Crypt: Difference between revisions
No edit summary |
|||
| Line 3: | Line 3: | ||
== Encrypted Container (LUKS) over NFS == | == Encrypted Container (LUKS) over NFS == | ||
=== 1. Create the image on the server === | |||
=== 1. Create the image on | |||
<pre> | <pre> | ||
# 64 GiB pre-allocated image | # 64 GiB pre-allocated image | ||
| Line 14: | Line 9: | ||
</pre> | </pre> | ||
=== 2. Attach as loop device | === 2. Attach as loop device === | ||
<pre> | <pre> | ||
losetup -fP --show /mnt/sektor/.local/containers.img | losetup -fP --show /mnt/sektor/.local/containers.img | ||
| Line 44: | Line 39: | ||
</pre> | </pre> | ||
=== | === Open and close === | ||
<pre> | <pre> | ||
# Open | # Open | ||
| Line 59: | Line 54: | ||
=== Notes === | === Notes === | ||
* Encryption is AES-256-XTS via LUKS2 — hardware accelerated if CPU has AES-NI (<code>grep aes /proc/cpuinfo</code>) | * Encryption is AES-256-XTS via LUKS2 — hardware accelerated if CPU has AES-NI (<code>grep aes /proc/cpuinfo</code>) | ||
* | * Server never sees decrypted data — key lives on the Linux client only | ||
* NFS traffic is unencrypted | * NFS traffic is unencrypted on the wire | ||
* Never open the container from two clients simultaneously | * Never open the container from two clients simultaneously | ||
* Always close cleanly before shutdown — crash during idle/read is safe, crash during write risks the file being written | * Always close cleanly before shutdown — crash during idle/read is safe, crash during write risks the file being written | ||
* | * Don't lose the passphrase | ||
Latest revision as of 20:10, 31 August 2026
LUKS
Encrypted Container (LUKS) over NFS
1. Create the image on the server
# 64 GiB pre-allocated image dd if=/dev/zero of=/mnt/mainframe/.local/containers.img bs=1M count=65536 status=progress
2. Attach as loop device
losetup -fP --show /mnt/sektor/.local/containers.img # → note the device name, e.g. /dev/loop0
3. Format with LUKS2
cryptsetup luksFormat --type luks2 /dev/loop0 # Type YES and choose a strong passphrase
4. Open and create filesystem
cryptsetup open /dev/loop0 containers mkfs.ext4 /dev/mapper/containers
5. Mount
mkdir -p /mnt/rayden mount /dev/mapper/containers /mnt/rayden
6. Backup LUKS header — do this now
cryptsetup luksHeaderBackup /dev/loop0 --header-backup-file ~/containers-luks-header.bak # Move the .bak off the machine immediately
Open and close
# Open losetup -P /dev/loop0 /mnt/sektor/.local/containers.img cryptsetup open /dev/loop0 containers mount /dev/mapper/containers /mnt/rayden # Close umount /mnt/rayden cryptsetup close containers losetup -d /dev/loop0
Notes
- Encryption is AES-256-XTS via LUKS2 — hardware accelerated if CPU has AES-NI (
grep aes /proc/cpuinfo) - Server never sees decrypted data — key lives on the Linux client only
- NFS traffic is unencrypted on the wire
- Never open the container from two clients simultaneously
- Always close cleanly before shutdown — crash during idle/read is safe, crash during write risks the file being written
- Don't lose the passphrase