Debian with luks - Revision history

FilipeFonseca at 07:02, 14 July 2021

2021-07-14T07:02:13Z

← Older revision		Revision as of 07:02, 14 July 2021
Line 8:		Line 8:

	== Install ==		== Install ==
	;1. Download [https://cdimage.debian.org/debian-cd/current/amd64/iso-cd/debian-10.10.0-amd64-netinst.iso \| Debian 10 ISO] image and burn it to a CD or create a bootable USB drive. Place the CD/USB in your appropriate drive, power on the machine and instruct the BIOS to boot from the CD/USB drive.		;1. Download [https://cdimage.debian.org/debian-cd/current/amd64/iso-cd/debian-10.10.0-amd64-netinst.iso Debian 10 ISO] image and burn it to a CD or create a bootable USB drive. Place the CD/USB in your appropriate drive, power on the machine and instruct the BIOS to boot from the CD/USB drive.

	:Once the system boots up the Debian installation media, choose Install from the first screen and press Enter key to move forward.		:Once the system boots up the Debian installation media, choose Install from the first screen and press Enter key to move forward.

FilipeFonseca at 07:01, 14 July 2021

2021-07-14T07:01:53Z

← Older revision		Revision as of 07:01, 14 July 2021
Line 8:		Line 8:

	== Install ==		== Install ==
	;1. Download [https://cdimage.debian.org/debian-cd/current/amd64/iso-cd/debian-10.10.0-amd64-netinst.iso\| Debian 10 ISO] image and burn it to a CD or create a bootable USB drive. Place the CD/USB in your appropriate drive, power on the machine and instruct the BIOS to boot from the CD/USB drive.		;1. Download [https://cdimage.debian.org/debian-cd/current/amd64/iso-cd/debian-10.10.0-amd64-netinst.iso \| Debian 10 ISO] image and burn it to a CD or create a bootable USB drive. Place the CD/USB in your appropriate drive, power on the machine and instruct the BIOS to boot from the CD/USB drive.

	:Once the system boots up the Debian installation media, choose Install from the first screen and press Enter key to move forward.		:Once the system boots up the Debian installation media, choose Install from the first screen and press Enter key to move forward.

FilipeFonseca at 09:46, 13 July 2021

2021-07-13T09:46:43Z

← Older revision		Revision as of 09:46, 13 July 2021
Line 8:		Line 8:

	== Install ==		== Install ==
	;1. Download [https://cdimage.debian.org/debian-cd/current/amd64/iso-cd/debian-10.10.0-amd64-netinst.iso\|Debian 10 ISO] image and burn it to a CD or create a bootable USB drive. Place the CD/USB in your appropriate drive, power on the machine and instruct the BIOS to boot from the CD/USB drive.		;1. Download [https://cdimage.debian.org/debian-cd/current/amd64/iso-cd/debian-10.10.0-amd64-netinst.iso\| Debian 10 ISO] image and burn it to a CD or create a bootable USB drive. Place the CD/USB in your appropriate drive, power on the machine and instruct the BIOS to boot from the CD/USB drive.

	:Once the system boots up the Debian installation media, choose Install from the first screen and press Enter key to move forward.		:Once the system boots up the Debian installation media, choose Install from the first screen and press Enter key to move forward.

FilipeFonseca at 09:46, 13 July 2021

2021-07-13T09:46:19Z

← Older revision		Revision as of 09:46, 13 July 2021
Line 8:		Line 8:

	== Install ==		== Install ==
	;1. Download [[https://cdimage.debian.org/debian-cd/current/amd64/iso-cd/debian-10.10.0-amd64-netinst.iso\|Debian 10 ISO]] image and burn it to a CD or create a bootable USB drive. Place the CD/USB in your appropriate drive, power on the machine and instruct the BIOS to boot from the CD/USB drive.		;1. Download [https://cdimage.debian.org/debian-cd/current/amd64/iso-cd/debian-10.10.0-amd64-netinst.iso\|Debian 10 ISO] image and burn it to a CD or create a bootable USB drive. Place the CD/USB in your appropriate drive, power on the machine and instruct the BIOS to boot from the CD/USB drive.

	:Once the system boots up the Debian installation media, choose Install from the first screen and press Enter key to move forward.		:Once the system boots up the Debian installation media, choose Install from the first screen and press Enter key to move forward.

FilipeFonseca at 09:45, 13 July 2021

2021-07-13T09:45:43Z

← Older revision		Revision as of 09:45, 13 July 2021
Line 5:		Line 5:
	Still, one of the facilities of using LUKS encryption is that you can use a decryption key on the boot process to automatically unlock, decrypt and mount the encrypted partitions, without the need to always type a prompt passphrase at system boot (especially if you are connecting remotely through SSH).		Still, one of the facilities of using LUKS encryption is that you can use a decryption key on the boot process to automatically unlock, decrypt and mount the encrypted partitions, without the need to always type a prompt passphrase at system boot (especially if you are connecting remotely through SSH).

	You might ask, why only encrypt the /var and /home partitions and not the entire file system. One argument would be that /home and /var partitions contain, in most cases, sensitive data. While /home partition stores users data, the /var partition stores databases information (typically MySQL database files are located here), log files, websites data files, mail files and other, information that can be easily accessed once a third-party gains physical access to your hard drives. For security purposes, /root and swap are also encrypted. Swap ~~hold dencryption~~ headers somewhere, and the /root... no more comments here.		You might ask, why only encrypt the /var and /home partitions and not the entire file system. One argument would be that /home and /var partitions contain, in most cases, sensitive data. While /home partition stores users data, the /var partition stores databases information (typically MySQL database files are located here), log files, websites data files, mail files and other, information that can be easily accessed once a third-party gains physical access to your hard drives. For security purposes, /root and swap are also encrypted. Swap holds decryption headers somewhere, and the /root, well just safekeep... no more comments here.

	== Install ==		== Install ==
	;1. Download ~~Debian~~ 10.10 ISO image and burn it to a CD or create a bootable USB drive. Place the CD/USB in your appropriate drive, power on the machine and instruct the BIOS to boot from the CD/USB drive.		;1. Download [[https://cdimage.debian.org/debian-cd/current/amd64/iso-cd/debian-10.10.0-amd64-netinst.iso\|Debian 10 ISO]] image and burn it to a CD or create a bootable USB drive. Place the CD/USB in your appropriate drive, power on the machine and instruct the BIOS to boot from the CD/USB drive.

	:Once the system boots up the Debian installation media, choose Install from the first screen and press Enter key to move forward.		:Once the system boots up the Debian installation media, choose Install from the first screen and press Enter key to move forward.

FilipeFonseca at 09:22, 13 July 2021

2021-07-13T09:22:10Z

← Older revision		Revision as of 09:22, 13 July 2021
Line 1:		Line 1:
	This tutorial will guide you on installing latest release of Debian 10 (codename Buster) with swap, /home, /root and /var LVM partitions encrypted on top of a LUKS encrypted physical volume.		This tutorial will guide you on installing latest release of Debian 10 (codename Buster) with swap, /home, /root and /var LVM partitions encrypted on top of a LUKS encrypted physical volume.

	LUKS, an acronym for Linux Unified Key Setup, offers a standard for Linux hard disk block encryption and stores all the setup data in the partition header. If somehow, the LUKS partition header is tampered, damaged or overwritten in any way, the encrypted data that reside onto this partition is lost.		LUKS, an acronym for [[w:Linux Unified Key Setup\|Linux Unified Key Setup]], offers a standard for Linux hard disk block encryption and stores all the setup data in the partition header. If somehow, the LUKS partition header is tampered, damaged or overwritten in any way, the encrypted data that reside onto this partition is lost.

	Still, one of the facilities of using LUKS encryption is that you can use a decryption key on the boot process to automatically unlock, decrypt and mount the encrypted partitions, without the need to always type a prompt passphrase at system boot (especially if you are connecting remotely through SSH).		Still, one of the facilities of using LUKS encryption is that you can use a decryption key on the boot process to automatically unlock, decrypt and mount the encrypted partitions, without the need to always type a prompt passphrase at system boot (especially if you are connecting remotely through SSH).

FilipeFonseca at 22:07, 12 July 2021

2021-07-12T22:07:48Z

← Older revision		Revision as of 22:07, 12 July 2021
Line 129:		Line 129:
	[[File:Debian with luks 50.jpg\|400px\|center\|thumb\| Overview of Current Partition]]		[[File:Debian with luks 50.jpg\|400px\|center\|thumb\| Overview of Current Partition]]
	[[File:Debian with luks 51.jpg\|400px\|center\|thumb\| Write Changes to Format Disk]]		[[File:Debian with luks 51.jpg\|400px\|center\|thumb\| Write Changes to Format Disk]]
			[[File:Debian with luks 52.jpg\|400px\|center\|thumb\| Adittional Media]]

	;19. That’s all for the partitioning scheme in order to run LVM encrypted partitions on top of an encrypted volume.		;19. That’s all for the partitioning scheme in order to run LVM encrypted partitions on top of an encrypted volume.
	After the base system is installed, select a Debian archive mirror country for repositories. If the machine is directly connected to Internet and you do not use a proxy server to gain Internet access, hit on Continue at HTTP proxy information.		After the base system is installed, select a Debian archive mirror country for repositories. If the machine is directly connected to Internet and you do not use a proxy server to gain Internet access, hit on Continue at HTTP proxy information.
	[[File:Debian with luks 52.jpg\|400px\|center\|thumb\| Configure Package Manager]]		[[File:Debian with luks 53.jpg\|400px\|center\|thumb\| Configure Package Manager]]
	[[File:Debian with luks 53.jpg\|400px\|center\|thumb\| Select Location of Repository]]		[[File:Debian with luks 54.jpg\|400px\|center\|thumb\| Select Location of Repository]]
	[[File:Debian with luks 54.jpg\|400px\|center\|thumb\| Configure HTTP Proxy]]		[[File:Debian with luks 55.jpg\|400px\|center\|thumb\| Configure HTTP Proxy]]

	;20. After the installer will configure the apt repositories a new prompt should appear demanding to participate in the package usage survey. Choose No to continue and select the software you want to install further.		;20. After the installer will configure the apt repositories a new prompt should appear demanding to participate in the package usage survey. Choose No to continue and select the software you want to install further.

FilipeFonseca at 22:05, 12 July 2021

2021-07-12T22:05:22Z

FilipeFonseca at 21:58, 12 July 2021

2021-07-12T21:58:32Z

← Older revision		Revision as of 21:58, 12 July 2021
Line 126:		Line 126:

	;18. Repeat the above steps for remaining Logical Volume with the following settings		;18. Repeat the above steps for remaining Logical Volume with the following settings
	Again, after you finish setting up swap, /root, /home and /var partition hit the Done setting up the partition to return to main Partition menu, review the partitions for a last time, and, if everything is in the right place, move to Finish partitioning and write changes to disk and choose No at the next prompt (Return to partitioning menu) and Yes in order to format the partitions, write changes to disk and continue with the installation process.		Again, after you finish setting up swap, /root, /home and /var partition hit the Done setting up the partition to return to main Partition menu, review the partitions for a last time, and, if everything is in the right place, move to Finish partitioning and write changes to disk and choose No at the next prompt (Return to partitioning menu) and Yes in order to format the partitions, write changes to disk and continue with the installation process. After base-system is complete, select no to skip another image sources.
	[[File:Debian with luks 50.jpg\|400px\|center\|thumb\| Overview of Current Partition]]		[[File:Debian with luks 50.jpg\|400px\|center\|thumb\| Overview of Current Partition]]
	[[File:Debian with luks 51.jpg\|400px\|center\|thumb\| Finish LVM Partitioning]]		[[File:Debian with luks 51.jpg\|400px\|center\|thumb\| Finish LVM Partitioning]]

FilipeFonseca at 21:44, 12 July 2021

2021-07-12T21:44:12Z

← Older revision		Revision as of 21:44, 12 July 2021
Line 161:		Line 161:
	<syntaxhighlight lang="bash">		<syntaxhighlight lang="bash">
	# GENERATE KEY		# GENERATE KEY
	dd if=/dev/urandom of=cryptkey bs=512 count=1		dd if=/dev/urandom of=/cryptkey-sys bs=512 count=1
	# SECURE KEY		# SECURE KEY
	chmod 700 cryptkey		chmod 700 /cryptkey-sys
	</syntaxhighlight>		</syntaxhighlight>
	[[File:Debian with luks 62.jpg\|400px\|center\|thumb\| Auto Mount Encrypted Partitions]]		[[File:Debian with luks 62.jpg\|400px\|center\|thumb\| Auto Mount Encrypted Partitions]]
			This file must be accessible from boot, so it must be place on unencrypted partition.
	;24. After the key has been created, open and edit /etc/crypttab file and replace none parameter with the absolute system path to your key as in the following screenshot:		;24. After the key has been created, open and edit /etc/crypttab file and replace none parameter with the absolute system path to your key as in the following screenshot:
	<syntaxhighlight lang="bash">		<syntaxhighlight lang="bash">
Line 176:		Line 176:
	<syntaxhighlight lang="bash">		<syntaxhighlight lang="bash">
	# ADD KEY		# ADD KEY
	cryptsetup luksAddKey /dev/~~sda5~~ /root/cryptkey		cryptsetup luksAddKey /dev/xvda5 /root/cryptkey-sys
	#CHECK KEY		#CHECK KEY
	cryptsetup luksDump /dev/~~sda5~~		cryptsetup luksDump /dev/xvda5
	</syntaxhighlight>		</syntaxhighlight>
	[[File:Debian with luks 64.jpg\|400px\|center\|thumb\| Add Key to Encrypted Luks]]		[[File:Debian with luks 64.jpg\|400px\|center\|thumb\| Add Key to Encrypted Luks]]
	[[File:Debian with luks 65.jpg\|400px\|center\|thumb\| Encrypted Key]]		[[File:Debian with luks 65.jpg\|400px\|center\|thumb\| Encrypted Key]]

	That’s it! On the next boot up process, the encrypted partitions will be automatically unlocked and mounted with the below decryption key~~. All sensitive data stored in /home and /var partitions will be highly secured in case someone gains physical access to your machine hard-drive~~.		That’s it! On the next boot up process, the encrypted partitions will be automatically unlocked and mounted with the below decryption key.

	Be aware that if you lose the decryption key or you forget the passphrase set during installation process the data stored onto the encrypted partitions cannot be recovered and will be forever lost, so you should take precaution and regular backup data, preferably to an encrypted device also.		Be aware that if you lose the decryption key or you forget the passphrase set during installation process the data stored onto the encrypted partitions cannot be recovered and will be forever lost, so you should take precaution and regular backup data, preferably to an encrypted device also.

← Older revision		Revision as of 22:07, 12 July 2021
Line 129:		Line 129:
	[[File:Debian with luks 50.jpg\|400px\|center\|thumb\| Overview of Current Partition]]		[[File:Debian with luks 50.jpg\|400px\|center\|thumb\| Overview of Current Partition]]
	[[File:Debian with luks 51.jpg\|400px\|center\|thumb\| Write Changes to Format Disk]]		[[File:Debian with luks 51.jpg\|400px\|center\|thumb\| Write Changes to Format Disk]]
			[[File:Debian with luks 52.jpg\|400px\|center\|thumb\| Adittional Media]]

	;19. That’s all for the partitioning scheme in order to run LVM encrypted partitions on top of an encrypted volume.		;19. That’s all for the partitioning scheme in order to run LVM encrypted partitions on top of an encrypted volume.
	After the base system is installed, select a Debian archive mirror country for repositories. If the machine is directly connected to Internet and you do not use a proxy server to gain Internet access, hit on Continue at HTTP proxy information.		After the base system is installed, select a Debian archive mirror country for repositories. If the machine is directly connected to Internet and you do not use a proxy server to gain Internet access, hit on Continue at HTTP proxy information.
	[[File:Debian with luks 52.jpg\|400px\|center\|thumb\| Configure Package Manager]]		[[File:Debian with luks 53.jpg\|400px\|center\|thumb\| Configure Package Manager]]
	[[File:Debian with luks 53.jpg\|400px\|center\|thumb\| Select Location of Repository]]		[[File:Debian with luks 54.jpg\|400px\|center\|thumb\| Select Location of Repository]]
	[[File:Debian with luks 54.jpg\|400px\|center\|thumb\| Configure HTTP Proxy]]		[[File:Debian with luks 55.jpg\|400px\|center\|thumb\| Configure HTTP Proxy]]

	;20. After the installer will configure the apt repositories a new prompt should appear demanding to participate in the package usage survey. Choose No to continue and select the software you want to install further.		;20. After the installer will configure the apt repositories a new prompt should appear demanding to participate in the package usage survey. Choose No to continue and select the software you want to install further.

← Older revision		Revision as of 22:05, 12 July 2021
Line 128:		Line 128:
	Again, after you finish setting up swap, /root, /home and /var partition hit the Done setting up the partition to return to main Partition menu, review the partitions for a last time, and, if everything is in the right place, move to Finish partitioning and write changes to disk and choose No at the next prompt (Return to partitioning menu) and Yes in order to format the partitions, write changes to disk and continue with the installation process. After base-system is complete, select no to skip another image sources.		Again, after you finish setting up swap, /root, /home and /var partition hit the Done setting up the partition to return to main Partition menu, review the partitions for a last time, and, if everything is in the right place, move to Finish partitioning and write changes to disk and choose No at the next prompt (Return to partitioning menu) and Yes in order to format the partitions, write changes to disk and continue with the installation process. After base-system is complete, select no to skip another image sources.
	[[File:Debian with luks 50.jpg\|400px\|center\|thumb\| Overview of Current Partition]]		[[File:Debian with luks 50.jpg\|400px\|center\|thumb\| Overview of Current Partition]]
	[[File:Debian with luks 51~~.jpg\|400px\|center\|thumb\| Finish LVM Partitioning]]~~		[[File:Debian with luks 51.jpg\|400px\|center\|thumb\| Write Changes to Format Disk]]
	~~[[File:Debian with luks 52~~.jpg\|400px\|center\|thumb\| Write Changes to Format Disk]]

	;19. That’s all for the partitioning scheme in order to run LVM encrypted partitions on top of an encrypted volume.		;19. That’s all for the partitioning scheme in order to run LVM encrypted partitions on top of an encrypted volume.
	After the base system is installed, select a Debian archive mirror country for repositories. If the machine is directly connected to Internet and you do not use a proxy server to gain Internet access, hit on Continue at HTTP proxy information.		After the base system is installed, select a Debian archive mirror country for repositories. If the machine is directly connected to Internet and you do not use a proxy server to gain Internet access, hit on Continue at HTTP proxy information.
	[[File:Debian with luks 53.jpg\|400px\|center\|thumb\| Configure Package Manager]]		[[File:Debian with luks 52.jpg\|400px\|center\|thumb\| Configure Package Manager]]
	[[File:Debian with luks 54.jpg\|400px\|center\|thumb\| Select Location of Repository]]		[[File:Debian with luks 53.jpg\|400px\|center\|thumb\| Select Location of Repository]]
	[[File:Debian with luks 55.jpg\|400px\|center\|thumb\| Configure HTTP Proxy]]		[[File:Debian with luks 54.jpg\|400px\|center\|thumb\| Configure HTTP Proxy]]

	;20. After the installer will configure the apt repositories a new prompt should appear demanding to participate in the package usage survey. Choose No to continue and select the software you want to install further.		;20. After the installer will configure the apt repositories a new prompt should appear demanding to participate in the package usage survey. Choose No to continue and select the software you want to install further.
Line 166:		Line 165:
	</syntaxhighlight>		</syntaxhighlight>
	[[File:Debian with luks 62.jpg\|400px\|center\|thumb\| Auto Mount Encrypted Partitions]]		[[File:Debian with luks 62.jpg\|400px\|center\|thumb\| Auto Mount Encrypted Partitions]]
	This file must be accessible from boot, so it must be ~~place~~ on unencrypted partition.		This file must be accessible from boot, so it must be placed on unencrypted partition.
	;24. After the key has been created, open and edit /etc/crypttab file and replace none parameter with the absolute system path to your key as in the following screenshot:		;24. After the key has been created, open and edit /etc/crypttab file and replace none parameter with the absolute system path to your key as in the following screenshot:
	<syntaxhighlight lang="bash">		<syntaxhighlight lang="bash">