加载中…dm-crypt 在 openwrt上的使用
(2014-11-26 22:16:42)
标签：
it |
分类： linux |
Openwrt上使用dm-crypt
1.
Dm-crypt的介绍：
dm-crypt: a device-mapper crypto target
About
Device-mapper is a new infrastructure in the Linux
2.6 kernel that provides a generic way to create virtual layers of
block devices that can do different things on top of real block
devices like striping, concatenation, mirroring, snapshotting,
etc... The device-mapper is used by the
dm-crypt is such a device-mapper target that provides transparent
encryption of block devices using the new Linux 2.6 cryptoapi. The
user can basically specify one of the symmetric ciphers, a key (of
any allowed size), an iv generation mode and then the user can
create a new block device in /dev. Writes to this device will be
encrypted and reads decrypted. You can mount your filesystem on it
as usual. But without the key you can't access your data.
It does basically the same as cryptoloop only that it's a much
cleaner code and better suits the need of a block device and has a
more flexible configuration interface. The on-disk format is also
compatible. In the future you will be able to specify other iv
generation modes for enhanced security (you'll have to reencrypt
your filesystem though).
I've set up a
There's a mailing list at
Gmane
2. 在openwrt中的配置
2.1 Openwrt中默认不打开dm-crypt选项需要在
package/kernel/linux/modules/block.mk里的 改成红色部分
define KernelPackage/dm
Endef
检查一下Crypt.mk里要有如下
define KernelPackage/crypto-xts
endef
2.2 make
menuconfig 配置
Kernel
modules里
< >
kmod-aoe....................................... ATA over Ethernet
support
< >
kmod-ata-core............................ Serial and Parallel ATA
support
<*>
kmod-block2mtd................................ Block device MTD
emulation
-*-
kmod-dm.................................................... Device
Mapper
< >
kmod-ide-core............................. IDE (ATA/ATAPI) device
support
< >
kmod-md-mod......................................................
MD
RAID
< >
kmod-nbd.................................... Network block device
support
< > kmod-scsi-cdrom.......................
Kernel support for CD / DVD
drives
< >
kmod-scsi-generic........................ Kernel support for SCSI
generic
注意红色的部分
Loop功能是为了能把文件连接到loop设备中去
Cryptographic API
modules
kmod-crypto-aes.............................. AES cipher
CryptoAPI module
< >
kmod-crypto-authenc...................... Combined mode wrapper for
IPsec
< >
kmod-crypto-cbc................... Cipher Block Chaining CryptoAPI
module
< >
kmod-crypto-ecb..................... Electronic CodeBook CryptoAPI
module
< >
kmod-crypto-fcrypt........................ FCRYPT cipher CryptoAPI
module
-*-
kmod-crypto-hash.................................. CryptoAPI hash
support
< >
kmod-crypto-hw-padlock..... VIA PadLock ACE with AES/SHA hw crypto
module
< >
kmod-crypto-hw-talitos. Freescale integrated security engine (SEC)
driver
kmod-crypto-iv.......................... CryptoAPI
initialization
vectors
-*-
kmod-crypto-manager.......................... CryptoAPI algorithm
manager
< >
kmod-crypto-md4.............................. MD4 digest CryptoAPI
module
< >
kmod-crypto-md5.............................. MD5 digest CryptoAPI
module
< >
kmod-crypto-michael-mic........ Michael MIC keyed digest CryptoAPI
module
< >
kmod-crypto-misc................................. Other CryptoAPI
modules
< >
kmod-crypto-null................................... Null CryptoAPI
module
< >
kmod-crypto-ocf.............................................. OCF
modules
< >
kmod-crypto-pcbc...... Propagating Cipher Block Chaining CryptoAPI
module
-*-
kmod-crypto-pcompress....... CryptoAPI Partial (de)compression
operations
< >
kmod-crypto-rng....................... CryptoAPI random number
generation
< >
kmod-crypto-sha1............................ SHA1 digest CryptoAPI
module
< >
kmod-crypto-sha256................. SHA224 SHA256 digest CryptoAPI
module
< >
kmod-crypto-test................................... Test CryptoAPI
module
< >
kmod-crypto-user........................... CryptoAPI userspace
interface
< >
kmod-crypto-wq............................. CryptoAPI work queue
handling
kmod-crypto-xts.............................. XTS cipher
CryptoAPI
module
< >
kmod-cryptodev..................... Driver for cryptographic
acceleration
这些将编译出加密库
Filesystems
Native
Language Support
-*- kmod-nls-base
<*> kmod-nls-cp437
<*> kmod-nls-utf8
Libraries
{M}
libgcrypt............................................. GNU crypto
library
< >
libgd............................................ The GD graphics
library
< >
libgee.................................. GObject based collection
library
{M} libgpg-error......................... GnuPG error handling helper library
Utilities
cryptsetup.
losetup
3.
如何使用
3.1 在ubuntu上的操作
在ubuntu上建立好加密分区以方便在板子上直接加载
我们建立一个300M的文件
dd if=/dev/zero of=cryptsetup.img bs=1M count=300
对接到loop1里
losetup /dev/loop1 cryptsetup.img
建立加密设备，使用aes加密方式 这个命令要求输入密码的，假定为”12345678”
cryptsetup
成功的话看看有没有分区 /dev/mapper/crfs就是设备节点了
ls
/dev/mapper/crfs
格式化它
mkfs.ext4 /dev/mapper/crfs
加载分区到指定目录
mount /dev/mapper/crfs /mnt/crypt_mount
这就可以用了
Cd /mnt/crypt_mount
Mkdir test
Ps > ps.txt
我们生成几个测试文件
接下来我们反安装它，目的是让cryptsetup.img可以放到openwrt上直接使用
Umount
cryptsetup remove crfs
losetup -d /dev/loop1
这样cryptsetup.img文件就是一个ext4格式的加密文件了，可以在openwrt 上直接加载
3.2 在openwrt上的操作
需要的库和程序如下：
/lib/libgcrypt.so.20
/lib/libcryptsetup.so.4
/lib/libgpg-error.so.0
libcryptsetup.so.4 -> /mnt/udisk/dm/cryptsetup/usr/lib/libcryptsetup.so.4.5.0
libgcrypt.so.20 -> /mnt/udisk/dm/cryptsetup/usr/lib/libgcrypt.so.20.0.1
libgpg-error.so.0 -> /mnt/udisk/dm/cryptsetup/usr/lib/libgpg-error.so.0.10.0
gf128mul.ko
cbc.ko
xts.ko
cryptsetup
losetup
准备好上述的程序和库后进行如下操作，就可以挂接分区了
1.
losetup /dev/loop1 cryptsetup.img
echo 12345678 | cryptsetup
mount /dev/mapper/crfs /mnt/cryptdisk
好了，我们现在可以操作这个分区了
记得为root增加密码，把串口设置成需要登录，这样就不会有问题了
喜欢
0
赠金笔