1
00:00:00,450 --> 00:00:01,358
Sometimes it'll be necessary

2
00:00:01,358 --> 00:00:05,190
to encrypt the data that we're using.

3
00:00:05,190 --> 00:00:07,320
Usually if the data is sensitive in nature,

4
00:00:07,320 --> 00:00:09,420
encryption is going to be our first go-to.

5
00:00:09,420 --> 00:00:11,550
So we're going to walk through how to do device

6
00:00:11,550 --> 00:00:14,490
and hold this encryption using the crypt setup,

7
00:00:14,490 --> 00:00:15,630
that's going to be our front end.

8
00:00:15,630 --> 00:00:17,970
And then we're going to be using the LUKS standard,

9
00:00:17,970 --> 00:00:22,050
which stand for the Linux Unified Key Setup system.

10
00:00:22,050 --> 00:00:24,240
That's what we're going to use to encrypt the data.

11
00:00:24,240 --> 00:00:25,320
The first thing we need to do,

12
00:00:25,320 --> 00:00:28,890
we actually need to unmount our backup data system.

13
00:00:28,890 --> 00:00:31,133
That's the one we're going to use for this example.

14
00:00:35,460 --> 00:00:36,720
All right, make sure that it's not mounted,

15
00:00:36,720 --> 00:00:38,220
so we're good to go there.

16
00:00:38,220 --> 00:00:39,060
So the first thing we need to do

17
00:00:39,060 --> 00:00:40,830
is go ahead and shred this data.

18
00:00:40,830 --> 00:00:41,700
And what that does is

19
00:00:41,700 --> 00:00:45,000
it overwrites it with a whole bunch of just random data

20
00:00:45,000 --> 00:00:47,550
to make sure that anything we have over there prior

21
00:00:47,550 --> 00:00:49,500
will be unrecoverable.

22
00:00:49,500 --> 00:00:53,700
Cause back in the day when a lot of magnetic tapes were used

23
00:00:53,700 --> 00:00:55,500
you were able to actually fetch the data

24
00:00:55,500 --> 00:00:56,813
after someone deleted it,

25
00:00:56,813 --> 00:00:59,850
because the problem is with magnetic information

26
00:00:59,850 --> 00:01:01,590
it's not fully removed.

27
00:01:01,590 --> 00:01:04,590
So this is just a good practice to make sure

28
00:01:04,590 --> 00:01:06,750
that we get rid of any sensitive data just in case

29
00:01:06,750 --> 00:01:08,760
there's someone wants to try to hull data

30
00:01:08,760 --> 00:01:11,310
from things that we've tried to erase.

31
00:01:11,310 --> 00:01:12,690
Next thing we want to do is go ahead and crypt

32
00:01:12,690 --> 00:01:15,960
the data back up with the pass phrase.

33
00:01:15,960 --> 00:01:16,793
New sudo

34
00:01:19,740 --> 00:01:20,573
crypt setup

35
00:01:23,310 --> 00:01:24,143
verbose.

36
00:01:25,560 --> 00:01:26,760
Enter it in LUKS format.

37
00:01:26,760 --> 00:01:27,870
So what that's going to do is go ahead

38
00:01:27,870 --> 00:01:31,590
and make this device formatted

39
00:01:31,590 --> 00:01:34,170
for the LUK standard.

40
00:01:34,170 --> 00:01:38,523
Remember that stands for the Linux Unified Key Setup.

41
00:01:41,160 --> 00:01:42,179
All right.

42
00:01:42,179 --> 00:01:43,713
All caps, yes.

43
00:01:45,180 --> 00:01:46,880
And we're going to put in a password.

44
00:01:55,140 --> 00:01:57,563
All right, that command went through successfully.

45
00:01:58,890 --> 00:02:01,560
Next thing we're going to do is use the LUKS open command.

46
00:02:01,560 --> 00:02:04,710
And what that does is it allows the system to map it.

47
00:02:04,710 --> 00:02:07,110
This is very similar to the LVM,

48
00:02:07,110 --> 00:02:08,430
or the logical volume mapper,

49
00:02:08,430 --> 00:02:09,780
so let's do that right now.

50
00:02:11,790 --> 00:02:12,633
Crypt set up.

51
00:02:15,300 --> 00:02:16,133
LUKS open.

52
00:02:24,720 --> 00:02:26,163
Name it, data back.

53
00:02:33,180 --> 00:02:36,030
All right, that went through successfully.

54
00:02:36,030 --> 00:02:41,030
You can check this by viewing the dev mapper.

55
00:02:41,100 --> 00:02:44,043
Remember that's where all the logical volumes are stored.

56
00:02:45,180 --> 00:02:46,380
I'm going to search for it.

57
00:02:49,080 --> 00:02:51,873
Okay, we see it listed there at the bottom.

58
00:02:54,630 --> 00:02:55,800
All right, next thing we have to do

59
00:02:55,800 --> 00:02:57,690
is make a file system on there.

60
00:02:57,690 --> 00:02:59,430
So we have to format it,

61
00:02:59,430 --> 00:03:03,220
and we're going to use the ext4 format

62
00:03:04,080 --> 00:03:07,473
dev mapper data back.

63
00:03:08,820 --> 00:03:11,103
Okay, that went through successfully.

64
00:03:12,450 --> 00:03:13,750
Next, we need to mount it.

65
00:03:23,700 --> 00:03:24,533
Back up.

66
00:03:27,690 --> 00:03:29,940
All right, we have that successfully mounted.

67
00:03:31,320 --> 00:03:33,060
Let's go ahead and create a file.

68
00:03:33,060 --> 00:03:34,770
Let's go ahead and create a file.

69
00:03:34,770 --> 00:03:36,750
Input some information in there.

70
00:03:36,750 --> 00:03:38,493
We're just going to put encrypted.

71
00:03:40,375 --> 00:03:42,600
Okay, we can use the tee command just to make sure

72
00:03:42,600 --> 00:03:44,050
it went through successfully.

73
00:03:51,000 --> 00:03:54,930
Encrypt data text.

74
00:03:54,930 --> 00:03:56,940
All right, so the text encrypted was input

75
00:03:56,940 --> 00:03:58,679
into the encrypt.txt.

76
00:03:58,679 --> 00:03:59,910
So we're going to use this file

77
00:03:59,910 --> 00:04:00,930
to test out to make sure

78
00:04:00,930 --> 00:04:03,000
that our encryption went through earlier

79
00:04:03,000 --> 00:04:04,620
and test this a little later.

80
00:04:04,620 --> 00:04:05,850
Okay, so next thing we need to do

81
00:04:05,850 --> 00:04:08,460
is add this information to the crypttab

82
00:04:08,460 --> 00:04:11,130
and the fstab files respectively.

83
00:04:11,130 --> 00:04:13,593
Now the crypttab is very similar to the fstab file,

84
00:04:13,593 --> 00:04:16,709
but it only deals with the encrypted volumes.

85
00:04:16,709 --> 00:04:18,930
So this is where our Linux is going to look at boot

86
00:04:18,930 --> 00:04:21,089
to see if there's any encrypted volumes

87
00:04:21,089 --> 00:04:22,440
that it needs to mount,

88
00:04:22,440 --> 00:04:24,120
so I use the pseudo bash command.

89
00:04:24,120 --> 00:04:26,340
And now the reason we're using this bash command is

90
00:04:26,340 --> 00:04:28,020
because we're about to use output direction

91
00:04:28,020 --> 00:04:30,930
which inherits the privilege of the current shell.

92
00:04:30,930 --> 00:04:33,060
That's why the standard pseudo command will not work.

93
00:04:33,060 --> 00:04:35,220
So we're going to need to use the bash dash C option

94
00:04:35,220 --> 00:04:36,444
to run the entire command

95
00:04:36,444 --> 00:04:39,513
as a new shell with pseudo privileges.

96
00:04:45,690 --> 00:04:47,370
None, now this specifies

97
00:04:47,370 --> 00:04:49,530
that we're not going to associate this file

98
00:04:49,530 --> 00:04:51,510
with the path to an encryption key.

99
00:04:51,510 --> 00:04:53,910
So we're going to have to input the passphrase

100
00:04:53,910 --> 00:04:55,310
whenever the system reboots.

101
00:04:56,190 --> 00:04:57,490
That's what the nun means.

102
00:05:00,810 --> 00:05:03,000
And now we see that that's the only thing in there.

103
00:05:03,000 --> 00:05:03,950
All right, perfect.

104
00:05:05,610 --> 00:05:09,370
Along with that, we're going to need to edit our fstab file

105
00:05:13,650 --> 00:05:16,533
so it knows to mount the data back,

106
00:05:18,390 --> 00:05:20,943
but we're going to use the mapper here.

107
00:05:22,590 --> 00:05:23,710
Okay, so we'll insert

108
00:05:26,340 --> 00:05:28,620
mapper data back,

109
00:05:28,620 --> 00:05:30,900
cause this is the one that we associated earlier

110
00:05:30,900 --> 00:05:32,200
when we created that file.

111
00:05:33,990 --> 00:05:36,930
We use that mount point ext4.

112
00:05:36,930 --> 00:05:38,970
Now we're going to change this right here.

113
00:05:38,970 --> 00:05:41,543
Instead of default, we're going to make this a no fail.

114
00:05:43,810 --> 00:05:46,800
And what that simply means is this will mount

115
00:05:46,800 --> 00:05:49,620
the encrypted volume after it has been unlocked.

116
00:05:49,620 --> 00:05:50,760
And it indicates to the system

117
00:05:50,760 --> 00:05:52,680
that it should not try to report any errors

118
00:05:52,680 --> 00:05:55,530
if the volume is not detected.

119
00:05:55,530 --> 00:05:56,363
All right.

120
00:06:00,450 --> 00:06:02,450
Now we're going to go ahead and reboot this

121
00:06:03,960 --> 00:06:05,103
and see if it works.

122
00:06:06,630 --> 00:06:08,490
Should be prompted for our password

123
00:06:08,490 --> 00:06:10,040
once the system gets in reboot.

124
00:06:17,640 --> 00:06:19,650
Okay, we see that drive was unlocked successfully,

125
00:06:19,650 --> 00:06:20,900
and we're able to reboot.

126
00:06:28,920 --> 00:06:29,753
Next, we can go ahead

127
00:06:29,753 --> 00:06:31,800
and just check that file that we created earlier

128
00:06:31,800 --> 00:06:33,450
just to make sure we can read it.

129
00:06:37,722 --> 00:06:40,110
All right, looks like we can read the plain text now.

130
00:06:40,110 --> 00:06:42,180
So we went over how to encrypt a disc

131
00:06:42,180 --> 00:06:44,040
and how to wipe it successfully.

132
00:06:44,040 --> 00:06:46,590
So make sure that we protect our sensitive data.

133
00:06:46,590 --> 00:06:48,000
Thank you for sticking with me through this walkthrough

134
00:06:48,000 --> 00:06:49,800
and I'll see you in the next lesson.