So now we understand that the basics behind encryption on Linux, let's now try
to implement
this type of solution directly using Ansible.
Now the way we're actually going to do it in this particular video is we're
going to
use one of our all favorite solutions and that would be to construct the
playbook utilizing
an Ansible role.
More specifically, we're going to be using the rail system roles.
So once again, if you want to consult the documentation directly on your
command line,
you can go into user share dog rail system roles. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
you can go into user share dog rail system roles.
If we're done LS, I can go into the storage role.
This is the one we're going to be using.
And feel free to read the markdown page named readme.md.
This is going to have all the information that you need to use this particular
role.
In my case though, I prefer to read it directly via GitHub.
So I just searched for rail storage role, GitHub, and I'm going to click this
top link
right here.
So if we scroll on down the get to the documentation, this has got all the same
information that
you see within the terminal.
It's just presented a little bit, neither of my opinion. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
It's just presented a little bit, neither of my opinion.
And one of the variables we're going to have to set is the story volume.
So let's go down to that right here.
This one is what we're looking for.
We can specify a name for the name of the volume.
We can specify the type of volume we're going to be managing.
In our case, it's going to be a disk.
Although if you suggest you could be managing a read array, which we've just
discussed previously,
we can use the disk parameter to specify the set of disks that we want to be
using.
In the case here, I'm going to be using one of my new hard disks.
So in the previous video, I was using NVMe0enter.
And in this case, I'm just going to use a brand new fresh disk, which is NVMe0N WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And in this case, I'm just going to use a brand new fresh disk, which is NVMe0N
3, the
second disk I added.
Now if I want to specify the file system that I want to be utilizing, I can
specify that
via the FS_type parameter.
So if I want to use XFS or ext4, this would be where I would specify this.
I can give the file system a name using FS_label.
And very crucially after we have our encryption in play, we want to have the
data accessible
via a mount point.
We can use the mount_point parameter to specify that target directory. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We can use the mount_point parameter to specify that target directory.
So the previous keys we just discussed are all valuable and they will be used
within our
playbook.
But it's this section right here that is really targeting the concept that we
want to
be looking at.
This is all about our encryption.
So straight away, we have our encryption key specifying whether the volume is
going to be
encrypted using Lux.
Be aware though, is that if you happen to toggle this particular value, this is
going
to be a destructive operation pretty much.
When you happen to undo the encryption, you're basically going to be removing WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
When you happen to undo the encryption, you're basically going to be removing
all the data
on that volume.
So be aware.
Now in the previous video, we manually saw how we could create a password to
protect
our volume.
I believe that I used the password red forest 45, just a random password.
It is using this particular parameter here where we would specify that type of
password
information.
If you want to be using key based encryption, you can use the encryption_key
option to specify
the path to the actual key that is going to unlock the volume itself.
But in our case, we're going to keep it fairly simple and just use a passphrase WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
But in our case, we're going to keep it fairly simple and just use a passphrase
.
Again, we have some additional options to specify the type of cipher we want to
use as
well as the key size and bits, as well as the actual Lux encryption version
that we want
to be using.
So let's actually try to make this work them.
So all we'll do is I'll quit out this page and I'll go back and I will just
create a
new playbook called play2.yml.
So we're going to insert more to have our three hyphens at the top to denote
the ammo
file.
We'll have a name for this playbook.
Let's just call this play2 and we'll just say encrypts a partition. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Let's just call this play2 and we'll just say encrypts a partition.
In this case, I'm just going to target one device, my blue box and I'm going to
set gather
facts to be the billion value false.
Now I'm going to specify my variables that I'm going to be using and passing in
to the
storage role and the variable I want to set is going to be the storage
underscore volumes.
So let's give this a name.
Let's just call this test volume.
What is the media type?
Well, it's going to be a disk.
Let's specify the disks that are going to be in use.
Now again, in my case here, if I go to my blue box, if I do an LS BLK dash F, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Now again, in my case here, if I go to my blue box, if I do an LS BLK dash F,
it is this
particular disk here, NVMe 0 and 3, which has nothing on it at all yet.
This is a disk that I want to be targeting and effectively I want to create an
encrypted
partition on it as well as by the way, make it accessible via a mount point.
So for me, this is going to be NVMe 0 and 3.
Again, changes to suit whatever value you have on your particular system.
I'll specify the file system type I want to be.
It's going to be let's go with XFS here and let's give this a little label here
, say WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
, say
file system label.
Let's just call this test label of K, the name itself doesn't matter too much.
Let's specify the mount point here and let's just mount this in the mount
directory.
In fact, if you just go to the target device, let's create a little directory
just for that
quickly and let's just do sudo mkdir and let's just call this one crypto dir.
And of course, if you so wish, you could have easily created this directory
using Ansible
Directly, but nevertheless, let's go back to our playbook.
So the mount point is going to be in crypto dir and now let's get to the
encryption.
What I will do is specify the keyword encryption and give the billion value WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
What I will do is specify the keyword encryption and give the billion value
true.
Now I'm going to specify my encryption password and let's just give the
password.
Let's just go with green truck 78 doesn't actually matter so much and it goes
without
saying in a real live situation, you would not want to hard code this password.
Now if you so wish, you could add in additional values such as the encryption
key size or
you could specify the path to the encryption key if you didn't want to use a
password.
But for now, let's keep things nice and simple and all it will do is I'll now
go and call WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
go and call
the storage role.
So let's say roles and then I'll say it rail system roles dot storage.
So let's save this and let's try it running the playbook.
So the playbook kicks off and we can see the modifications being made and the
playbook
completes.
So let's go back to our device right now.
And if I do an LSBOK dash F look at what we actually have down here on device
number
three, we have this encrypted partition.
It has the XFS file system here is a test label and it has actually been
mounted and
is accessible via mount crypto dir. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
is accessible via mount crypto dir.
So what I can do therefore is I can go into CD, MNT, crypto dir and I can just
say pseudo
them and that just maybe create a file called file one dot txt going to type in
my password
go into insert mode and just say this is some secret stuff right in quits.
There we have our file as we can see right now it is accessible to us.
But if we so wish we could close down this partition and have it protected via
the encryption.
So let's see the other directory and I can say pseudo U mounts and target the
mount crypto WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
mount crypto
directory.
I can then say pseudo crypt setup and then close the partition and I can
reference the
locks container with this UUID right here just paste this in and to enter and
now the
partition is fully encrypted.
And if I want to open it manually and test the password I can say pseudo crypt
setup
open and say dev N V M E zero N three and let's just give this a device name
which is called
my disk.
Now I'm going to have to enter the passphrase.
So if I type in something wrong such as random pass one it's going to be WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So if I type in something wrong such as random pass one it's going to be
incorrect.
However if I use the password be specified in the answerable playbook when we
created
this encrypted partition let's copy this and let's paste this in and to enter
as we can
see here we now get a success.
So LSBLK dash F now we have access to the actual disk itself and I can now
mount it by
saying pseudo mount dev matter and this time I have named the device my disk
and now I
can specify the mount points let's put it in the same mount point as before I
'll say
MNT and it'll be encrypted and now if I see the enter the MNT crypto directory WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
MNT and it'll be encrypted and now if I see the enter the MNT crypto directory
and do an
LS now we can see we have access to that secret file which was encrypted but
now that
it is open as we can see here we have access to that particular file.
So as you can see this is how we can use answerable to easily create encrypted
partitions on
our devices and once we have those partitions mounted we can also use answer
able to easily
push out and create data within those encrypted drives which has really really
handy when dealing WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
handy when dealing
with sensitive data on a large scale.