Mastering Linux Security and Hardening

The only missing piece of the puzzle is to configure the system to automatically mount the LUKS partition upon boot-up. To do that, I'll configure two different files:

/etc/crypttab
/etc/fstab

Had I not chosen to encrypt the disk when I installed the operating system, I wouldn't have a crypttab file, and I would have to create it myself. But, since I did choose to encrypt the drive, I already have one with information about that drive:

luks-2d7f02c7-864f-42ce-b362-50dd830d9772 UUID=2d7f02c7-864f-42ce-b362-50dd830d9772 none

The first two fields describe the name and location of the encrypted partition. The third field is for the encryption passphrase. If it's set to none, as it is here, then the passphrase will have to be manually entered upon boot-up.

In the fstab file, we have the entry that actually mounts the partition:

/dev/mapper/centos-root /                 xfs     defaults,x-systemd.device-timeout=0 0 0
UUID=9f9fbf9c-d046-44fc-a73e-ca854d0ca718 /boot                   xfs     defaults        0 0
/dev/mapper/centos-swap swap              swap    defaults,x-systemd.device-timeout=0 0 0

Well, there are actually two entries in this case, because I have two logical volumes, / and swap, on top of my encrypted physical volume. The UUID line is the /boot partition, which is the only part of the drive that isn't encrypted. Now, let's add our new encrypted partition so that it will mount automatically, as well.

This is where it would be extremely helpful to remotely log into your virtual machine from your desktop host machine. By using a GUI-type Terminal, whether it be the Terminal from a Linux or MacOS machine, or Cygwin from a Windows machine, you'll have the ability to perform copy-and-paste operations, which you won't have if you work directly from the virtual machine terminal. (Trust me, you don't want to be typing in those long UUIDs.)

The first step is to obtain the UUID of the encrypted partition:

[donnie@localhost etc]$ sudo cryptsetup luksUUID /dev/sdb1
[sudo] password for donnie:
6cbdce17-48d4-41a1-8f8e-793c0fa7c389
[donnie@localhost etc]$

I'll copy that UUID, and paste it into the /etc/crypttab file. (Note that you'll paste it in twice. The first time, you'll prepend it with luks-, and the second time you'll append it with UUID=.):

luks-2d7f02c7-864f-42ce-b362-50dd830d9772 UUID=2d7f02c7-864f-42ce-b362-50dd830d9772 none
luks-6cbdce17-48d4-41a1-8f8e-793c0fa7c389 UUID=6cbdce17-48d4-41a1-8f8e-793c0fa7c389 none

Finally, I'll edit the /etc/fstab file, adding the last line in the file for my new encrypted partition. (Note that I again used luks-, followed by the UUID number.):

/dev/mapper/centos-root / xfs defaults,x-systemd.device-timeout=0 0 0
UUID=9f9fbf9c-d046-44fc-a73e-ca854d0ca718 /boot xfs defaults 0 0
/dev/mapper/centos-swap swap swap defaults,x-systemd.device-timeout=0 0 0
/dev/mapper/luks-6cbdce17-48d4-41a1-8f8e-793c0fa7c389 /secrets xfs defaults 0 0

When editing the fstab file for adding normal, unencrypted partitions, I always like to do a sudo mount -a to check the fstab file for typos. That won't work with LUKS partitions though, because mount won't recognize the partition until the system reads in the crypttab file, and that won't happen until I reboot the machine. So, just be extra careful with editing fstab when adding LUKS partitions.

Now for the moment of truth. I'll reboot the machine to see if everything works.

Okay, the machine has rebooted, and mount shows that my endeavors have been successful:

[donnie@localhost ~]$ mount | grep 'secrets'
/dev/mapper/luks-6cbdce17-48d4-41a1-8f8e-793c0fa7c389 on /secrets type xfs (rw,relatime,seclabel,attr2,inode64,noquota)
[donnie@localhost ~]$

Table of Contents for
Mastering Linux Security and Hardening

Configuring the LUKS partition to mount automatically

Table of Contents for Mastering Linux Security and Hardening

Table of Contents for
Mastering Linux Security and Hardening