ืืื ืืึธื ืืื ื ืึทืื ืึทืืขืืขื! ืืขืจ ืคึผืึธืกืื ืืืขื ืืืื ื ืืฆืืง ืคึฟืึทืจ ืืขื ืข ืืืึธืก ื ืืฆื LUKS ืืึทืื ืขื ืงืจืืคึผืฉืึทื ืืื ืืืืื ืฆื ืืขืงืจืืคึผื ืืืกืงืก ืืื ืืขืจ ืืื ืืงืก (ืืขืืืึทื, ืืืื ืื) ืืืืฃ ืืื ืข ืคืื โโืืขืงืจืืคึผืืืึธื ืคืื ืืขืจ ืืืึธืจืฆื ืฆืขืืืืืื ื. ืืื ืืื ืงืขื ื ืืฉื ืืขืคึฟืื ืขื ืึทืืึท ืืื ืคึฟืึธืจืืึทืฆืืข ืืืืฃ ืื ืืื ืืขืจื ืขื.
ืืึทื ืฅ ืืขืฆืื ืก, ืืื ืึท ืคืึทืจืืจืขืกืขืจื ืืื ืื ื ืืืขืจ ืคืื ืืืกืงืก ืืื ืื ืฉืขืืืืขืก, ืืื ืืขืคึผืืึธื ืืขืจื ืื ืคึผืจืึธืืืขื ืคืื ืืขืงืจืืคึผืืื ื ืืืกืงืก ื ืืฆื ืื ืืขืจ ืืื ืืึทืืืืกื ืืืคึฟื ืืืจื /etc/crypttab. ืคึผืขืจืกื ืึทืื, ืืื ืืืืืคึผืื ืงื ืึท ืืืกื ืคืจืืืืขืืขื ืืื ืืขื ืืืคึฟื, ื ืืืืื ืึทื ืื ืืขืงืข ืืื ืืืืขื ืขื ืืืืื ื ืึธื ืืึธืืืื ื (ืืึทืื ืืื ื) ืื ืืืึธืจืฆื ืฆืขืืืืืื ื, ืืืืก ืืื ื ืขืืืืืื ืืคืขืงืืืจื ืืคืก ืืืืคืืจืื, ืืคืจื ืืืื ืืื ืืขื ืขื ืืขืืืืื ืืขืืืืจื ืคืื ืคืืจืืืืืื ืืขื ืืืืฃ ื *_ืงืจืืคื ืืืื, ืืืขืจ ืืืื ืจืืืืก ืืืื ืืขืืืืื ืคืื ืคืืจืืืืืื ืืขื. ืืืจ ืึทืืข ืืืืกื ืึทื ืืืจ ืงืขื ืขื ื ืืฆื ืคึผืึทืจืืึทื ืืืืฃ LUKS ืงืึทื ืืืื ืขืจื, ืจืขืื? ืืื ืืืื ืื ืคึผืจืึธืืืขื ืคืื ืคืจื ืึธื ืืืื ืคืื ืื ืืขืจืข ืืึทืืื ืื ืืขื, ืืืขื ืขืก ืืขื ืขื ืงืืื ืขืจืืื ื ืึธื, ืืื ื ืืฆื ืืื ืฉืืื ืืึทืจืคึฟื ืขืคึผืขืก (ืืื ืืื ืืจืืขืื ืืื ืงืืึทืกืืขืจื Proxmox VE 5.x ืืื ZFS ืืืืขืจ iSCSI).
ื ืืืกื ืืืขืื ZFSoverISCSIiSCSI ืึทืจืืขื ืคึฟืึทืจ ืืืจ ืืืจื LIO, ืืื ืืื ืคืึทืงื, ืืืขื ืื ืืกืงืกื ืฆืื ืกืืึทืจืฅ ืืื ืงืขื ื ืืฉื ืืขื ZVOL ืืขืืืืกืขืก, ืขืก ืคืฉืื ืจืืืืืื ืืื ืคืื ืื ืงืึทื ืคืืืืขืจืืืฉืึทื, ืืืึธืก ืคึผืจืืืืขื ืฅ ืืึทืกื ืกืืกืืขืืขื ืคืื ืืืืื ื. ืืขืจืคืืจ, ืึธืืขืจ ืจืืกืืึธืจืื ื ืื ืืึทืงืึทืคึผ ืืืฉืกืึธื ืืขืงืข, ืึธืืขืจ ืืึทื ืืืึทืื ืึทืืื ื ืืขืืืืกืขืก ืืื ืื ืืืขื ืืืคืืขืจืก ืคืื ืืขืืขืจ VM, ืืืึธืก ืืื ืคืฉืื ืฉืจืขืงืืขื ืืืขื ืขืก ืืขื ืขื ืืึทืืึทื ื ืคืื ืึทืืึท ืืืฉืื ืขื ืืื ืืขืืขืจ ืงืึทื ืคืืืืขืจืืืฉืึทื ืืื ืืขืจ ืืื 1 ืืืกืง.
ืืื ืื ืฆืืืืืืข ืงืฉืื ืืืึธืก ืืื ืืืขื ืืึทืืจืึทืืื ืืื ืืื ืฆื ืืขืงืจืืคึผื (ืืึธืก ืืื ืืขืจ ืฉืืืกื ืคืื ื ืคืื ืืขื ืึทืจืืืงื). ืืื ืืืจ ืืืขืื ืจืขืื ืืืขืื ืืขื ืืื ืื, ืืืื ืฆื ืื ืฉื ืืึทืื!
ืจืืึฟ ืึธืคื ืืืืฃ ืืขืจ ืืื ืืขืจื ืขืฅ, ืืื ื ืืฆื ืึท ืฉืืืกื ืืขืงืข (ืืืึธืก ืืื ืืืืืึธืืึทืืืฉ ืฆืืืขืืขืื ืฆื ืื ืฉืคึผืขืืื ืืื ืื ืืึทืคึฟืขื - cryptsetup luksAddKey), ืึธืืขืจ ืืื ืืขืืื ืืืืกื ืขืืขื (ืขืก ืืื ืืืืขืจ ืงืืืื ืืื ืคึฟืึธืจืืึทืฆืืข ืืืืฃ ืืขืจ ืจืืกืืฉ-ืฉืคึผืจืึทื ืืื ืืขืจื ืขืฅ) - ืื ืืขืงืจืืคึผื_ืืขืจืืืื ืฉืจืืคื, ืืืื ืืื /lib/cryptsetup/script/ (ืคืื ืงืืจืก, ืขืก ืืขื ืขื ืื ืืขืจืข ืืืขืื, ืึธืืขืจ ืืื ืืขืืืืื ื ืื ืฆืืืื, ืืืึธืก ืืื ืืขืืืขื ืื ืืงืขืจ ืคืื ืืขื ืึทืจืืืงื). ืืื ืืืื ืืขืฉืืจืขืื ืคึฟืึทืจ ืคืื ืึธืืึทื ืึทืืึทืก ืึทืงืืึทืืืืืฉืึทื ื ืึธื ืจืขืืึธืึธืฅ, ืึธื ืงืืื ื ืึธื ืงืึทืืึทื ืื ืืื ืื ืงืึทื ืกืึธืื, ืึทืืื ืึทื ืึทืืฅ ืืืึธืื "ื ืขืืขื ืึทืืืขืง" ืคึฟืึทืจ ืืืจ ืืืืื. ืืขืจืืืขืจ, ืืืึธืก ืืืึทืจืื? โ
ืืืืืจ ืื ืืืืืขื!
ืืืจ ืืืขืจื ืขืืขื ืึท ืกืืกืืขื, ืืืฉื ืืขืืืึทื, ืืื ืกืืึทืืืจื ืืืืฃ ืื sda3_crypt ืงืจืืคึผืืึธ ืฆืขืืืืืื ื ืืื ืึท ืืืฅ ืืืกืงืก ืืจืืื ืฆื ืขื ืงืจืืคึผื ืืื ืืึทืื ืืืึธืก ืืืื ืืึทืจืฅ ืืืื. ืืืจ ืืึธืื ืึท ืฉืืืกื ืคืจืึทืืข (ืคึผืึทืกืกืคืจืึทืกืข) ืฆื ืืคืฉืืืกื sda3_crypt ืืื ืขืก ืืื ืคึฟืื ืืขื ืึธืคึผืืืืืื ื ืึทื ืืืจ ืืืขืื ืืึทืืืึทืืืงื ืื "ืืึทืฉ" ืคืื ืื ืคึผืึทืจืึธื ืืืืฃ ืึท ืคืืืกื ืืืง (ืืขืงืจืืคึผืืื) ืกืืกืืขื ืืื ืืืืื ืขืก ืฆื ืื ืืขืจืข ืืืกืงืก. ืึทืืฅ ืืื ืขืืขืืขื ืืึทืจ, ืืื ืื ืงืึทื ืกืึธืื ืืืจ ืืืกืคืืจื:
/lib/cryptsetup/scripts/decrypt_derived sda3_crypt | cryptsetup luksFormat /dev/sdXืืื X ืืื ืืื ืืืขืจ ืืืกืงืก, ืคึผืึทืจืืืฉืึทื ื, ืขืืง.
ื ืึธื ืขื ืงืจืืคึผืืื ื ืื ืืืกืงืก ืืื ืึท ืืึทืฉ ืคึฟืื ืืื ืืืขืจ ืฉืืืกื ืคืจืึทืืข, ืืืจ ืืึทืจืคึฟื ืฆื ืืขืคึฟืื ืขื ืื UUID ืึธืืขืจ ID - ืืืคึผืขื ืืื ื ืืืืฃ ืืืึธืก ืืื ืืขืืืืื ื ืฆื ืืืึธืก. ืืืจ ื ืขืืขื ืืึทืื ืคืื /dev/disk/by-uuid ืืื by-id, ืจืืกืคึผืขืงืืืืืื.
ืืขืจ ืืืืึทืืขืจ ืืื ืข ืืื ืคึผืจืืคึผืขืจืื ื ืืขืงืขืก ืืื ืืื ื-ืกืงืจืืคึผืก ืคึฟืึทืจ ืื ืคืึทื ืืงืฉืึทื ื ืืืึธืก ืืืจ ืืึทืจืคึฟื ืฆื ืึทืจืืขืื, ืืึธืื ืืื ืื ืืืื ืืืืึทืืขืจ:
cp -p /usr/share/initramfs-tools/hooks/cryptroot /etc/initramfs-tools/hooks/
cp -p /usr/share/initramfs-tools/scripts/local-top/cryptroot /etc/initramfs-tools/scripts/local-top/ะดะฐะปะตะต
touch /etc/initramfs-tools/hooks/decrypt && chmod +x /etc/initramfs-tools/hooks/decryptืืื ืืึทืื ืคืื ../ืืขืงืจืืคึผื
#!/bin/sh
cp -p /lib/cryptsetup/scripts/decrypt_derived "$DESTDIR/bin/decrypt_derived"ะดะฐะปะตะต
touch /etc/initramfs-tools/hooks/partcopy && chmod +x /etc/initramfs-tools/hooks/partcopyืืื ืืึทืื ../partcopy
#!/bin/sh
cp -p /sbin/partprobe "$DESTDIR/bin/partprobe"
cp -p /lib/x86_64-linux-gnu/libparted.so.2 "$DESTDIR/lib/x86_64-linux-gnu/libparted.so.2"
cp -p /lib/x86_64-linux-gnu/libreadline.so.7 "$DESTDIR/lib/x86_64-linux-gnu/libreadline.so.7"ืึท ืืืกื ืืขืจ
touch /etc/initramfs-tools/scripts/local-bottom/partprobe && chmod +x /etc/initramfs-tools/scripts/local-bottom/partprobeืืื ืืึทืื ../partprobe
#!/bin/sh
$DESTDIR/bin/partprobeืืื ืืขืกืึธืฃ, ืืืืืขืจ ืืขืจืืืึทื ืืืงื-ืื ืืืจืึทืืคืก, ืืืจ ืืึทืจืคึฟื ืฆื ืจืขืืึทืืืจื ืื ืืขืงืข /etc/initramfs-tools/scripts/local-top/cryptroot, ืกืืึทืจืืื ื ืคืื ืฉืืจื ~360, ืึท ืฉืืืง ืคืื ืงืึธื ืืื ืื
ืึธืจืืืื ืขื
# decrease $count by 1, apparently last try was successful.
count=$(( $count - 1 ))
message "cryptsetup ($crypttarget): set up successfully"
break
ืืื ืืจืขื ืืขื ืขืก ืฆื ืืขื ืคืึธืจืขื
ืขืืืืื
# decrease $count by 1, apparently last try was successful.
count=$(( $count - 1 ))
/bin/decrypt_derived $crypttarget | cryptsetup luksOpen /dev/disk/by-uuid/ *CRYPT_MAP*
/bin/decrypt_derived $crypttarget | cryptsetup luksOpen /dev/disk/by-id/ *CRYPT_MAP*
message "cryptsetup ($crypttarget): set up successfully"
breakืืึทืืขืจืงืื ื ืึทื ืึธืืขืจ UUID ืึธืืขืจ ID ืงืขื ืขื ืืืื ืืขืืืืื ื ืืึธ. ืื ืืืืคึผื ืืึทื ืืื ืึทื ืื ื ืืืืืง ืืจืืืืขืจืก ืคึฟืึทืจ ืืื / ืกืกื ืืขืืืืกืขืก ืืขื ืขื ืืืกืืฃ ืฆื /etc/initramfs-tools/modules. ืืืจ ืงืขื ืขื ืืขืคึฟืื ืขื ืืืืก ืืืึธืก ืฉืึธืคืขืจ ืืื ืืขื ืืฆื ืืื ืืขื ืืึทืคึฟืขื ืืืขืืืึทืื ืืื ืคึฟืึธืจืืึทืฆืืข -a -n /dev/sdX | egrep 'ืงืืงื|ืืจืืืืืขืจ'.
ืืืฆื ืึทื ืืืจ ืืขื ืขื ืคืึทืจืืืง ืืื ืึทืืข ืื ืืขืงืขืก ืืขื ืขื ืืื ืคึผืืึทืฅ, ืืืจ ืืืืคื ืืขืจืืืึทื ืืืงื-ืื ืืืจืึทืืคืก -ื -ืง ืึทืืข -ืื, ืืื ืืึธืืื ื ืืื ื ืืฉื ืืืื ืขืจืจืึธืจืก ืืื ืืขืจ ืืืจืืคืืจืื ื ืคืื ืืื ืืืขืจ ืกืงืจืืคึผืก. ืืืจ ืจืขืืึธืึธื, ืึทืจืืึทื ืื ืฉืืืกื ืคืจืึทืืข ืืื ืืืึทืจืื ืึท ืืืกื, ืืืคึผืขื ืืื ื ืืืืฃ ืื ื ืืืขืจ ืคืื ืืืกืงืก. ืืขืจื ืึธื, ืื ืกืืกืืขื ืืืขื ืึธื ืืืืื ืืื ืืื ืื ืืขืฆื ืกืืึทืืข ืคืื โโืกืืึทืจืืึทืคึผ, ื ืืืืื ื ืึธื "ืืึธืื ืืื ื" ืื ืืืึธืจืฆื ืฆืขืืืืืื ื, ืื ืคึผืึทืจืฅ ืคึผืจืึธืืข ืืึทืคึฟืขื ืืืขื ืืืื ืขืงืกืึทืงืืืืึทื - ืขืก ืืืขื ืืขืคึฟืื ืขื ืืื ืงืืืึทืื ืึทืืข ืืืฉืืคื ืคึผืึทืจืืืฉืึทื ื ืืืืฃ LUKS ืืขืืืืกืขืก ืืื ืงืืื ืขืจืืื, ืืืื ZFS ืึธืืขืจ ืืืื, ืืืขื ืืขื ืคืืจืืืืื ืืืขืจื ืื ืคืจืืืืขืืขื! ืืื ืืึธืก ืึทืืฅ ืืืืืขืจ ืืึธืืืื ื ืื ืืืืคึผื ืืึทืืื ืื ืืก ืืืึธืก ืืึทืจืคึฟื ืื ืืืกืงืก / ืขืจืืื.
ืืขืจืืืึทื ืืืงื1: ืืื , ืืขื ืืืคึฟื ืึทืจืืขื ืืืืื ืคึฟืึทืจ LUKS1.
ืืงืืจ: www.habr.com