Initial commit
This commit is contained in:
68
README.debian13
Normal file
68
README.debian13
Normal file
@@ -0,0 +1,68 @@
|
|||||||
|
# ---------------------------------------------------------------------------------------
|
||||||
|
#
|
||||||
|
# Early decrypt partition using systemd-cryptsetup - after upgrade Debian 12 -> Debia 13
|
||||||
|
#
|
||||||
|
# ---------------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
RAW_PARTITION=/dev/md5
|
||||||
|
CRYPT_PARTITION=data
|
||||||
|
KEY_FILE=/etc/cryptsetup-keys.d/data.key
|
||||||
|
|
||||||
|
# 1) cryptsetup-initramfs entfernen
|
||||||
|
# =================================
|
||||||
|
#
|
||||||
|
# (cryptsetup selbst bleibt installiert!)
|
||||||
|
#
|
||||||
|
apt purge cryptsetup-initramfs
|
||||||
|
|
||||||
|
|
||||||
|
# update-initramfs -u -k all sollte nun durchlaufen
|
||||||
|
#
|
||||||
|
update-initramfs -u -k all
|
||||||
|
|
||||||
|
|
||||||
|
# 2) Sicherstellen, dass systemd die crypttab Einträge überhaupt verarbeitet
|
||||||
|
# ===========================================================================
|
||||||
|
#
|
||||||
|
# In Debian wurde systemd-cryptsetup als eigenes Paket aufgeteilt; wenn das fehlt,
|
||||||
|
# werden nicht-root LUKS-Volumes aus /etc/crypttab u.U. nicht automatisch geöffnet.
|
||||||
|
#
|
||||||
|
# Also:
|
||||||
|
#
|
||||||
|
# apt install systemd-cryptsetup
|
||||||
|
#
|
||||||
|
apt install systemd-cryptsetup
|
||||||
|
|
||||||
|
|
||||||
|
# 3) /etc/crypttab anpassen (kein initramfs mehr)
|
||||||
|
# ===============================================
|
||||||
|
#
|
||||||
|
# data UUID=a7e3afb8-f257-4e99-b37a-fdc579ec9e96 /etc/cryptsetup-keys.d/data.key luks,nofail
|
||||||
|
#
|
||||||
|
cat <<EOF >> /etc/crypttab
|
||||||
|
|
||||||
|
# <target name> <source device> <key file> <options>
|
||||||
|
${CRYPT_PARTITION} UUID=a$(blkid -s UUID -o value ${RAW_PARTITION}) ${KEY_FILE} luks,nofail
|
||||||
|
|
||||||
|
EOF
|
||||||
|
|
||||||
|
|
||||||
|
# 4) /etc/fstab
|
||||||
|
# =============
|
||||||
|
#
|
||||||
|
# /dev/mapper/data /data ext4 defaults,nofail,x-systemd.device-timeout=30 0 2
|
||||||
|
#
|
||||||
|
cat <<EOF >> /etc/fstab
|
||||||
|
|
||||||
|
# /dev/mapper/${CRYPT_PARTITION} (LUKS device ${RAW_PARTITION})
|
||||||
|
/dev/mapper/${CRYPT_PARTITION} /data ext4 efaults,nofail,x-systemd.device-timeout=30 0 2
|
||||||
|
EOF
|
||||||
|
|
||||||
|
systemctl daemon-reload
|
||||||
|
|
||||||
|
|
||||||
|
# 5) RAID (md5) muss beim Boot assembliert werden
|
||||||
|
#
|
||||||
|
apt install --reinstall mdadm
|
||||||
|
update-initramfs -u -k all
|
||||||
|
|
||||||
62
create_crypted_disk.sh
Executable file
62
create_crypted_disk.sh
Executable file
@@ -0,0 +1,62 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
|
||||||
|
_BACKUP_DEVICE_NAME=backup
|
||||||
|
_LABEL=BACKUP_OPP_03
|
||||||
|
_KEY_FILE=/crypt/home/.keys/zapata.key
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
# - Encrypt Disk with given keyfile
|
||||||
|
# -
|
||||||
|
echo ""
|
||||||
|
echo "Encrypt Disk with given keyfile"
|
||||||
|
cryptsetup luksFormat /dev/sde1 $_KEY_FILE
|
||||||
|
|
||||||
|
# - Add Key with Passphrase
|
||||||
|
# -
|
||||||
|
echo ""
|
||||||
|
echo "Add Key (Passphrase) using existent key (keyfile: $_KEY_FILE)"
|
||||||
|
cryptsetup luksAddKey -d $_KEY_FILE /dev/sde1
|
||||||
|
|
||||||
|
# - Open encrypted device
|
||||||
|
# -
|
||||||
|
echo ""
|
||||||
|
echo "Open encrypted device"
|
||||||
|
cryptsetup luksOpen /dev/sde1 $_BACKUP_DEVICE_NAME --key-file $_KEY_FILE
|
||||||
|
|
||||||
|
# - Create Filesystem on crypted device
|
||||||
|
# -
|
||||||
|
echo ""
|
||||||
|
echo "Create ext4 Filesystem on crypted device \"$_BACKUP_DEVICE_NAME\""
|
||||||
|
mkfs.ext4 -E lazy_itable_init=0,lazy_journal_init=0 /dev/mapper/$_BACKUP_DEVICE_NAME
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo "Simple sync.."
|
||||||
|
sync
|
||||||
|
|
||||||
|
# - Label crypted device
|
||||||
|
# -
|
||||||
|
echo ""
|
||||||
|
echo "Label crypted device \"$_BACKUP_DEVICE_NAME\". Label: $_LABEL"
|
||||||
|
tune2fs -L $_LABEL /dev/mapper/$_BACKUP_DEVICE_NAME
|
||||||
|
|
||||||
|
# - Set maximal mount count on crypted device
|
||||||
|
# -
|
||||||
|
echo ""
|
||||||
|
echo "Set maximal mount count on crypted device"
|
||||||
|
tune2fs -c 21 /dev/mapper/$_BACKUP_DEVICE_NAME
|
||||||
|
|
||||||
|
# - List settings of crypted device
|
||||||
|
# -
|
||||||
|
echo ""
|
||||||
|
echo "List settings of crypted device \"_BACKUP_DEVICE_NAME\""
|
||||||
|
tune2fs -l /dev/mapper/$_BACKUP_DEVICE_NAME
|
||||||
|
|
||||||
|
# - Close crypted device
|
||||||
|
# -
|
||||||
|
echo ""
|
||||||
|
echo "Close crypted device \"$_BACKUP_DEVICE_NAME\""
|
||||||
|
cryptsetup luksClose $_BACKUP_DEVICE_NAME
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
exit 0
|
||||||
203
cryptodevice.txt
Normal file
203
cryptodevice.txt
Normal file
@@ -0,0 +1,203 @@
|
|||||||
|
## - urls
|
||||||
|
## -
|
||||||
|
http://wiki.ubuntuusers.de/System_verschl%C3%BCsseln
|
||||||
|
http://de.gentoo-wiki.com/DM-Crypt
|
||||||
|
|
||||||
|
## --------------------------------------------------------- ##
|
||||||
|
## - In welchem Slot befindet sich der Key mit Passwort... - ##
|
||||||
|
## --------------------------------------------------------- ##
|
||||||
|
|
||||||
|
# - bsp.: cryptsetup --verbose open --test-passphrase /dev/sda5
|
||||||
|
# -
|
||||||
|
cryptsetup --verbose open --test-passphrase <device>
|
||||||
|
|
||||||
|
|
||||||
|
## ------------------------------------------------------------- #
|
||||||
|
## - - #
|
||||||
|
## - cryptodevice einrichten - #
|
||||||
|
## - - #
|
||||||
|
## ------------------------------------------------------------- #
|
||||||
|
|
||||||
|
## -------------------------- ##
|
||||||
|
## - Cryptodevice erstellen - ##
|
||||||
|
## -------------------------- ##
|
||||||
|
## -
|
||||||
|
cryptsetup luksFormat <device i.e. "/dev/sda1">
|
||||||
|
## - oder
|
||||||
|
cryptsetup -c aes-lrw-benbi -y -s 384 luksFormat <device>
|
||||||
|
#
|
||||||
|
#cryptsetup -c aes-xts-plain -y -s 512 luksFormat <device>
|
||||||
|
cryptsetup luksFormat -c aes-xts-plain64 -s 512 -h sha512 -y <device>
|
||||||
|
|
||||||
|
## - cryptodevice erstellen mit password im keyfile
|
||||||
|
## -
|
||||||
|
## - keyfile (1024 bit groß) erstellen
|
||||||
|
head -c1024 /dev/urandom > <keyfile i.e. "/etc/.key/hostname.key">
|
||||||
|
## - crytodevice erstellen
|
||||||
|
cryptsetup -c aes-lrw-benbi -s 384 luksFormat <device> <keyfile>
|
||||||
|
# - oder (etwas neuer)
|
||||||
|
#cryptsetup -c aes-xts-plain -s 512 luksFormat <device> <keyfile>
|
||||||
|
cryptsetup -c aes-xts-plain64 -s 512 -h sha512 luksFormat <device> <keyfile>
|
||||||
|
|
||||||
|
## - cryptodevice mit einem abgeleiteten Schlüssel eines bestehenden LUKS
|
||||||
|
## - device erstellen
|
||||||
|
## -
|
||||||
|
## - /lib/cryptsetup/scripts/decrypt_derived <Name_des_Ursprungsgeräts> | cryptsetup -c aes-xts-plain -s 512 luksFormat <Gerät>
|
||||||
|
## - wobei mit <Name des Ursprungsgeräts> ist im Folgenden der Mapper-Name
|
||||||
|
## - gemeint ist, der unter /dev/mapper/ angezeigt wird - z.Bsp. root
|
||||||
|
## -
|
||||||
|
/lib/cryptsetup/scripts/decrypt_derived root | cryptsetup -c aes-xts-plain -s 512 luksFormat /dev/sda3
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
## ------------------------ ##
|
||||||
|
## - Cryptodevice oeffnen - ##
|
||||||
|
## ------------------------ ##
|
||||||
|
## -
|
||||||
|
cryptsetup luksOpen <device> <cryptodevice i.e. "data">
|
||||||
|
## - bzw. mit keyfileangabe
|
||||||
|
cryptsetup luksOpen <device> <cryptodevice i.e. "data"> --key-file <keyfile>
|
||||||
|
|
||||||
|
## - dateisystem erstellen
|
||||||
|
## -
|
||||||
|
## - Die "-m" Option reserviert soviel Prozent (hier: 0 Prozent) des Speichers
|
||||||
|
## - für den Superuser. Vergisst man die Option anzugeben, werden standardmäßig 5%
|
||||||
|
## - des Speicherplatzers für den Superuser reserviert.
|
||||||
|
## -
|
||||||
|
#mkfs.ext4 -m0 -E lazy_itable_init=0,lazy_journal_init=0 /dev/mapper/<cryptodevice>
|
||||||
|
mkfs.ext4 -E lazy_itable_init=0,lazy_journal_init=0 /dev/mapper/<cryptodevice>
|
||||||
|
|
||||||
|
## - neue crytopartition mounten
|
||||||
|
## -
|
||||||
|
mount /dev/mapper/<cryptodevice> <mountpoint i.e. "/data">
|
||||||
|
|
||||||
|
## - öffnen eines mit einem abgeleiteten Schlüssel erstellten
|
||||||
|
## - LUKS Devices
|
||||||
|
## -
|
||||||
|
## - /lib/cryptsetup/scripts/decrypt_derived <Name Des Ursprungsgeräts> | cryptsetup luksOpen <Gerät> <Name>
|
||||||
|
/lib/cryptsetup/scripts/decrypt_derived root | cryptsetup luksOpen /dev/sda3 data
|
||||||
|
|
||||||
|
|
||||||
|
## ----------------- ##
|
||||||
|
## - /etc/crypttab - ##
|
||||||
|
## ----------------- ##
|
||||||
|
## -
|
||||||
|
## - Paswortgeschütztes Device
|
||||||
|
#<Name> UUID=<UUID> none <options>
|
||||||
|
root UUID=9d323be6-7aad-4813-a0d2-8db4947c48d9 none luks
|
||||||
|
## -
|
||||||
|
## - Keyfile gechütztes Device
|
||||||
|
#<Name> UUID=<UUID> <key file> <options
|
||||||
|
home UUID=866d09f2-1b18-a00a-8d45-b2407260864c /etc/.key/luna.key luks,aes-xts-plain
|
||||||
|
## -
|
||||||
|
## - mit abgeleitetem Schlüssel erstelltes Device
|
||||||
|
#<Name> UUID=<UUID> <Ursprungsgeräts> luks,keyscript=/lib/cryptsetup/scripts/decrypt_derived
|
||||||
|
data UUID=5f106e59-829f-4186-95b7-a0c84bb0adbd root luks,keyscript=/lib/cryptsetup/scripts/decrypt_derived
|
||||||
|
|
||||||
|
## - Hinweis!
|
||||||
|
## - die UUID eines Gerätedevice kann mittels "blkid" ermittelt werden
|
||||||
|
## -
|
||||||
|
blkid /dev/sda2
|
||||||
|
|
||||||
|
## - Neuere Versionen von cryptsetup können die UUID auch selbst ermitteln:
|
||||||
|
## -
|
||||||
|
cryptsetup luksUUID /dev/sdxY
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
## - Luks ermöglicht, mit verschiedenen Schlüsseln auf die
|
||||||
|
## - Partition zuzugreifen. Folgender Befehl fügst einen
|
||||||
|
## - weiteren hinzu:
|
||||||
|
## - ein passwort hinzufügen
|
||||||
|
## -
|
||||||
|
cryptsetup luksAddKey /dev/$DEVICE
|
||||||
|
## -
|
||||||
|
## - ein passwort hinzufügen falls eine schlüsseldatei benutzt wird
|
||||||
|
## -
|
||||||
|
cryptsetup luksAddKey -d /pfad/zur/datei /dev/$DEVICE
|
||||||
|
## -
|
||||||
|
## - ein passwort hinzufügen falls eine abgeleiteter Schlüssel benutzt wird
|
||||||
|
## -
|
||||||
|
mkdir /mnt/ram && mount -t ramfs -o size=1m ramfs /mnt/ram && chmod 600 /mnt/ram
|
||||||
|
/lib/cryptsetup/scripts/decrypt_derived <Ursprungsgerät z.Bsp. root> > /mnt/ram/tmp.key
|
||||||
|
cryptsetup luksAddKey -d /mnt/ram/tmp.key /dev/$DEVICE
|
||||||
|
umount /mnt/ram && rmdir /mnt/ram
|
||||||
|
## -
|
||||||
|
## - einen abgeleiteten Schlüssel hinzufügen, falls ein Passwort benutzt wurde
|
||||||
|
## -
|
||||||
|
mkdir /mnt/ram && mount -t ramfs -o size=1m ramfs /mnt/ram && chmod 600 /mnt/ram
|
||||||
|
/lib/cryptsetup/scripts/decrypt_derived <Ursprungsgerät z.Bsp. root> > /mnt/ram/tmp.key
|
||||||
|
cryptsetup luksAddKey /dev/$DEVICE /mnt/ram/tmp.key
|
||||||
|
umount /mnt/ram && rmdir /mnt/ram
|
||||||
|
## -
|
||||||
|
## - eine Schlüsseldatei hinzufügen
|
||||||
|
## -
|
||||||
|
cryptsetup luksAddKey /dev/$DEVICE <keydatei>
|
||||||
|
## -
|
||||||
|
## - eine Schlüsseldatei hinzufügen falls eine schlüsseldatei benutzt wird
|
||||||
|
## -
|
||||||
|
cryptsetup luksAddKey -d /pfad/zur/datei /dev/$DEVICE <keydatei>
|
||||||
|
|
||||||
|
|
||||||
|
## - Analog dazu kann mit luksKillSlot ein Schlüssel wieder entfernen.
|
||||||
|
## -
|
||||||
|
cryptsetup luksKillSlot <cryptodevice> <SlotNr>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
## - Täglicher Gebrauch
|
||||||
|
## - ==================
|
||||||
|
|
||||||
|
* Trage deine Cryptopartition in /etc/crypttab ein, bspw:
|
||||||
|
|
||||||
|
# <target device> <source device> <key file> <options>
|
||||||
|
$CRYPTODEVICE /dev/$DEVICE none luks,check=ext2,retry=5
|
||||||
|
# oder
|
||||||
|
<cryptodevice> <device> none luks,retry=1,cipher=aes-lrw-benbi
|
||||||
|
<cryptodevice> <device> <keykile> luks,cipher=aes-lrw-benbi
|
||||||
|
|
||||||
|
* Trage in /etc/fstab das Device (/dev/mapper/$CRYPTODEVICE $MOUNT)
|
||||||
|
mit deinen Dateisystemoptionen ein:
|
||||||
|
|
||||||
|
/dev/mapper/$CRYPTDEVICE $MOUNT auto defaults 0 0
|
||||||
|
|
||||||
|
* /etc/init.d/cryptdisks kümmert sich nun um die Initialisierung beim Booten.
|
||||||
|
Bei Falscheingabe, wirst du mehrmals (siehe retry in der /etc/crypttab)
|
||||||
|
erneut gefragt. Falls es weiterhin fehlschlägt, wird der Bootvorgang
|
||||||
|
ohne mounten fortgesetzt.
|
||||||
|
|
||||||
|
* Luks ermöglicht es dir, mit verschiedenen Schlüsseln auf die Partition
|
||||||
|
zuzugreifen. Mit folgendem Befehl fügst du einen weiteren hinzu:
|
||||||
|
|
||||||
|
cryptsetup luksAddKey /dev/$DEVICE
|
||||||
|
|
||||||
|
Dazu musst du das Passwort eines schon vorhandenen Schlüssels eingeben. Analog
|
||||||
|
dazu kannst du mit luksDelKey ein Schlüssel wieder entfernen.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
Paranoia
|
||||||
|
========
|
||||||
|
|
||||||
|
Mit dmsetup info lassen sich benutzte devicemappings anzeigen.
|
||||||
|
Taucht hier ein Teil als ACTIVE auf, so hat jedermensch darauf
|
||||||
|
Zugriff (auch wenn es nicht gemountet ist, könnte - wer die
|
||||||
|
nötigen Rechte hat - das Teil ohne passendes Cryptokennwort
|
||||||
|
mounten) - es ist in diesem Zustand quasi entschlüsselt!
|
||||||
|
|
||||||
|
Deswegen immer nach dem unmounten, das mapping entfernen
|
||||||
|
(sonst gibt's (erfahrene Beamte vorausgesetzt) evtl. Stress bei
|
||||||
|
der Hausdurchsuchung):
|
||||||
|
|
||||||
|
umount $MOUNT
|
||||||
|
cryptsetup luksClose $CRYPTODEVICE
|
||||||
|
|
||||||
|
Du kannst alle mappings gleichzeitig entfernen mit:
|
||||||
|
|
||||||
|
dmsetup remove_all
|
||||||
|
|
||||||
|
! Denk dran: cryptsetup luksClose niemals nicht vergessen oder aber
|
||||||
|
Stecker ziehen (bzw. den Rechner herunterfahren) ;) !
|
||||||
|
|
||||||
163
mount_crypt
Executable file
163
mount_crypt
Executable file
@@ -0,0 +1,163 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
|
||||||
|
PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin
|
||||||
|
|
||||||
|
## - Partition: data
|
||||||
|
## -
|
||||||
|
part_name=data
|
||||||
|
crypt_partition="/dev/mapper/$part_name"
|
||||||
|
raw_partition=< i.e. /dev/vda3 or /dev/sda3 ..>
|
||||||
|
mount_point=<your mount point>
|
||||||
|
|
||||||
|
start_samba=false
|
||||||
|
start_kvm=false
|
||||||
|
start_mysql=false
|
||||||
|
start_apache=false
|
||||||
|
start_vservers=true
|
||||||
|
vservers="<vserver1, vserver2,..>"
|
||||||
|
|
||||||
|
|
||||||
|
echo -e "\n\033[1;34m"
|
||||||
|
/sbin/cryptsetup luksOpen $raw_partition $part_name > /dev/null 2>&1
|
||||||
|
echo -e "\033[0m"
|
||||||
|
if ! df | grep "$crypt_partition" > /dev/null 2>&1 ;then
|
||||||
|
declare -i mount_count=`tune2fs -l $crypt_partition | grep "Mount count" | cut -d ":" -f 2`
|
||||||
|
declare -i max_mount_count=`tune2fs -l $crypt_partition | grep "Maximum mount count" | cut -d ":" -f 2`
|
||||||
|
if [ $max_mount_count -gt 0 ];then
|
||||||
|
|
||||||
|
if [ $mount_count -ge $max_mount_count ]; then
|
||||||
|
echo ""
|
||||||
|
echo -e "\tMaximal mount count of $max_mount_count was reached."
|
||||||
|
echo -e "\tSo a filecheck on \"$crypt_partition\" will be initiated.."
|
||||||
|
echo -e "\t\033[1;33m\E[5mPlease wait. This may take some time..\033[00m"
|
||||||
|
echo ""
|
||||||
|
e2fsck -p $crypt_partition > /dev/null
|
||||||
|
if [ $? -gt -0 ]; then
|
||||||
|
echo -e "\n\t[\033[1;31mERROR\033[0m] filecheck on $crypt_partition failed.\n"
|
||||||
|
fi
|
||||||
|
tune2fs -C 0 $crypt_partition > /dev/null
|
||||||
|
fi
|
||||||
|
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
|
||||||
|
|
||||||
|
if ! df | grep "$crypt_partition" > /dev/null 2>&1 ;then
|
||||||
|
|
||||||
|
echo -n -e "\tMounting crypto-partition \"$part_name\"..\t"
|
||||||
|
|
||||||
|
/bin/mount $crypt_partition $mount_point > /dev/null 2>&1
|
||||||
|
|
||||||
|
if [ $? -ne 0 ] ; then
|
||||||
|
echo -e " [\033[40m\033[1;31m failed \033[0m]"
|
||||||
|
else
|
||||||
|
echo -e " [\033[1;32m done \033[0m]"
|
||||||
|
fi
|
||||||
|
else
|
||||||
|
|
||||||
|
echo -e "\t\033[1;33mPartition \"$part_name\" already mounted..\033[0m"
|
||||||
|
|
||||||
|
fi
|
||||||
|
|
||||||
|
|
||||||
|
if $start_vservers ; then
|
||||||
|
if [ -n "$vservers" ]; then
|
||||||
|
echo ""
|
||||||
|
for _vserver in $vservers ; do
|
||||||
|
echo -n -e "\tStarting VServer \"$_vserver\".."
|
||||||
|
vserver $_vserver start > /dev/null 2>&1
|
||||||
|
if [ $? -ne 0 ] ; then
|
||||||
|
echo -e "\t [\033[40m\033[1;31m failed \033[0m]"
|
||||||
|
else
|
||||||
|
echo -e "\t [\033[1;32m done \033[0m]"
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
echo ""
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
|
||||||
|
|
||||||
|
if $start_mysql ; then
|
||||||
|
if ps ax | grep /usr/sbin/mysqld | grep -v grep > /dev/null 2>&1 || ps ax | grep smbd | grep -v grep > /dev/null 2>&1 ; then
|
||||||
|
## - Stopping Mysql..
|
||||||
|
## -
|
||||||
|
echo -n -e "\n\tStopping MySQL Server..\t\t"
|
||||||
|
/etc/init.d/mysql stop > /dev/null
|
||||||
|
|
||||||
|
if [ $? -ne 0 ] ; then
|
||||||
|
echo -e " [ \033[1;31mfailed\033[0m ]\n"
|
||||||
|
else
|
||||||
|
echo -e " [ \033[1;32mdone\033[0m ]\n"
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
|
||||||
|
## - Starting Mysql..
|
||||||
|
## -
|
||||||
|
echo -n -e "\n\tStarting MySQL Server..\t\t"
|
||||||
|
/etc/init.d/mysql start > /dev/null 2>&1
|
||||||
|
|
||||||
|
if [ $? -ne 0 ] ; then
|
||||||
|
echo -e " [ \033[1;31mfailed\033[0m ]\n"
|
||||||
|
else
|
||||||
|
echo -e " [ \033[1;32mdone\033[0m ]\n"
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
|
||||||
|
|
||||||
|
if $start_apache ; then
|
||||||
|
if ps ax | grep /usr/sbin/apache2 | grep -v grep > /dev/null 2>&1 || ps ax | grep smbd | grep -v grep > /dev/null 2>&1 ; then
|
||||||
|
## - Stopping Apache Webserver..
|
||||||
|
## -
|
||||||
|
echo -n -e "\n\tStopping Apache Weberver..\t"
|
||||||
|
/etc/init.d/apache2 stop > /dev/null
|
||||||
|
|
||||||
|
if [ $? -ne 0 ] ; then
|
||||||
|
echo -e " [ \033[1;31mfailed\033[0m ]\n"
|
||||||
|
else
|
||||||
|
echo -e " [ \033[1;32mdone\033[0m ]\n"
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
|
||||||
|
## - Starting Apache..
|
||||||
|
## -
|
||||||
|
echo -n -e "\n\tStarting Apache Webserver..\t"
|
||||||
|
/etc/init.d/apache2 start > /dev/null 2>&1
|
||||||
|
|
||||||
|
if [ $? -ne 0 ] ; then
|
||||||
|
echo -e " [ \033[1;31mfailed\033[0m ]\n"
|
||||||
|
else
|
||||||
|
echo -e " [ \033[1;32mdone\033[0m ]\n"
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
|
||||||
|
|
||||||
|
if $start_samba ; then
|
||||||
|
## - Starting Samba..
|
||||||
|
## -
|
||||||
|
if ps ax | grep nmbd | grep -v grep > /dev/null 2>&1 || ps ax | grep smbd | grep -v grep > /dev/null 2>&1 ; then
|
||||||
|
/etc/init.d/samba stop > /dev/null
|
||||||
|
killall smbd > /dev/null 2>&1
|
||||||
|
killall nmbd > /dev/null 2>&1
|
||||||
|
fi
|
||||||
|
echo -n -e "\n\tStarting Samba Fileserver..\t\t"
|
||||||
|
/etc/init.d/samba start > /dev/null 2>&1
|
||||||
|
|
||||||
|
if [ $? -ne 0 ] ; then
|
||||||
|
echo -e " [ \033[1;31mfailed\033[0m ]\n"
|
||||||
|
else
|
||||||
|
echo -e " [ \033[1;32mdone\033[0m ]\n"
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
|
||||||
|
|
||||||
|
if $start_kvm ; then
|
||||||
|
## - Starting libvirt-bin (also starts virtual boxes)
|
||||||
|
## -
|
||||||
|
echo -n -e "\n\tStarting libvirt-bin..\t\t\t"
|
||||||
|
/etc/init.d/libvirt-bin start > /dev/null 2>&1
|
||||||
|
if [ $? -ne 0 ] ; then
|
||||||
|
echo -e " [ \033[1;31mfailed\033[0m ]\n"
|
||||||
|
else
|
||||||
|
echo -e " [ \033[1;32mdone\033[0m ]\n"
|
||||||
|
fi
|
||||||
|
fi
|
||||||
54
mount_cryptroot
Normal file
54
mount_cryptroot
Normal file
@@ -0,0 +1,54 @@
|
|||||||
|
#!/bin/sh
|
||||||
|
|
||||||
|
# This script generates two scripts in the initramfs output,
|
||||||
|
# /root/mount_cryptroot.sh and /root/.profile
|
||||||
|
|
||||||
|
|
||||||
|
ALLOW_SHELL=0
|
||||||
|
# Set this to 1 before running update-initramfs if you want
|
||||||
|
# to allow authorized users to type Ctrl-C to drop to a
|
||||||
|
# root shell (useful for debugging, potential for abuse.)
|
||||||
|
#
|
||||||
|
# (Note that even with ALLOW_SHELL=0 it may still be possible
|
||||||
|
# to achieve a root shell.)
|
||||||
|
#
|
||||||
|
|
||||||
|
if [ -z ${DESTDIR} ]; then
|
||||||
|
exit
|
||||||
|
fi
|
||||||
|
|
||||||
|
SCRIPT="${DESTDIR}/root/mount_cryptroot.sh"
|
||||||
|
cat > "${SCRIPT}" << 'EOF'
|
||||||
|
#!/bin/sh
|
||||||
|
CMD=
|
||||||
|
while [ -z "$CMD" -o -z "`pidof askpass plymouth`" ]; do
|
||||||
|
CMD=`ps -o args | grep cryptsetup | grep -i open | grep -v grep`
|
||||||
|
sleep 0.1
|
||||||
|
done
|
||||||
|
while [ -n "`pidof askpass plymouth`" ]; do
|
||||||
|
$CMD && kill -9 `pidof askpass plymouth` && echo "Success"
|
||||||
|
done
|
||||||
|
EOF
|
||||||
|
|
||||||
|
chmod +x "${SCRIPT}"
|
||||||
|
|
||||||
|
# Run mount_cryptroot by default and close the login session afterwards
|
||||||
|
# If ALLOW_SHELL is set to 1, you can press Ctrl-C to get to an interactive prompt
|
||||||
|
cat > "${DESTDIR}/root/.profile" << EOF
|
||||||
|
ctrl_c_exit() {
|
||||||
|
exit 1
|
||||||
|
}
|
||||||
|
ctrl_c_shell() {
|
||||||
|
# Ctrl-C during .profile appears to mangle terminal settings
|
||||||
|
reset
|
||||||
|
}
|
||||||
|
if [ "$ALLOW_SHELL" == "1" ]; then
|
||||||
|
echo "Unlocking rootfs... Type Ctrl-C for a shell."
|
||||||
|
trap ctrl_c_shell INT
|
||||||
|
else
|
||||||
|
echo "Unlocking rootfs..."
|
||||||
|
trap ctrl_c_exit INT
|
||||||
|
fi
|
||||||
|
/root/mount_cryptroot.sh && exit 1 || echo "Run ./mount_cryptroot.sh to try unlocking again"
|
||||||
|
trap INT
|
||||||
|
EOF
|
||||||
120
remote_decrypt.txt
Normal file
120
remote_decrypt.txt
Normal file
@@ -0,0 +1,120 @@
|
|||||||
|
## - IP definitions in initramfs overwrites /etc/network/interfaces
|
||||||
|
## -
|
||||||
|
## - Add the following line to your interface definition
|
||||||
|
## -
|
||||||
|
## - pre-up ip addr flush dev eth0
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
Luks remote decrypt
|
||||||
|
===================
|
||||||
|
|
||||||
|
## Install packages busybox and dropbear
|
||||||
|
## -
|
||||||
|
## - Notice:
|
||||||
|
## - If package busybox-static is already installed, tha is sufficient.
|
||||||
|
## - Install only package dropbear in that case.
|
||||||
|
## -
|
||||||
|
#apt-get install dropbear busybox
|
||||||
|
apt-get install dropbear
|
||||||
|
|
||||||
|
|
||||||
|
## - For security reason and if no needed, remove keys from root directory in
|
||||||
|
## - initramfs (/etc/initramfs-tools/root/.ssh)
|
||||||
|
## -
|
||||||
|
rm /etc/initramfs-tools/root/.ssh/id_*
|
||||||
|
|
||||||
|
## - Empty /etc/initramfs-tools/root/.ssh/authorized_keys
|
||||||
|
## -
|
||||||
|
> /etc/initramfs-tools/root/.ssh/authorized_keys
|
||||||
|
|
||||||
|
## - Add your public key, you wish to early connect, to authorized_keys file
|
||||||
|
## - /etc/initramfs-tools/root/.ssh/authorized_keys
|
||||||
|
## -
|
||||||
|
vim /etc/initramfs-tools/root/.ssh/authorized_keys
|
||||||
|
|
||||||
|
|
||||||
|
## - Create initramfs script for unlocking the key
|
||||||
|
## -
|
||||||
|
cat << END > /etc/initramfs-tools/hooks/unlock_cryptkey_via_ssh.sh
|
||||||
|
#!/bin/sh
|
||||||
|
|
||||||
|
PREREQ="dropbear"
|
||||||
|
|
||||||
|
prereqs() {
|
||||||
|
echo "\$PREREQ"
|
||||||
|
}
|
||||||
|
|
||||||
|
case "\$1" in
|
||||||
|
prereqs)
|
||||||
|
prereqs
|
||||||
|
exit 0
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
|
||||||
|
. "\$CONFDIR/initramfs.conf"
|
||||||
|
#. /usr/share/initramfs-tools/hook-functions
|
||||||
|
|
||||||
|
if [ "\$DROPBEAR" != "n" ] && [ -r "/etc/crypttab" ] ; then
|
||||||
|
# fix for dropbear in Ubuntu 12.04 x86_64
|
||||||
|
[ -d /lib/x86_64-linux-gnu ] && cp -p /lib/x86_64-linux-gnu/libnss_* "\$DESTDIR/lib/"
|
||||||
|
|
||||||
|
mkdir -m 755 -p "\$DESTDIR/lib/unlock"
|
||||||
|
|
||||||
|
##### /bin/unlock
|
||||||
|
cat > "\${DESTDIR}/bin/unlock" <<EOF
|
||||||
|
#!/bin/sh
|
||||||
|
if PATH=/lib/unlock:/bin:/sbin /scripts/local-top/cryptroot ; then
|
||||||
|
for n in cryptroot "plymouth ask-for-pass" cryptsetup ; do
|
||||||
|
p=\\\$(ps w | grep "\\\$n" | awk '\\\$5 != "grep" {print \\\$1}')
|
||||||
|
[ -n "\\\$p" ] && kill \\\$p
|
||||||
|
done
|
||||||
|
exit 0
|
||||||
|
fi
|
||||||
|
exit 1
|
||||||
|
EOF
|
||||||
|
##### EOF /bin/unlock
|
||||||
|
|
||||||
|
##### /lib/unlock/plymouth
|
||||||
|
cat > "\$DESTDIR/lib/unlock/plymouth" <<-EOF
|
||||||
|
#!/bin/sh
|
||||||
|
[ "\\\$1" == "--ping" ] && exit 1
|
||||||
|
exec /bin/plymouth "\\\$@"
|
||||||
|
EOF
|
||||||
|
##### EOF /lib/unlock/plymouth
|
||||||
|
|
||||||
|
chmod 755 "\$DESTDIR/bin/unlock"
|
||||||
|
chmod 755 "\$DESTDIR/lib/unlock/plymouth"
|
||||||
|
|
||||||
|
# enable password login
|
||||||
|
[ -n "\$SSHUSERPASS" ] &&
|
||||||
|
touch "\$DESTDIR/etc/shadow" && chmod 640 "\$DESTDIR/etc/shadow" &&
|
||||||
|
getent shadow "\$SSHUSERPASS" | sed -n "s/^\$SSHUSERPASS:/root:/p" /etc/shadow >> "\$DESTDIR/etc/shadow"
|
||||||
|
|
||||||
|
sed -i'' 's|^\(root:.*\):[^:]*$|\1:/bin/sh|' "\$DESTDIR/etc/passwd"
|
||||||
|
fi
|
||||||
|
END
|
||||||
|
|
||||||
|
chmod 755 /etc/initramfs-tools/hooks/unlock_cryptkey_via_ssh.sh
|
||||||
|
|
||||||
|
## - Make changes persistent to initramfs
|
||||||
|
## -
|
||||||
|
update-initramfs -u -k all
|
||||||
|
|
||||||
|
|
||||||
|
## - Now you can connect to dropbear shell with your added key, for example
|
||||||
|
## -
|
||||||
|
## - Connect:
|
||||||
|
## - ssh -i ~/.ssh/dropbear/id_rsa_initram -o UserKnownHostsFile=.ssh/dropbear/known_hosts root@192.168.63.90
|
||||||
|
## -
|
||||||
|
## - Enter your passphrase:
|
||||||
|
## - Enter passphrase for key '/home/chris/.ssh/dropbear/id_rsa_initram': ******************
|
||||||
|
## -
|
||||||
|
## - Unlock key, type:
|
||||||
|
## - unlock
|
||||||
|
## -
|
||||||
|
## - Enter pasphrase for cryptodevice
|
||||||
|
## - Enter passphrase:
|
||||||
|
## -
|
||||||
139
umount_crypt
Executable file
139
umount_crypt
Executable file
@@ -0,0 +1,139 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
### BEGIN INIT INFO
|
||||||
|
# Provides: umount_crypt
|
||||||
|
# Required-Start: $remote_fs $syslog $network postfix
|
||||||
|
# Required-Stop: $remote_fs $syslog $network postfix
|
||||||
|
# Default-Start:
|
||||||
|
# Default-Stop: 0 1 6
|
||||||
|
# Short-Description: Unmounting crypto device(s)
|
||||||
|
### END INIT INFO
|
||||||
|
|
||||||
|
## ---
|
||||||
|
## - add with:
|
||||||
|
## - update-rc.d umount_crypt stop 01 0 1 6 .
|
||||||
|
## ---
|
||||||
|
|
||||||
|
PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin
|
||||||
|
|
||||||
|
## - Partition: data
|
||||||
|
## -
|
||||||
|
part_name=<choose a name i.e data>
|
||||||
|
crypt_partition="/dev/mapper/$part_name"
|
||||||
|
raw_partition=< i.e. /dev/vda3 or /dev/sda3 ..>
|
||||||
|
mount_point=<your mount point i.e /data>
|
||||||
|
|
||||||
|
stop_samba=false
|
||||||
|
stop_kvm=false
|
||||||
|
stop_mysql=false
|
||||||
|
stop_apache=false
|
||||||
|
stop_vservers=true
|
||||||
|
|
||||||
|
if $stop_vservers ; then
|
||||||
|
if [ -n $vservers ];then
|
||||||
|
echo ""
|
||||||
|
vservers=`vserver-stat | grep -E "^[0-9]{2,}" | awk '{print$8}'`
|
||||||
|
for _vserver in $vservers ; do
|
||||||
|
echo -n -e "\tStopping VServer \"$_vserver\".."
|
||||||
|
vserver $_vserver stop > /dev/null 2>&1
|
||||||
|
if [ $? -ne 0 ] ; then
|
||||||
|
echo -e "\t[ \033[1;31mfailed\033[0m ]"
|
||||||
|
else
|
||||||
|
echo -e "\t[ \033[1;32mdone\033[0m ]"
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
echo ""
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
|
||||||
|
|
||||||
|
if $stop_apache ; then
|
||||||
|
if ps ax | grep /usr/sbin/apache2 | grep -v grep > /dev/null 2>&1 || ps ax | grep smbd | grep -v grep > /dev/null 2>&1 ; then
|
||||||
|
## - Stopping Apache Webserver..
|
||||||
|
## -
|
||||||
|
echo -n -e "\n\tStopping Apache Weberver..\t"
|
||||||
|
/etc/init.d/apache2 stop > /dev/null
|
||||||
|
|
||||||
|
if [ $? -ne 0 ] ; then
|
||||||
|
echo -e " [ \033[1;31mfailed\033[0m ]\n"
|
||||||
|
else
|
||||||
|
echo -e " [ \033[1;32mdone\033[0m ]\n"
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
|
||||||
|
|
||||||
|
if $stop_mysql ; then
|
||||||
|
if ps ax | grep /usr/sbin/mysqld | grep -v grep > /dev/null 2>&1 || ps ax | grep smbd | grep -v grep > /dev/null 2>&1 ; then
|
||||||
|
## - Stopping Mysql..
|
||||||
|
## -
|
||||||
|
echo -n -e "\n\tStopping MySQL Server..\t\t"
|
||||||
|
/etc/init.d/mysql stop > /dev/null
|
||||||
|
|
||||||
|
if [ $? -ne 0 ] ; then
|
||||||
|
echo -e " [ \033[1;31mfailed\033[0m ]\n"
|
||||||
|
else
|
||||||
|
echo -e " [ \033[1;32mdone\033[0m ]\n"
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
|
||||||
|
|
||||||
|
if $stop_kvm ; then
|
||||||
|
## - Stopping KVM's
|
||||||
|
## -
|
||||||
|
echo -n -e "\n\tStopping Virtual Boxes..\t\t"
|
||||||
|
/etc/init.d/kvm_shutdown_guests stop > /dev/null 2>&1
|
||||||
|
if [ $? -ne 0 ] ; then
|
||||||
|
echo -e " [ \033[1;31mfailed\033[0m ]\n"
|
||||||
|
else
|
||||||
|
echo -e " [ \033[1;32mdone\033[0m ]\n"
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo -n -e "\n\tStopping libvirt-bin..\t\t\t"
|
||||||
|
/etc/init.d/libvirt-bin stop > /dev/null 2>&1
|
||||||
|
if [ $? -ne 0 ] ; then
|
||||||
|
echo -e " [ \033[1;31mfailed\033[0m ]\n"
|
||||||
|
else
|
||||||
|
echo -e " [ \033[1;32mdone\033[0m ]\n"
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
|
||||||
|
|
||||||
|
if $stop_samba ; then
|
||||||
|
## - Stopping Samba-Server
|
||||||
|
## -
|
||||||
|
echo -n -e "\n\tStopping Samba Fileserver..\t\t"
|
||||||
|
/etc/init.d/samba stop > /dev/null 2>&1
|
||||||
|
|
||||||
|
if [ $? -ne 0 ] ; then
|
||||||
|
echo -e " [ \033[1;31mfailed\033[0m ]\n"
|
||||||
|
else
|
||||||
|
echo -e " [ \033[1;32mdone\033[0m ]\n"
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
|
||||||
|
|
||||||
|
if ! df | grep "$crypt_partition" > /dev/null 2>&1 ;then
|
||||||
|
echo -e "\n\t\033[1;33mPartition \"$part_name\" is NOT mounted..\033[0m"
|
||||||
|
else
|
||||||
|
echo -n -e "\n\tUnmounting Partition $mount_point..\t\t"
|
||||||
|
/bin/umount $crypt_partition > /dev/null 2>&1
|
||||||
|
|
||||||
|
if [ $? -ne 0 ] ; then
|
||||||
|
echo -e " [ \033[1;31mfailed\033[0m ]"
|
||||||
|
else
|
||||||
|
echo -e " [ \033[1;32mdone\033[0m ]"
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo -n -e "\tDecrypting $part_name..\t\t\t"
|
||||||
|
cryptsetup luksClose $part_name > /dev/null 2>&1
|
||||||
|
|
||||||
|
if [ $? -ne 0 ] ; then
|
||||||
|
echo -e " [ \033[1;31mfailed\033[0m ]\n"
|
||||||
|
else
|
||||||
|
echo -e " [ \033[1;32mdone\033[0m ]\n"
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
exit 0
|
||||||
56
unlock_cryptkey_via_ssh.sh
Executable file
56
unlock_cryptkey_via_ssh.sh
Executable file
@@ -0,0 +1,56 @@
|
|||||||
|
#!/bin/sh
|
||||||
|
|
||||||
|
PREREQ="dropbear"
|
||||||
|
|
||||||
|
prereqs() {
|
||||||
|
echo "$PREREQ"
|
||||||
|
}
|
||||||
|
|
||||||
|
case "$1" in
|
||||||
|
prereqs)
|
||||||
|
prereqs
|
||||||
|
exit 0
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
|
||||||
|
. "$CONFDIR/initramfs.conf"
|
||||||
|
#. /usr/share/initramfs-tools/hook-functions
|
||||||
|
|
||||||
|
if [ "$DROPBEAR" != "n" ] && [ -r "/etc/crypttab" ] ; then
|
||||||
|
# fix for dropbear in Ubuntu 12.04 x86_64
|
||||||
|
[ -d /lib/x86_64-linux-gnu ] && cp -p /lib/x86_64-linux-gnu/libnss_* "$DESTDIR/lib/"
|
||||||
|
|
||||||
|
mkdir -m 755 -p "$DESTDIR/lib/unlock"
|
||||||
|
|
||||||
|
##### /bin/unlock
|
||||||
|
cat > "${DESTDIR}/bin/unlock" <<EOF
|
||||||
|
#!/bin/sh
|
||||||
|
if PATH=/lib/unlock:/bin:/sbin /scripts/local-top/cryptroot ; then
|
||||||
|
for n in cryptroot "plymouth ask-for-pass" cryptsetup ; do
|
||||||
|
p=\$(ps w | grep "\$n" | awk '\$5 != "grep" {print \$1}')
|
||||||
|
[ -n "\$p" ] && kill \$p
|
||||||
|
done
|
||||||
|
exit 0
|
||||||
|
fi
|
||||||
|
exit 1
|
||||||
|
EOF
|
||||||
|
##### EOF /bin/unlock
|
||||||
|
|
||||||
|
##### /lib/unlock/plymouth
|
||||||
|
cat > "$DESTDIR/lib/unlock/plymouth" <<-EOF
|
||||||
|
#!/bin/sh
|
||||||
|
[ "\$1" == "--ping" ] && exit 1
|
||||||
|
exec /bin/plymouth "\$@"
|
||||||
|
EOF
|
||||||
|
##### EOF /lib/unlock/plymouth
|
||||||
|
|
||||||
|
chmod 755 "$DESTDIR/bin/unlock"
|
||||||
|
chmod 755 "$DESTDIR/lib/unlock/plymouth"
|
||||||
|
|
||||||
|
# enable password login
|
||||||
|
[ -n "$SSHUSERPASS" ] &&
|
||||||
|
touch "$DESTDIR/etc/shadow" && chmod 640 "$DESTDIR/etc/shadow" &&
|
||||||
|
getent shadow "$SSHUSERPASS" | sed -n "s/^$SSHUSERPASS:/root:/p" /etc/shadow >> "$DESTDIR/etc/shadow"
|
||||||
|
|
||||||
|
sed -i'' 's|^\(root:.*\):[^:]*$|\1:/bin/sh|' "$DESTDIR/etc/passwd"
|
||||||
|
fi
|
||||||
Reference in New Issue
Block a user