20.6. 使用 LUKS2 加密空白块设备

流程

1. 将分区设置为加密的 LUKS 分区：

   # cryptsetup luksFormat /dev/nvme0n1p1
   
   WARNING!
   ========
   This will overwrite data on /dev/nvme0n1p1 irrevocably.
   Are you sure? (Type 'yes' in capital letters): YES
   Enter passphrase for /dev/nvme0n1p1:
   Verify passphrase:

2. 打开加密的 LUKS 分区：

   # cryptsetup open /dev/nvme0n1p1 nvme0n1p1_encrypted
   
   Enter passphrase for /dev/nvme0n1p1:

   这会解锁分区，并使用设备映射器将其映射到新设备。要不覆盖加密的数据，这个命令会警告内核，该设备是一个加密设备，并使用 /dev/mapper/device_mapped_name 路径通过 LUKS 来解决。

3. 创建一个文件系统来将加密的数据写入分区，该分区必须可通过设备映射名称访问：

   # mkfs -t ext4 /dev/mapper/nvme0n1p1_encrypted

4. 挂载该设备：

   # mount /dev/mapper/nvme0n1p1_encrypted mount-point

验证

1. 验证空白块设备是否已加密：

   # cryptsetup luksDump /dev/nvme0n1p1
   
   LUKS header information
   Version:       	2
   Epoch:         	3
   Metadata area: 	16384 [bytes]
   Keyslots area: 	16744448 [bytes]
   UUID:          	34ce4870-ffdf-467c-9a9e-345a53ed8a25
   Label:         	(no label)
   Subsystem:     	(no subsystem)
   Flags:       	(no flags)
   
   Data segments:
     0: crypt
   	offset: 16777216 [bytes]
   	length: (whole device)
   	cipher: aes-xts-plain64
   	sector: 512 [bytes]
   [...]

2. 查看加密的空白块设备的状态：

   # cryptsetup status nvme0n1p1_encrypted
   
   /dev/mapper/nvme0n1p1_encrypted is active and is in use.
     type:    LUKS2
     cipher:  aes-xts-plain64
     keysize: 512 bits
     key location: keyring
     device:  /dev/nvme0n1p1
     sector size:  512
     offset:  32768 sectors
     size:    20938752 sectors
     mode:    read/write