linuxexpert-practice-labs/labs/lpic-3-303/331-3-encrypted-file-systems/README.md

LPIC-3 331.3: Encrypted file systems

LUKS on a spare disk: key slots, a key file, the LUKS1 to LUKS2 conversion, unlocking at boot from crypttab, network-bound unlocking with Clevis and Tang, and an eCryptfs private directory.

Before you start

The lab adds a spare disk, /dev/loop40 (512 MiB, empty). It's an image file under /var/lib/le-lab/disks/, attached again at every boot, before crypttab is read.

The peer, at 10.99.0.2 (name peer), stands in for the other VM and already runs a Tang server on its port 80 (le-lab-peer-tang.socket): curl http://10.99.0.2/adv shows its advertisement.

On Ubuntu, the lab also creates the user crypto (password Lab-Pass-1) for task 5.

Tasks

1. Install cryptsetup if it's missing. Format /dev/loop40 as LUKS1 with the passphrase lab-pass-one, open it as secret, make an ext4 file system on it, mount it on /mnt/secret, and write top secret to /mnt/secret/note.txt.
2. Add a 64-byte random key file, /root/secret.key (mode 400), to a second key slot. Then close the volume and convert it to LUKS2.
3. Unlock and mount the volume at boot the way the system does it: a crypttab entry secret that names the volume by UUID and uses the key file, and an fstab entry that mounts /dev/mapper/secret on /mnt/secret, both with nofail. Start it through systemd and check that note.txt is there.
4. Install Clevis with its LUKS support, and bind the volume to the Tang server at http://10.99.0.2, so that clevis luks unlock opens it with no passphrase while Tang is reachable. The passphrase must still work.
5. Ubuntu: set up an eCryptfs private directory for crypto, wrapped with their login password Lab-Pass-1, that doesn't mount automatically at login. Mount it as crypto, write private data to ~/Private/diary.txt, and unmount it again.

Hints

• cryptsetup luksFormat --type luks1, cryptsetup open, cryptsetup status; echo -n 'lab-pass-one' | cryptsetup ... - reads the passphrase from standard input.
• dd if=/dev/urandom bs=64 count=1, cryptsetup luksAddKey, cryptsetup luksDump, cryptsetup convert --type luks2 (the volume must be closed).
• cryptsetup luksUUID; a crypttab line is name, device, key file, options. systemctl daemon-reload, systemctl start [email protected], mount /mnt/secret.
• clevis luks bind -d DEVICE tang '{"url":"http://10.99.0.2"}', clevis luks list; clevis luks unlock -d DEVICE -n NAME needs the volume closed first.
• ecryptfs-utils, modprobe ecryptfs; su - crypto -c "ecryptfs-setup-private --nopwcheck --noautomount ...". To mount without a terminal, ecryptfs-insert-wrapped-passphrase-into-keyring ~/.ecryptfs/wrapped-passphrase - with the login password on standard input, then /sbin/mount.ecryptfs_private; /sbin/umount.ecryptfs_private.