WEBVTT

1
00:00.000 --> 00:04.330
So now what I want to turn your attention to is the concept of encryption on

2
00:04.330 --> 00:05.760
Linux based systems.

3
00:05.760 --> 00:10.560
So with encryption, what we can do is we can encrypt files on a file by file

4
00:10.560 --> 00:11.760
basis pretty much.

5
00:11.760 --> 00:16.640
We identify the file that is sensitive and we can subsequently protect via

6
00:16.640 --> 00:18.160
encryption. However,

7
00:18.160 --> 00:23.440
as you can imagine, this can be a little bit laborious and it's not exactly the

8
00:23.440 --> 00:24.400
most efficient way

9
00:24.400 --> 00:31.300
to protect your data. Instead, what you can use is something known as full disk
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

9
00:24.400 --> 00:31.300
to protect your data. Instead, what you can use is something known as full disk

10
00:31.300 --> 00:31.920
encryption.

11
00:31.920 --> 00:35.600
So what this means is that when you say, for example, power your device off,

12
00:35.600 --> 00:36.960
the entire contents

13
00:36.960 --> 00:41.270
are going to be protected via that encryption. So if someone happens to steal

14
00:41.270 --> 00:42.240
your laptop and

15
00:42.240 --> 00:46.760
it's turned off, even if they happen to have forensic tools, they still should

16
00:46.760 --> 00:47.680
not be able to

17
00:47.680 --> 00:51.490
access your data because of that encryption. We can ultimately implement the

18
00:51.490 --> 00:52.880
solution on Linux,

19
00:52.880 --> 00:57.840
utilizing something known as lock now. I maybe said that a little bit wrong. We

20
00:57.840 --> 00:58.960
don't actually

21
00:58.960 --> 01:03.990
use Lux in the respect that it's not actually a tool itself. Pretty much what
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

21
00:58.960 --> 01:03.990
use Lux in the respect that it's not actually a tool itself. Pretty much what

22
01:03.990 --> 01:05.120
Lux is. It's a type

23
01:05.120 --> 01:09.840
of standard or specification. This is really the real set that has been laid

24
01:09.840 --> 01:10.880
out that we want

25
01:10.880 --> 01:16.040
encryption tools to be compliant with. So Lux stands for the Linux Unified Key

26
01:16.040 --> 01:17.520
Set-Up and quite simply,

27
01:17.520 --> 01:21.700
there are a bunch of Lux compliant tools available for Linux. Let's actually

28
01:21.700 --> 01:22.800
discuss one of the

29
01:22.800 --> 01:27.840
options we actually have here. One of them is something known as correct setup.

30
01:27.840 --> 01:28.480
So let me briefly

31
01:28.480 --> 01:32.370
show you how we can set this up via the command line and then we'll transport
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

31
01:28.480 --> 01:32.370
show you how we can set this up via the command line and then we'll transport

32
01:32.370 --> 01:33.520
that information

33
01:33.520 --> 01:37.920
into deploying the encryption, utilizing Ansible. So let's go back to one of my

34
01:37.920 --> 01:38.720
target devices,

35
01:38.720 --> 01:43.520
my blue box right here. Now right now if I do an LSBLK dash F from the previous

36
01:43.520 --> 01:43.840
skill,

37
01:43.840 --> 01:48.080
we do actually have these two disks in use. They happen to be mounted in this

38
01:48.080 --> 01:49.600
particular directory

39
01:49.600 --> 01:53.700
and they happen to be formatted with XFS and part of a radar array. So all I'm

40
01:53.700 --> 01:54.160
going to do here is

41
01:54.160 --> 01:59.060
I will say pseudo U mount and unmount this particular directory. So now it is

42
01:59.060 --> 02:01.200
mounted to an LSBLK dash
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

42
01:59.060 --> 02:01.200
mounted to an LSBLK dash

43
02:01.200 --> 02:05.490
F. Now let me stop the radar array and let me just zero the super blocks. So

44
02:05.490 --> 02:06.400
let's go back to

45
02:06.400 --> 02:10.300
LSBLK dash F. Now we just have a regular disk again. What I'm going to do is I

46
02:10.300 --> 02:11.280
'm going to briefly

47
02:11.280 --> 02:14.820
create a partition on one of these disks and then I'll walk to the process of

48
02:14.820 --> 02:16.000
encryption. So all

49
02:16.000 --> 02:20.710
I will do here is I will target the second disk or say pseudo part it NVMe zero

50
02:20.710 --> 02:21.680
enter. Let's say

51
02:21.680 --> 02:28.320
MK label GPT or say MK part primary. Now we can see we've created partition one

52
02:28.320 --> 02:29.920
on disk number two.

53
02:29.920 --> 02:34.480
So what I can do here is I can say pseudo crypt setup and now I'm going to say
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

53
02:29.920 --> 02:34.480
So what I can do here is I can say pseudo crypt setup and now I'm going to say

54
02:34.480 --> 02:36.000
Lux format and

55
02:36.000 --> 02:40.710
then specify the device I want to target which is going to be dev NVMe zero

56
02:40.710 --> 02:42.080
enter P1 for partition

57
02:42.080 --> 02:46.060
number one. So if I hit enter it's going to override any data that is already

58
02:46.060 --> 02:46.880
on the disk.

59
02:46.880 --> 02:50.640
If I'm sure I will say yes and capital letters. So what I'm going to have to do

60
02:50.640 --> 02:51.680
is to write a pass

61
02:51.680 --> 02:55.440
phrase for this particular partition. So let's give you a random phrase of let

62
02:55.440 --> 02:56.240
's maybe go with

63
02:56.240 --> 03:03.280
red forest 45 and what's a red forest 45. Perfect. So if I now do an LSBLK dash
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

63
02:56.240 --> 03:03.280
red forest 45 and what's a red forest 45. Perfect. So if I now do an LSBLK dash

64
03:03.280 --> 03:04.400
F check this out right

65
03:04.400 --> 03:08.210
here we actually have this encrypted partition right now. So if I want this to

66
03:08.210 --> 03:08.960
be accessible

67
03:08.960 --> 03:13.240
away I can do this as I can say pseudo crypt setup open and then I specify the

68
03:13.240 --> 03:14.160
device that I want

69
03:14.160 --> 03:18.950
to target which is going to be dev NVMe zero enter P1 and now I'm going to give

70
03:18.950 --> 03:19.760
a name of the

71
03:19.760 --> 03:23.660
map device created by crypt setup. So let's just call this my partition okay

72
03:23.660 --> 03:24.480
the name itself

73
03:24.480 --> 03:27.830
doesn't actually matter so much and now I'm going to have to enter the pass

74
03:27.830 --> 03:29.120
phrase to access this

75
03:29.120 --> 03:34.320
so type in red forest 45 and I enter because I've typed the correct password we
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

75
03:29.120 --> 03:34.320
so type in red forest 45 and I enter because I've typed the correct password we

76
03:34.320 --> 03:35.600
now have access.

77
03:35.600 --> 03:40.170
So now do an LSBLK dash F here we can see the device that we have created my

78
03:40.170 --> 03:40.960
partition.

79
03:40.960 --> 03:45.280
So what I could do is I could create a file system on this particular partition

80
03:45.280 --> 03:46.000
. So let's now say

81
03:46.000 --> 03:52.160
pseudo MKFS dot XFS and then our target dev mapper and the name of my device

82
03:52.160 --> 03:53.120
happened to be my

83
03:53.120 --> 03:57.690
partition. So we write that now what I want to do is I want to mount my file

84
03:57.690 --> 03:58.640
system. So let me

85
03:58.640 --> 04:01.930
just create a directory let's just call it let's maybe say my mount point the
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

85
03:58.640 --> 04:01.930
just create a directory let's just call it let's maybe say my mount point the

86
04:01.930 --> 04:02.720
name itself doesn't

87
04:02.720 --> 04:07.280
actually matter so much and now it says pseudo mount dash T and it's an XFS

88
04:07.280 --> 04:08.320
based file system

89
04:08.320 --> 04:12.820
and I'm going to mount dev mapper my partition and I'm going to make it

90
04:12.820 --> 04:14.240
accessible via my mount

91
04:14.240 --> 04:19.480
point if I hit enter if I don't LSBLK dash F check this out right here we have

92
04:19.480 --> 04:20.560
my partition

93
04:20.560 --> 04:24.600
which is an XFS based file system and it's now available in this particular

94
04:24.600 --> 04:25.440
directory.

95
04:25.440 --> 04:29.610
We're now accessing this particular partition if I now say pseudo them and let

96
04:29.610 --> 04:30.320
's just create a
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

96
04:29.610 --> 04:30.320
's just create a

97
04:30.320 --> 04:34.530
file called private dot T XT going to insert more than just say this is some

98
04:34.530 --> 04:35.760
sensitive data escape

99
04:35.760 --> 04:40.510
colon wq write and quit here we have the particular file and we now have full

100
04:40.510 --> 04:41.440
access to this

101
04:41.440 --> 04:45.110
particular partition to write anything we so wish but the cool thing is if you

102
04:45.110 --> 04:46.400
want to protect it

103
04:46.400 --> 04:50.000
what we can do is we can leave the mount point so I'm a different directory and

104
04:50.000 --> 04:50.800
I can say pseudo

105
04:50.800 --> 04:55.660
U mounts and then on mount my mount point doing LSBLK dash F we can see it's no

106
04:55.660 --> 04:56.880
longer mounted so

107
04:56.880 --> 05:01.210
what I want to do here is I want to say pseudo crypt setup and I want to close
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

107
04:56.880 --> 05:01.210
what I want to do here is I want to say pseudo crypt setup and I want to close

108
05:01.210 --> 05:02.240
my partition

109
05:02.240 --> 05:06.510
and if I hit enter now the partition is now in its encrypted state again and if

110
05:06.510 --> 05:07.600
I want to access

111
05:07.600 --> 05:11.810
the data again I can just simply open it once more so I hit the enter key and

112
05:11.810 --> 05:12.320
now I'm going to

113
05:12.320 --> 05:16.120
have to type in the correct phrase if I happen to type in something wrong such

114
05:16.120 --> 05:17.120
as nuggets one which

115
05:17.120 --> 05:20.960
is the wrong password it's not going to give me access to the actual encrypted

116
05:20.960 --> 05:22.000
partition whereas

117
05:22.000 --> 05:26.310
if I type in red forest 45 and I enter as we can see here the device

118
05:26.310 --> 05:28.240
successfully loads and once

119
05:28.240 --> 05:32.610
again what that means is that we can mount it as such and to the mount point I
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

119
05:28.240 --> 05:32.610
again what that means is that we can mount it as such and to the mount point I

120
05:32.610 --> 05:33.360
then go into my

121
05:33.360 --> 05:37.250
mount point once again do an LS and now we can see here we have access to earth

122
05:37.250 --> 05:38.480
sensitive file

123
05:38.480 --> 05:42.160
so now that we know how encryption operates on Linux let's now see how to

124
05:42.160 --> 05:42.960
implement this type

125
05:42.960 --> 05:45.360
of technology utilizing Ansible