kontejnera-v-moment-zagruzki-sistemy","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/rasshifrovka-luks-kontejnera-v-moment-zagruzki-sistemy","title":{"rendered":"LUKS konteineri dekr\u00fcpteerimine s\u00fcsteemi k\u00e4ivitumise ajal","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Tere p\u00e4evast v\u00f5i \u00f6\u00f6st k\u00f5igile! See postitus on kasulik neile, kes kasutavad LUKS andmete kr\u00fcpteerimist ja soovivad dekr\u00fcpteerida kettasid Linuxis (Debian, Ubuntu) root jaotise dekr\u00fcptimise etapis<\/b>. Sellist teavet ei suutnud ma internetist leida.<\/p>\n

Hiljuti, arvestades riiulitel olevate kettaste arvu suurenemist, seisin silmitsi probleemiga kettaste dekr\u00fcpteerimisel tuntud meetodi abil l\u00e4bi \/etc\/crypttab. Mina isiklikult eristaksin mitmeid selle meetodi kasutamise probleeme, nimelt see, et fail loetakse ainult p\u00e4rast root jaotuse laadimist<\/b>, mis m\u00f5jutab negatiivselt ZFS importi, eriti kui need on loodud *_crypt seadme jaotustest v\u00f5i mdadm RAID'idest, mis on samuti loodud jaotustest. Me k\u00f5ik teame, et parted'i saab kasutada LUKS konteinerite jaoks?<\/i> Ja samuti on probleem varajaste muude teenuste k\u00e4ivitamisega, kui massiive veel pole, kuid kasutada<\/b> juba on midagi vajalik (t\u00f6\u00f6tan klasterdatud Proxmox VE 5.x ja ZFS \u00fcle iSCSI).<\/p>\n

Natuke ZFS \u00fcle iSCSI-st<\/b>iSCSI t\u00f6\u00f6tab mul l\u00e4bi LIO, ja kui iscsi-maa k\u00e4ivitub ja ei n\u00e4e ZVOL seadmeid, siis eemaldab ta need lihtsalt konfigureerimisest, mis ei luba k\u00fclalis\u00fcsteemidel k\u00e4ivituda. Seega tuleb kas taastada json faili varukoopia v\u00f5i manuaalselt lisada seadmed iga VM-i identifikaatoritega, mis on lihtsalt kohutav, kui selliseid masinasi on k\u00fcmneid ja igas konfiguratsioonis on rohkem kui 1 ketas.<\/p>\n

Ja teine k\u00fcsimus, mida vaatan, on see, kuidas dekr\u00fcpteerimist teha (see on artikli v\u00f5tmepunkt). R\u00e4\u00e4gime sellest allpool, tulge ja vaadake!
\n<\/a><\/noindex>
\nEnamasti kasutatakse internetis v\u00f5tme faili (loomulikult lisatud enne seda slotiga k\u00e4su \u2014 cryptsetup luksAddKey), v\u00f5i harvadel eranditel (Venekeelses internetis on v\u00e4ga napp informatsioon) \u2014 skripti decrypt_derived, mis asub \/lib\/cryptsetup\/script\/ (loomulikult on ka teisi viise, kuid olen kasutanud just neid kaht, mis said artikli aluseks). samuti p\u00fc\u00fcdsin saavutada t\u00e4ielikku iseseisvat k\u00e4ivitamist p\u00e4rast taask\u00e4ivitusi, ilma lisak\u00e4skudeta konsoolis, et k\u00f5ik \u201et\u00f6\u00f6taks\u201d kohe. Nii et miks oodata? \u2014 <\/p>\n

Alustame!<\/p>\n

Eeldame, et s\u00fcsteem on n\u00e4iteks Debian, mis on installitud kr\u00fcpteeritud partitsioonile sda3_crypt ja meil on k\u00fcmme ketast, mis on kr\u00fcpteerimiseks valmis ja millele saame luua mida iganes soovime. Meil on v\u00f5ti (passphrase), et dekodeerida sda3_crypt ja just sellelt partitsioonilt saame t\u00f6\u00f6tava (dekodeeritud) s\u00fcsteemi parooli \"hash\"'i v\u00f5tta ning lisada see \u00fclej\u00e4\u00e4nud ketastele. K\u00f5ik on elementaarne, sisestame konsoolis:<\/p>\n

\/lib\/cryptsetup\/scripts\/decrypt_derived sda3_crypt | cryptsetup luksFormat \/dev\/sdX<\/code><\/pre>\n
\nkus X \u2014 need on meie kettad, partitsioonid jne.<\/p>\n
P\u00e4rast ketaste kr\u00fcpteerimist meie v\u00f5tme fraasiga on vajalik teada UUID-d v\u00f5i ID-d \u2014 s\u00f5ltuvalt sellest, kes ja millega harjunud on. Saame andmed \/dev\/disk\/by-uuid ja by-id vastavalt.<\/p>\n
J\u00e4rgmine etapp on vajalikud failid ja mini-skriptid t\u00f6\u00f6tamiseks ette valmistada, alustame:<\/p>\n
cp -p \/usr\/share\/initramfs-tools\/hooks\/cryptroot \/etc\/initramfs-tools\/hooks\/\ncp -p \/usr\/share\/initramfs-tools\/scripts\/local-top\/cryptroot \/etc\/initramfs-tools\/scripts\/local-top\/<\/code><\/pre>\n
\nedasi<\/p>\n
touch \/etc\/initramfs-tools\/hooks\/decrypt && chmod +x \/etc\/initramfs-tools\/hooks\/decrypt<\/code><\/pre>\n
\nSisu .. \/decrypt<\/b><\/p>\n
#!\/bin\/sh\n\ncp -p \/lib\/cryptsetup\/scripts\/decrypt_derived \"$DESTDIR\/bin\/decrypt_derived\"<\/code><\/pre>\n
edasi<\/p>\n
touch \/etc\/initramfs-tools\/hooks\/partcopy && chmod +x \/etc\/initramfs-tools\/hooks\/partcopy<\/code><\/pre>\n
\nSisu .. \/partcopy<\/b><\/p>\n
#!\/bin\/sh\n\ncp -p \/sbin\/partprobe \"$DESTDIR\/bin\/partprobe\"\ncp -p \/lib\/x86_64-linux-gnu\/libparted.so.2 \"$DESTDIR\/lib\/x86_64-linux-gnu\/libparted.so.2\"\ncp -p \/lib\/x86_64-linux-gnu\/libreadline.so.7 \"$DESTDIR\/lib\/x86_64-linux-gnu\/libreadline.so.7\"<\/code><\/pre>\n
veel natuke<\/p>\n
touch \/etc\/initramfs-tools\/scripts\/local-bottom\/partprobe && chmod +x \/etc\/initramfs-tools\/scripts\/local-bottom\/partprobe<\/code><\/pre>\n
\nSisu .. \/partprobe<\/b><\/p>\n
#!\/bin\/sh\n\n$DESTDIR\/bin\/partprobe<\/code><\/pre>\n
Ja viimane, enne update-initramfs'i, tuleb redigeerida faili \/etc\/initramfs-tools\/scripts\/local-top\/cryptroot, alates rea ~360, koodil\u00f5ik allpool<\/p>\n
Originaal<\/b><\/p>\n
\n                # decrease $count by 1, apparently last try was successful.\n                count=$(( $count - 1 ))\n                \n                message \"cryptsetup ($crypttarget): set up successfully\"\n                break\n<\/code><\/pre>\n
ja viima sellisesse vormi<\/p>\n
Redigeeritud<\/b><\/p>\n
\n                # decrease $count by 1, apparently last try was successful.\n                count=$(( $count - 1 ))\n                \n\n                \/bin\/decrypt_derived $crypttarget | cryptsetup luksOpen \/dev\/disk\/by-uuid\/ *CRYPT_MAP*\n                \/bin\/decrypt_derived $crypttarget | cryptsetup luksOpen \/dev\/disk\/by-id\/ *CRYPT_MAP*\n\n                message \"cryptsetup ($crypttarget): set up successfully\"\n                break<\/code><\/pre>\n
Pange t\u00e4hele, et siin saab kasutada kas UUID-d v\u00f5i ID-d. Peamine on see, et vajalikud draiverid HDD\/SSD seadmete jaoks oleksid lisatud \/etc\/initramfs-tools\/modules. Kasutatava draiveri saate teada k\u00e4suga udevadm info -a -n \/dev\/sdX | egrep 'looking|DRIVER'<\/i>.<\/p>\n
N\u00fc\u00fcd, kui oleme l\u00f5petanud ja k\u00f5ik failid on paigas, k\u00e4ivitame update-initramfs -u -k all -v<\/i>, logimisel ei tohiks olla<\/b> meie skriptide t\u00e4itmise vigu. Taask\u00e4ivitame, sisestame v\u00f5tmefraasi ja ootame veidi, olenevalt ketaste arvust. Edasi k\u00e4ivitub s\u00fcsteem ja k\u00e4ivitamise l\u00f5ppfaasis, t\u00e4psemalt p\u00e4rast root-partitsiooni \u00abmountimist\u00bb, t\u00e4idetakse k\u00e4sk partprobe \u2014 see leiab ja \u00fchendab k\u00f5ik loodud partitsioonid LUKS seadmetes ning k\u00f5ik massiivid, olgu need ZFS v\u00f5i mdadm, kogunevad probleemideta! Ja k\u00f5ik see enne p\u00f5hiteenusete ja teenuste laadimist, mis vajavad neid kettaid\/massiive.<\/b> peamiste teenuste ja teenuste, mille jaoks neid kettasid\/mahte on vaja.<\/p>\n
update1<\/b>: Kuidas m\u00e4rkas<\/a><\/noindex> AEP<\/a><\/noindex>, see meetod t\u00f6\u00f6tab ainult LUKS1 jaoks.
\n
Allikas: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u0412\u0441\u0435\u043c \u0434\u043e\u0431\u0440\u043e\u0433\u043e \u0434\u043d\u044f, \u043d\u043e\u0447\u0438! \u042d\u0442\u043e\u0442 \u043f\u043e\u0441\u0442 \u0431\u0443\u0434\u0435\u0442 \u043f\u043e\u043b\u0435\u0437\u0435\u043d \u0442\u0435\u043c, \u043a\u0442\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0434\u0430\u043d\u043d\u044b\u0445 LUKS \u0438 \u0445\u043e\u0447\u0435\u0442 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u044c decrypt\u0434\u0435\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0443 \u0434\u0438\u0441\u043a\u043e\u0432 \u043f\u043e\u0434 Linux (Debian, Ubuntu) \u043d\u0430 \u0441\u0442\u0430\u0434\u0438\u0438 \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0438 root \u0440\u0430\u0437\u0434\u0435\u043b\u0430. \u0418 \u0442\u0430\u043a\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0432 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0435 \u044f \u043d\u0430\u0439\u0442\u0438 \u043d\u0435 \u0441\u043c\u043e\u0433. \u0421\u043e\u0432\u0441\u0435\u043c \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0441 \u0443\u0432\u0435\u043b\u0438\u0447\u0435\u043d\u0438\u0435\u043c \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u0430 \u0434\u0438\u0441\u043a\u043e\u0432 \u0432 \u043f\u043e\u043b\u043a\u0430\u0445, \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0441\u044f \u0441 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u043e\u0439 \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0438 \u0434\u0438\u0441\u043a\u043e\u0432 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0431\u043e\u043b\u0435\u0435 \u0447\u0435\u043c \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e\u0433\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-35652","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 LUKS konteineri dekr\u00fcpteerimine s\u00fcsteemi laadimise hetkel | ProHoster","description":"Tere k\u00f5igile! See postitus on kasulik neile, kes kasutavad LUKS-i andmete kr\u00fcpteerimist ja tahavad dekr\u00fcpteerida kettaid Linuxis (Debian, Ubuntu) root jaotise dekr\u00fcpteerimise etapis. Sellist teavet ma internetist ei leidnud. M\u00f5ni aeg tagasi, kui ketaste arv riiulitel suurenes, kohtasin probleemi ketaste dekr\u00fcpteerimisel, kasutades laialdaselt tuntud.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/rasshifrovka-luks-kontejnera-v-moment-zagruzki-sistemy","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0430 LUKS \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430 \u0432 \u043c\u043e\u043c\u0435\u043d\u0442 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u044b | ProHoster","og:description":"\u0412\u0441\u0435\u043c \u0434\u043e\u0431\u0440\u043e\u0433\u043e \u0434\u043d\u044f, \u043d\u043e\u0447\u0438! \u042d\u0442\u043e\u0442 \u043f\u043e\u0441\u0442 \u0431\u0443\u0434\u0435\u0442 \u043f\u043e\u043b\u0435\u0437\u0435\u043d \u0442\u0435\u043c, \u043a\u0442\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0434\u0430\u043d\u043d\u044b\u0445 LUKS \u0438 \u0445\u043e\u0447\u0435\u0442 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u044c decrypt\u0434\u0435\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0443 \u0434\u0438\u0441\u043a\u043e\u0432 \u043f\u043e\u0434 Linux (Debian, Ubuntu) \u043d\u0430 \u0441\u0442\u0430\u0434\u0438\u0438 \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0438 root \u0440\u0430\u0437\u0434\u0435\u043b\u0430. \u0418 \u0442\u0430\u043a\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0432 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0435 \u044f \u043d\u0430\u0439\u0442\u0438 \u043d\u0435 \u0441\u043c\u043e\u0433. \u0421\u043e\u0432\u0441\u0435\u043c \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0441 \u0443\u0432\u0435\u043b\u0438\u0447\u0435\u043d\u0438\u0435\u043c \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u0430 \u0434\u0438\u0441\u043a\u043e\u0432 \u0432 \u043f\u043e\u043b\u043a\u0430\u0445, \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0441\u044f \u0441 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u043e\u0439 \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0438 \u0434\u0438\u0441\u043a\u043e\u0432 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0431\u043e\u043b\u0435\u0435 \u0447\u0435\u043c \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e\u0433\u043e","og:url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/rasshifrovka-luks-kontejnera-v-moment-zagruzki-sistemy","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:05:33+00:00","article:modified_time":"2019-10-31T19:05:33+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"35652","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 00:12:43","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:58:29","updated":"2026-01-22 00:12:43"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/35652","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=35652"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/35652\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=35652"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=35652"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=35652"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}