04.md

4 EXERCISE

10.10.2017

Disks (encrypted disks)

cryptsetup - manage plain dm-crypt and LUKS encrypted volumes

exercise #1

1. Create encrypted loopback device

fallocate -l 200MB file0
losetup -f file0
cryptsetup -y -v luksFormat /dev/loop0 # added [password slot-1 = ABCDEFGH]

# Dump the header information of a LUKS device.
cryptsetup luksDump /dev/loop0

2. Add second password to disk

cryptsetup luksAddKey /dev/loop0 # added [password slot-2 = IJKLMNOP]

3. Copy device to neighbour and let him/her know second password

4. Backup other's device crypto headers

cryptsetup luksHeaderBackup /dev/loop0 --header-backup-file backupHeaderFile

5. Open other's device and remove first (unknown) password

cryptsetup luksKillSlot /dev/loop0 1 # removed [password slot-1 = ABCDEFGH]

6. Change known password and restore backup

cryptsetup luksAddKey /dev/loop0 # added [password slot-1 = 12345678]

cryptsetup luksRemoveKey /dev/loop0 # removed [password slot-2 = IJKLMNOP]

cryptsetup luksHeaderRestore /dev/loop0 --header-backup-file backupHeaderFile

HELP:

• https://www.cyberciti.biz/hardware/howto-linux-hard-disk-encryption-with-luks-cryptsetup-command/
• https://www.lisenet.com/2013/luks-add-keys-backup-and-restore-volume-header/
• http://www.thegeekstuff.com/2016/03/cryptsetup-lukskey