{"id":35652,"date":"2019-10-31T22:05:33","date_gmt":"2019-10-31T19:05:33","guid":{"rendered":"https:\/\/prohoster.info\/blog\/rasshifrovka-luks-kontejnera-v-moment-zagruzki-sistemy\/"},"modified":"2019-10-31T22:05:33","modified_gmt":"2019-10-31T19:05:33","slug":"rasshifrovka-luks-kontejnera-v-moment-zagruzki-sistemy","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/rasshifrovka-luks-kontejnera-v-moment-zagruzki-sistemy","title":{"rendered":"Dezvoltarea containerului LUKS \u00een momentul ini\u021bializ\u0103rii sistemului","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Bun\u0103 ziua, bun\u0103 seara! Acest post va fi util celor care folosesc criptarea datelor LUKS \u0219i doresc s\u0103 decripteze discurile pe Linux (Debian, Ubuntu) \u00een stadiul de decriptare a part\u021biei root<\/b>. \u0218i astfel de informa\u021bii nu am reu\u0219it s\u0103 g\u0103sesc pe internet.<\/p>\n

Recent, cu cre\u0219terea num\u0103rului de discuri din rafturi, m-am confruntat cu problema decript\u0103rii discurilor folosind metoda bine cunoscut\u0103 prin \/etc\/crypttab. Personal, eviden\u021biez c\u00e2teva probleme legate de utilizarea acestei metode, \u0219i anume, c\u0103 fi\u0219ierul este citit doar dup\u0103 \u00eenc\u0103rcarea (mount) a part\u021biei root<\/b>, ceea ce afecteaz\u0103 negativ importul ZFS, \u00een special dac\u0103 acestea au fost create din parti\u021bii pe un dispozitiv *_crypt, sau din raid-uri mdadm, create de asemenea din parti\u021bii. \u0218tim cu to\u021bii c\u0103 se poate utiliza parted pe containere LUKS?<\/i> \u0218i exist\u0103 \u0219i problema pornirii timpurii a altor servicii, c\u00e2nd array-urile nu sunt \u00eenc\u0103 disponibile, dar folosi<\/b> deja este necesar ceva (lucrez cu Proxmox VE 5.x clustering \u0219i ZFS peste iSCSI).<\/p>\n

Pu\u021bin despre ZFS over iSCSI<\/b>iSCSI func\u021bioneaz\u0103 pentru mine prin LIO, iar c\u00e2nd se ini\u021biaz\u0103 iscsi-target-ul \u0219i nu vede dispozitivele ZVOL, pur \u0219i simplu le \u0219terge din configura\u021bie, ceea ce nu permite sistemelor gazd\u0103 s\u0103 porneasc\u0103. De aici apare fie restaurarea fi\u0219ierului de backup json, fie ad\u0103ugarea manual\u0103 a dispozitivelor cu identificatorii fiec\u0103rei VM, ceea ce este pur \u0219i simplu groaznic, c\u00e2nd exist\u0103 zeci de ma\u0219ini \u0219i \u00een configura\u021bia fiec\u0103rei mai mult de 1 disc.<\/p>\n

\u0218i a doua \u00eentrebare pe care o voi analiza este cu ce lucru pentru a decripta (acesta este momentul cheie al articolului). \u0218i despre aceasta vom discuta mai jos, intra\u021bi \u00een detalii!
\n<\/a><\/noindex>
\nCel mai adesea, pe internet se folose\u0219te un fi\u0219ier cheie (bine\u00een\u021beles, ad\u0103ugat mai \u00eenainte \u00een slot cu comanda \u2014 cryptsetup luksAddKey), sau \u00een cazuri rare (informa\u021biile \u00een limba rom\u00e2n\u0103 sunt foarte limitate) \u2014 scriptul decrypt_derived, care se afl\u0103 \u00een \/lib\/cryptsetup\/script\/ (desigur, exist\u0103 \u0219i alte metode, dar eu am utilizat exact aceste dou\u0103, care au stat la baza articolului). De asemenea, am vizat o activare complet autonom\u0103 dup\u0103 reporniri, f\u0103r\u0103 comenzi suplimentare \u00een consol\u0103, astfel \u00eenc\u00e2t totul s\u0103 \u201edecoleze\u201d imediat. De aceea, de ce s\u0103 a\u0219tept\u0103m? \u2014 <\/p>\n

S\u0103 \u00eencepem!<\/p>\n

Presupunem un sistem, de exemplu Debian, instalat pe part\u021bia criptat\u0103 sda3_crypt \u0219i o duzin\u0103 de discuri preg\u0103tite pentru criptare \u0219i crearea a ceea ce ne dorim. Avem o fraz\u0103 cheie (passphrase) pentru deblocarea sda3_crypt \u0219i de pe aceast\u0103 part\u021bie vom extrage \u201ehash\u201d-ul parolei de pe sistemul pornit (decriptat) \u0219i \u00eel vom ad\u0103uga pe celelalte discuri. Totul este simplu, \u00een consol\u0103 execut\u0103m:<\/p>\n

\/lib\/cryptsetup\/scripts\/decrypt_derived sda3_crypt | cryptsetup luksFormat \/dev\/sdX<\/code><\/pre>\n
\nunde X este discurile, parti\u021biile etc.<\/p>\n
Dup\u0103 criptarea discurilor cu \u201ehash\u201d-ul de la fraza noastr\u0103 cheie, trebuie s\u0103 afl\u0103m UUID sau ID \u2014 depinde de preferin\u021be. Lu\u0103m datele din \/dev\/disk\/by-uuid \u0219i by-id respectiv.<\/p>\n
Urm\u0103torul pas este preg\u0103tirea fi\u0219ierelor \u0219i mini-scripturilor pentru func\u021biile necesare, s\u0103 \u00eencepem:<\/p>\n
cp -p \/usr\/share\/initramfs-tools\/hooks\/cryptroot \/etc\/initramfs-tools\/hooks\/\ncp -p \/usr\/share\/initramfs-tools\/scripts\/local-top\/cryptroot \/etc\/initramfs-tools\/scripts\/local-top\/<\/code><\/pre>\n
\napoi<\/p>\n
touch \/etc\/initramfs-tools\/hooks\/decrypt && chmod +x \/etc\/initramfs-tools\/hooks\/decrypt<\/code><\/pre>\n
\nCon\u021binutul ..\/decrypt<\/b><\/p>\n
#!\/bin\/sh\n\ncp -p \/lib\/cryptsetup\/scripts\/decrypt_derived \"$DESTDIR\/bin\/decrypt_derived\"<\/code><\/pre>\n
apoi<\/p>\n
touch \/etc\/initramfs-tools\/hooks\/partcopy && chmod +x \/etc\/initramfs-tools\/hooks\/partcopy<\/code><\/pre>\n
\nCon\u021binutul ..\/partcopy<\/b><\/p>\n
#!\/bin\/sh\n\ncp -p \/sbin\/partprobe \"$DESTDIR\/bin\/partprobe\"\ncp -p \/lib\/x86_64-linux-gnu\/libparted.so.2 \"$DESTDIR\/lib\/x86_64-linux-gnu\/libparted.so.2\"\ncp -p \/lib\/x86_64-linux-gnu\/libreadline.so.7 \"$DESTDIR\/lib\/x86_64-linux-gnu\/libreadline.so.7\"<\/code><\/pre>\n
\u00eenc\u0103 pu\u021bin<\/p>\n
touch \/etc\/initramfs-tools\/scripts\/local-bottom\/partprobe && chmod +x \/etc\/initramfs-tools\/scripts\/local-bottom\/partprobe<\/code><\/pre>\n
\nCon\u021binutul ..\/partprobe<\/b><\/p>\n
#!\/bin\/sh\n\n$DESTDIR\/bin\/partprobe<\/code><\/pre>\n
\u0219i \u00een final, \u00eenainte de update-initramfs, trebuie s\u0103 edit\u0103m fi\u0219ierul \/etc\/initramfs-tools\/scripts\/local-top\/cryptroot, \u00eencep\u00e2nd de la linia ~360, fragment de cod mai jos<\/p>\n
Original<\/b><\/p>\n
\n                # decrease $count by 1, apparently last try was successful.\n                count=$(( $count - 1 ))\n                \n                message \"cryptsetup ($crypttarget): set up successfully\"\n                break\n<\/code><\/pre>\n
\u0219i \u00eel transform\u0103m \u00eentr-o form\u0103 similar\u0103<\/p>\n
Editat<\/b><\/p>\n
\n                # decrease $count by 1, apparently last try was successful.\n                count=$(( $count - 1 ))\n                \n\n                \/bin\/decrypt_derived $crypttarget | cryptsetup luksOpen \/dev\/disk\/by-uuid\/ *CRYPT_MAP*\n                \/bin\/decrypt_derived $crypttarget | cryptsetup luksOpen \/dev\/disk\/by-id\/ *CRYPT_MAP*\n\n                message \"cryptsetup ($crypttarget): set up successfully\"\n                break<\/code><\/pre>\n
Re\u021bine\u021bi c\u0103 aici se poate folosi fie UUID, fie ID. Cel mai important este ca driverele necesare pentru dispozitivele HDD\/SSD s\u0103 fie incluse \u00een \/etc\/initramfs-tools\/modules. Pentru a afla driverul utilizat, se poate folosi comanda udevadm info -a -n \/dev\/sdX | egrep 'looking|DRIVER'<\/i>.<\/p>\n
Acum, c\u00e2nd am terminat \u0219i toate fi\u0219ierele sunt la locul lor, pornim update-initramfs -u -k all -v<\/i>, \u00een logare nu ar trebui s\u0103 existe<\/b> erori \u00een execu\u021bia scripturilor noastre. Facem o repornire, introducem fraza cheie \u0219i a\u0219tept\u0103m pu\u021bin, \u00een func\u021bie de num\u0103rul discurilor. Ulterior, sistemul se va porni \u0219i \u00een etapa final\u0103 de boot, adic\u0103 dup\u0103 \u201emounting\u201d-ul part\u021biei root, va fi executat\u0103 comanda partprobe \u2014 aceasta va g\u0103si \u0219i va ata\u0219a toate parti\u021biile create pe dispozitivele LUKS \u0219i orice array-uri, fie ele ZFS sau mdadm, se vor forma f\u0103r\u0103 probleme! \u0218i toate acestea \u00eenainte de a porni<\/b> serviciile \u0219i procesele principale care necesit\u0103 aceste discuri\/array-uri.<\/p>\n
update1<\/b>: Cum am observat<\/a><\/noindex> AEP<\/a><\/noindex>, aceast\u0103 metod\u0103 func\u021bioneaz\u0103 doar pentru LUKS1.
\n
Sursa: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u0412\u0441\u0435\u043c \u0434\u043e\u0431\u0440\u043e\u0433\u043e \u0434\u043d\u044f, \u043d\u043e\u0447\u0438! \u042d\u0442\u043e\u0442 \u043f\u043e\u0441\u0442 \u0431\u0443\u0434\u0435\u0442 \u043f\u043e\u043b\u0435\u0437\u0435\u043d \u0442\u0435\u043c, \u043a\u0442\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0434\u0430\u043d\u043d\u044b\u0445 LUKS \u0438 \u0445\u043e\u0447\u0435\u0442 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u044c decrypt\u0434\u0435\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0443 \u0434\u0438\u0441\u043a\u043e\u0432 \u043f\u043e\u0434 Linux (Debian, Ubuntu) \u043d\u0430 \u0441\u0442\u0430\u0434\u0438\u0438 \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0438 root \u0440\u0430\u0437\u0434\u0435\u043b\u0430. \u0418 \u0442\u0430\u043a\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0432 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0435 \u044f \u043d\u0430\u0439\u0442\u0438 \u043d\u0435 \u0441\u043c\u043e\u0433. \u0421\u043e\u0432\u0441\u0435\u043c \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0441 \u0443\u0432\u0435\u043b\u0438\u0447\u0435\u043d\u0438\u0435\u043c \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u0430 \u0434\u0438\u0441\u043a\u043e\u0432 \u0432 \u043f\u043e\u043b\u043a\u0430\u0445, \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0441\u044f \u0441 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u043e\u0439 \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0438 \u0434\u0438\u0441\u043a\u043e\u0432 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0431\u043e\u043b\u0435\u0435 \u0447\u0435\u043c \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e\u0433\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-35652","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Decriptarea unui container LUKS \u00een timpul \u00eenc\u0103rc\u0103rii sistemului | ProHoster","description":"Bun\u0103 ziua, noapte tuturor! Aceast\u0103 postare va fi util\u0103 pentru cei care folosesc criptarea datelor LUKS \u0219i doresc s\u0103 decripteze discurile sub Linux (Debian, Ubuntu) \u00een timpul decript\u0103rii parti\u021biei root.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/rasshifrovka-luks-kontejnera-v-moment-zagruzki-sistemy","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0430 LUKS \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430 \u0432 \u043c\u043e\u043c\u0435\u043d\u0442 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u044b | ProHoster","og:description":"\u0412\u0441\u0435\u043c \u0434\u043e\u0431\u0440\u043e\u0433\u043e \u0434\u043d\u044f, \u043d\u043e\u0447\u0438! \u042d\u0442\u043e\u0442 \u043f\u043e\u0441\u0442 \u0431\u0443\u0434\u0435\u0442 \u043f\u043e\u043b\u0435\u0437\u0435\u043d \u0442\u0435\u043c, \u043a\u0442\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0434\u0430\u043d\u043d\u044b\u0445 LUKS \u0438 \u0445\u043e\u0447\u0435\u0442 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u044c decrypt\u0434\u0435\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0443 \u0434\u0438\u0441\u043a\u043e\u0432 \u043f\u043e\u0434 Linux (Debian, Ubuntu) \u043d\u0430 \u0441\u0442\u0430\u0434\u0438\u0438 \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0438 root \u0440\u0430\u0437\u0434\u0435\u043b\u0430.","og:url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/rasshifrovka-luks-kontejnera-v-moment-zagruzki-sistemy","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:05:33+00:00","article:modified_time":"2019-10-31T19:05:33+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"35652","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 00:12:43","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:58:29","updated":"2026-01-22 00:12:43","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/35652","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=35652"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/35652\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=35652"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=35652"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=35652"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}