How to create an encrypted filesystem on RHEL 5
- nirmalpathak's blog
- Login or register to post comments
The existing filesystem can not be encrypted. The procedure of creating an encrypted filesystem will ERASE your existing data on fileystem.
For creating an encrypted filesystem special modules needs to be added. We need to create a mapping between existing filesystem and encrypted filesystem to let system understand about the encrypted filesystem.
Following are the steps to create an encrypted filesystem.
---->
Install needed packages :
# yum install cryptsetup
Load modules (if needed) :
# modprobe aes
# modprobe dm_mod
# modprobe dm_crypt
LUKS on a free partition :
# cryptsetup luksFormat -c aes -h sha256
This would erase any data on the partition !
THE PARTITION SHOULD NOT BE MOUNTED, if so “umount ″
Formating the newly created partition :
# cryptsetup luksOpen secure
# mkfs.ext3 /dev/mapper/secure
where “secure” is the name given to the encrypted partition. it would result in a device name like /dev/mapper/secure
Mount manually into the /secure directory :
mount -t ext3 /dev/mapper/secure /secure
Unmount :
# umount /secure
# cryptsetup luksClose secure
Automatically mounting at boot :
Edit /etc/crypttab like this :
secure none luks
Edit /etc/fstab file like this :
/dev/mapper/secure /secure ext3 defaults 0 1
You would be prompted for the LUKS password at each boot.
---->
Creating Encrypted Swap Space on RHEL 5
1- Setup the encrypted partition
#swapoff -a
#cryptsetup -h sha256 -c aes-cbc-essiv:sha256 -s 256 luksFormat /dev/hda2
#cryptsetup luksOpen /dev/hda2 cswap
#mkswap /dev/mapper/cswap
2- Add this line to /etc/crypttab:
#cswap /dev/hda2 none swap,luks,timeout=30
3- Set the swap partition to be this in /etc/fstab:
#/dev/mapper/cswap none swap defaults 0 0