So now what I want to turn your attention to is the concept of encryption on
Linux based systems.
So with encryption, what we can do is we can encrypt files on a file by file
basis pretty much.
We identify the file that is sensitive and we can subsequently protect via
encryption. However,
as you can imagine, this can be a little bit laborious and it's not exactly the
most efficient way
to protect your data. Instead, what you can use is something known as full disk WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to protect your data. Instead, what you can use is something known as full disk
encryption.
So what this means is that when you say, for example, power your device off,
the entire contents
are going to be protected via that encryption. So if someone happens to steal
your laptop and
it's turned off, even if they happen to have forensic tools, they still should
not be able to
access your data because of that encryption. We can ultimately implement the
solution on Linux,
utilizing something known as lock now. I maybe said that a little bit wrong. We
don't actually
use Lux in the respect that it's not actually a tool itself. Pretty much what WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
use Lux in the respect that it's not actually a tool itself. Pretty much what
Lux is. It's a type
of standard or specification. This is really the real set that has been laid
out that we want
encryption tools to be compliant with. So Lux stands for the Linux Unified Key
Set-Up and quite simply,
there are a bunch of Lux compliant tools available for Linux. Let's actually
discuss one of the
options we actually have here. One of them is something known as correct setup.
So let me briefly
show you how we can set this up via the command line and then we'll transport WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
show you how we can set this up via the command line and then we'll transport
that information
into deploying the encryption, utilizing Ansible. So let's go back to one of my
target devices,
my blue box right here. Now right now if I do an LSBLK dash F from the previous
skill,
we do actually have these two disks in use. They happen to be mounted in this
particular directory
and they happen to be formatted with XFS and part of a radar array. So all I'm
going to do here is
I will say pseudo U mount and unmount this particular directory. So now it is
mounted to an LSBLK dash WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
mounted to an LSBLK dash
F. Now let me stop the radar array and let me just zero the super blocks. So
let's go back to
LSBLK dash F. Now we just have a regular disk again. What I'm going to do is I
'm going to briefly
create a partition on one of these disks and then I'll walk to the process of
encryption. So all
I will do here is I will target the second disk or say pseudo part it NVMe zero
enter. Let's say
MK label GPT or say MK part primary. Now we can see we've created partition one
on disk number two.
So what I can do here is I can say pseudo crypt setup and now I'm going to say WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So what I can do here is I can say pseudo crypt setup and now I'm going to say
Lux format and
then specify the device I want to target which is going to be dev NVMe zero
enter P1 for partition
number one. So if I hit enter it's going to override any data that is already
on the disk.
If I'm sure I will say yes and capital letters. So what I'm going to have to do
is to write a pass
phrase for this particular partition. So let's give you a random phrase of let
's maybe go with
red forest 45 and what's a red forest 45. Perfect. So if I now do an LSBLK dash WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
red forest 45 and what's a red forest 45. Perfect. So if I now do an LSBLK dash
F check this out right
here we actually have this encrypted partition right now. So if I want this to
be accessible
away I can do this as I can say pseudo crypt setup open and then I specify the
device that I want
to target which is going to be dev NVMe zero enter P1 and now I'm going to give
a name of the
map device created by crypt setup. So let's just call this my partition okay
the name itself
doesn't actually matter so much and now I'm going to have to enter the pass
phrase to access this
so type in red forest 45 and I enter because I've typed the correct password we WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
so type in red forest 45 and I enter because I've typed the correct password we
now have access.
So now do an LSBLK dash F here we can see the device that we have created my
partition.
So what I could do is I could create a file system on this particular partition
. So let's now say
pseudo MKFS dot XFS and then our target dev mapper and the name of my device
happened to be my
partition. So we write that now what I want to do is I want to mount my file
system. So let me
just create a directory let's just call it let's maybe say my mount point the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
just create a directory let's just call it let's maybe say my mount point the
name itself doesn't
actually matter so much and now it says pseudo mount dash T and it's an XFS
based file system
and I'm going to mount dev mapper my partition and I'm going to make it
accessible via my mount
point if I hit enter if I don't LSBLK dash F check this out right here we have
my partition
which is an XFS based file system and it's now available in this particular
directory.
We're now accessing this particular partition if I now say pseudo them and let
's just create a WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
's just create a
file called private dot T XT going to insert more than just say this is some
sensitive data escape
colon wq write and quit here we have the particular file and we now have full
access to this
particular partition to write anything we so wish but the cool thing is if you
want to protect it
what we can do is we can leave the mount point so I'm a different directory and
I can say pseudo
U mounts and then on mount my mount point doing LSBLK dash F we can see it's no
longer mounted so
what I want to do here is I want to say pseudo crypt setup and I want to close WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
what I want to do here is I want to say pseudo crypt setup and I want to close
my partition
and if I hit enter now the partition is now in its encrypted state again and if
I want to access
the data again I can just simply open it once more so I hit the enter key and
now I'm going to
have to type in the correct phrase if I happen to type in something wrong such
as nuggets one which
is the wrong password it's not going to give me access to the actual encrypted
partition whereas
if I type in red forest 45 and I enter as we can see here the device
successfully loads and once
again what that means is that we can mount it as such and to the mount point I WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
again what that means is that we can mount it as such and to the mount point I
then go into my
mount point once again do an LS and now we can see here we have access to earth
sensitive file
so now that we know how encryption operates on Linux let's now see how to
implement this type
of technology utilizing Ansible