Sometimes it'll be necessary
to encrypt the data that we're using.
Usually if the data is sensitive in nature,
encryption is going to be our first go-to.
So we're going to walk through how to do device
and hold this encryption using the crypt setup,
that's going to be our front end.
And then we're going to be using the LUKS standard,
which stand for the Linux Unified Key Setup system.
That's what we're going to use to encrypt the data.
The first thing we need to do,
we actually need to unmount our backup data system.
That's the one we're going to use for this example.
All right, make sure that it's not mounted,
so we're good to go there.
So the first thing we need to do
is go ahead and shred this data.
And what that does is
it overwrites it with a whole bunch of just random data
to make sure that anything we have over there prior
will be unrecoverable.
Cause back in the day when a lot of magnetic tapes were used
you were able to actually fetch the data
after someone deleted it,
because the problem is with magnetic information
it's not fully removed.
So this is just a good practice to make sure
that we get rid of any sensitive data just in case
there's someone wants to try to hull data
from things that we've tried to erase.
Next thing we want to do is go ahead and crypt
the data back up with the pass phrase.
New sudo
crypt setup
verbose.
Enter it in LUKS format.
So what that's going to do is go ahead
and make this device formatted
for the LUK standard.
Remember that stands for the Linux Unified Key Setup.
All right.
All caps, yes.
And we're going to put in a password.
All right, that command went through successfully.
Next thing we're going to do is use the LUKS open command.
And what that does is it allows the system to map it.
This is very similar to the LVM,
or the logical volume mapper,
so let's do that right now.
Crypt set up.
LUKS open.
Name it, data back.
All right, that went through successfully.
You can check this by viewing the dev mapper.
Remember that's where all the logical volumes are stored.
I'm going to search for it.
Okay, we see it listed there at the bottom.
All right, next thing we have to do
is make a file system on there.
So we have to format it,
and we're going to use the ext4 format
dev mapper data back.
Okay, that went through successfully.
Next, we need to mount it.
Back up.
All right, we have that successfully mounted.
Let's go ahead and create a file.
Input some information in there.
We're just going to put encrypted.
Okay, we can use the tee command just to make sure
it went through successfully.
Encrypt data text.
All right, so the text encrypted was input
into the encrypt.txt.
So we're going to use this file
to test out to make sure
that our encryption went through earlier
and test this a little later.
Okay, so next thing we need to do
is add this information to the crypttab
and the fstab files respectively.
Now the crypttab is very similar to the fstab file,
but it only deals with the encrypted volumes.
So this is where our Linux is going to look at boot
to see if there's any encrypted volumes
that it needs to mount,
so I use the pseudo bash command.
And now the reason we're using this bash command is
because we're about to use output direction
which inherits the privilege of the current shell.
That's why the standard pseudo command will not work.
So we're going to need to use the bash dash C option
to run the entire command
as a new shell with pseudo privileges.
None, now this specifies
that we're not going to associate this file
with the path to an encryption key.
So we're going to have to input the passphrase
whenever the system reboots.
That's what the nun means.
And now we see that that's the only thing in there.
All right, perfect.
Along with that, we're going to need to edit our fstab file
so it knows to mount the data back,
but we're going to use the mapper here.
Okay, so we'll insert
mapper data back,
cause this is the one that we associated earlier
when we created that file.
We use that mount point ext4.
Now we're going to change this right here.
Instead of default, we're going to make this a no fail.
And what that simply means is this will mount
the encrypted volume after it has been unlocked.
And it indicates to the system
that it should not try to report any errors
if the volume is not detected.
All right.
Now we're going to go ahead and reboot this
and see if it works.
Should be prompted for our password
once the system gets in reboot.
Okay, we see that drive was unlocked successfully,
and we're able to reboot.
Next, we can go ahead
and just check that file that we created earlier
just to make sure we can read it.
All right, looks like we can read the plain text now.
So we went over how to encrypt a disc
and how to wipe it successfully.
So make sure that we protect our sensitive data.
Thank you for sticking with me through this walkthrough
and I'll see you in the next lesson.