Quick Start Guide

main
Robert 4 weeks ago
parent cd7239690d
commit 6a20799486
  1. 55
      README.MD

@ -1,53 +1,56 @@
# LUKS-Encrypted Disk Images on Linux # LUKS-Encrypted Disk Images on Linux
## NOTE: This will not work on an LXC unprivileged container!
To make it work inside an LXC: You’d need to modify your container config (as root on the host):
```
lxc.apparmor.profile = unconfined
lxc.cap.drop =
lxc.cgroup.devices.allow = b 7:* rwm # /dev/loop*
lxc.cgroup.devices.allow = c 10:237 rwm # /dev/mapper/control
lxc.mount.auto = proc:rw sys:rw
lxc.include = /usr/share/lxc/config/common.conf
```
And run the container as privileged (security.privileged = true).
Security warning: privileged LXC containers with these capabilities are essentially “mini-VMs” with host-level power. Not recommended on multi-tenant systems.
## Using your package manager: (apt, etc...) install the following: ## Using your package manager: (apt, etc...) install the following:
## Requires: cryptsetup, losetup, mount, umount, findmnt, blkid ## Requires: cryptsetup, losetup, mount, umount, findmnt, blkid
## Optional: VBoxManage (VirtualBox), virsh (libvirt) ## Optional: VBoxManage (VirtualBox), virsh (libvirt)
## 1st Make a symbloic link to your bin path:
```
sudo ln -s "$(pwd)/luks-img.sh" /usr/local/bin/
```
## Quick Starts ## Quick Starts
``` ```
1) Create & mount a new 4 GB encrypted image: 1) Create & mount a new 4 GB encrypted image:
sudo ./luks-img.sh create --file mydisk.img --size 4G sudo luks-img.sh create --file mydisk.img --size 4G
2) Open & mount an existing image: 2) Open & mount an existing image:
sudo ./luks-img.sh open --file mydisk.img --mount /mnt/luks sudo luks-img.sh open --file mydisk.img --mount /mnt/luks
3) Close (unmount, close mapper, detach loop): 3) Close (unmount, close mapper, detach loop):
sudo ./luks-img.sh close --file mydisk.img sudo luks-img.sh close --file mydisk.img
4) Backup the LUKS header: 4) Backup the LUKS header:
sudo ./luks-img.sh header-backup --file mydisk.img --out mydisk.header sudo luks-img.sh header-backup --file mydisk.img --out mydisk.header
*) Add a new key using an existing keyfile: *) Add a new key using an existing keyfile:
sudo ./luks-img.sh add-key --file mydisk.img --keyfile /path/newkey --existing-keyfile /path/oldkey sudo luks-img.sh add-key --file mydisk.img --keyfile /path/newkey --existing-keyfile /path/oldkey
``` ```
### If you want to add the image file to a VM: ### If you want to add the image file to a VM:
## Virtual Box: ## Virtual Box:
``` ```
sudo ./luks-img.sh launch-vbox --file mydisk.img --vm "Ubuntu VM" --start sudo luks-img.sh launch-vbox --file mydisk.img --vm "Ubuntu VM" --start
sudo ./luks-img.sh detach-vbox --vm "Ubuntu VM" sudo luks-img.sh detach-vbox --vm "Ubuntu VM"
``` ```
## libvirt/QEMU VM: ## libvirt/QEMU VM:
``` ```
sudo ./luks-img.sh attach-virt --file mydisk.img --vm myvm --target vdb --persistent sudo luks-img.sh attach-virt --file mydisk.img --vm myvm --target vdb --persistent
sudo ./luks-img.sh detach-virt --vm myvm --target vdb --persistent sudo luks-img.sh detach-virt --vm myvm --target vdb --persistent
```
## Please NOTE: This will not work on an LXC unprivileged container!
To make it work inside an LXC: You’d need to modify your container config (as root on the host):
``` ```
lxc.apparmor.profile = unconfined
lxc.cap.drop =
lxc.cgroup.devices.allow = b 7:* rwm # /dev/loop*
lxc.cgroup.devices.allow = c 10:237 rwm # /dev/mapper/control
lxc.mount.auto = proc:rw sys:rw
lxc.include = /usr/share/lxc/config/common.conf
```
And run the container as privileged (security.privileged = true).
Security warning: privileged LXC containers with these capabilities are essentially “mini-VMs” with host-level power. Not recommended on multi-tenant systems!!

Loading…
Cancel
Save