WEBVTT 1 00:00.000 --> 00:04.320 So now we understand that the basics behind encryption on Linux, let's now try 2 00:04.320 --> 00:05.120 to implement 3 00:05.120 --> 00:08.160 this type of solution directly using Ansible. 4 00:08.160 --> 00:11.910 Now the way we're actually going to do it in this particular video is we're 5 00:11.910 --> 00:12.240 going to 6 00:12.240 --> 00:16.000 use one of our all favorite solutions and that would be to construct the 7 00:16.000 --> 00:17.200 playbook utilizing 8 00:17.200 --> 00:18.560 an Ansible role. 9 00:18.560 --> 00:23.280 More specifically, we're going to be using the rail system roles. 10 00:23.280 --> 00:26.680 So once again, if you want to consult the documentation directly on your 11 00:26.680 --> 00:27.480 command line, 12 00:27.480 --> 00:30.520 you can go into user share dog rail system roles. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 12 00:27.480 --> 00:30.520 you can go into user share dog rail system roles. 13 00:30.520 --> 00:33.040 If we're done LS, I can go into the storage role. 14 00:33.040 --> 00:34.720 This is the one we're going to be using. 15 00:34.720 --> 00:39.160 And feel free to read the markdown page named readme.md. 16 00:39.160 --> 00:42.640 This is going to have all the information that you need to use this particular 17 00:42.640 --> 00:43.080 role. 18 00:43.080 --> 00:47.080 In my case though, I prefer to read it directly via GitHub. 19 00:47.080 --> 00:50.970 So I just searched for rail storage role, GitHub, and I'm going to click this 20 00:50.970 --> 00:51.360 top link 21 00:51.360 --> 00:51.920 right here. 22 00:51.920 --> 00:55.560 So if we scroll on down the get to the documentation, this has got all the same 23 00:55.560 --> 00:56.240 information that 24 00:56.240 --> 00:58.200 you see within the terminal. 25 00:58.200 --> 01:01.160 It's just presented a little bit, neither of my opinion. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 25 00:58.200 --> 01:01.160 It's just presented a little bit, neither of my opinion. 26 01:01.160 --> 01:04.600 And one of the variables we're going to have to set is the story volume. 27 01:04.600 --> 01:06.360 So let's go down to that right here. 28 01:06.360 --> 01:07.880 This one is what we're looking for. 29 01:07.880 --> 01:10.040 We can specify a name for the name of the volume. 30 01:10.040 --> 01:12.320 We can specify the type of volume we're going to be managing. 31 01:12.320 --> 01:14.560 In our case, it's going to be a disk. 32 01:14.560 --> 01:17.350 Although if you suggest you could be managing a read array, which we've just 33 01:17.350 --> 01:18.400 discussed previously, 34 01:18.400 --> 01:22.860 we can use the disk parameter to specify the set of disks that we want to be 35 01:22.860 --> 01:23.520 using. 36 01:23.520 --> 01:26.640 In the case here, I'm going to be using one of my new hard disks. 37 01:26.640 --> 01:29.560 So in the previous video, I was using NVMe0enter. 38 01:29.560 --> 01:35.040 And in this case, I'm just going to use a brand new fresh disk, which is NVMe0N WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 38 01:29.560 --> 01:35.040 And in this case, I'm just going to use a brand new fresh disk, which is NVMe0N 39 01:35.040 --> 01:35.400 3, the 40 01:35.400 --> 01:36.840 second disk I added. 41 01:36.840 --> 01:40.290 Now if I want to specify the file system that I want to be utilizing, I can 42 01:40.290 --> 01:41.240 specify that 43 01:41.240 --> 01:43.880 via the FS_type parameter. 44 01:43.880 --> 01:48.160 So if I want to use XFS or ext4, this would be where I would specify this. 45 01:48.160 --> 01:51.760 I can give the file system a name using FS_label. 46 01:51.760 --> 01:55.350 And very crucially after we have our encryption in play, we want to have the 47 01:55.350 --> 01:56.240 data accessible 48 01:56.240 --> 01:57.560 via a mount point. 49 01:57.560 --> 02:02.040 We can use the mount_point parameter to specify that target directory. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 49 01:57.560 --> 02:02.040 We can use the mount_point parameter to specify that target directory. 50 02:02.040 --> 02:05.870 So the previous keys we just discussed are all valuable and they will be used 51 02:05.870 --> 02:06.360 within our 52 02:06.360 --> 02:07.360 playbook. 53 02:07.360 --> 02:11.260 But it's this section right here that is really targeting the concept that we 54 02:11.260 --> 02:11.680 want to 55 02:11.680 --> 02:13.000 be looking at. 56 02:13.000 --> 02:14.920 This is all about our encryption. 57 02:14.920 --> 02:18.670 So straight away, we have our encryption key specifying whether the volume is 58 02:18.670 --> 02:19.240 going to be 59 02:19.240 --> 02:20.960 encrypted using Lux. 60 02:20.960 --> 02:24.980 Be aware though, is that if you happen to toggle this particular value, this is 61 02:24.980 --> 02:25.320 going 62 02:25.320 --> 02:28.280 to be a destructive operation pretty much. 63 02:28.280 --> 02:31.260 When you happen to undo the encryption, you're basically going to be removing WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 63 02:28.280 --> 02:31.260 When you happen to undo the encryption, you're basically going to be removing 64 02:31.260 --> 02:31.920 all the data 65 02:31.920 --> 02:32.920 on that volume. 66 02:32.920 --> 02:33.920 So be aware. 67 02:33.920 --> 02:37.340 Now in the previous video, we manually saw how we could create a password to 68 02:37.340 --> 02:37.720 protect 69 02:37.720 --> 02:38.720 our volume. 70 02:38.720 --> 02:43.600 I believe that I used the password red forest 45, just a random password. 71 02:43.600 --> 02:48.270 It is using this particular parameter here where we would specify that type of 72 02:48.270 --> 02:48.920 password 73 02:48.920 --> 02:49.920 information. 74 02:49.920 --> 02:53.230 If you want to be using key based encryption, you can use the encryption_key 75 02:53.230 --> 02:54.080 option to specify 76 02:54.080 --> 02:57.840 the path to the actual key that is going to unlock the volume itself. 77 02:57.840 --> 03:00.900 But in our case, we're going to keep it fairly simple and just use a passphrase WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 77 02:57.840 --> 03:00.900 But in our case, we're going to keep it fairly simple and just use a passphrase 78 03:00.900 --> 03:01.200 . 79 03:01.200 --> 03:05.210 Again, we have some additional options to specify the type of cipher we want to 80 03:05.210 --> 03:05.560 use as 81 03:05.560 --> 03:10.180 well as the key size and bits, as well as the actual Lux encryption version 82 03:10.180 --> 03:10.880 that we want 83 03:10.880 --> 03:11.880 to be using. 84 03:11.880 --> 03:13.720 So let's actually try to make this work them. 85 03:13.720 --> 03:16.410 So all we'll do is I'll quit out this page and I'll go back and I will just 86 03:16.410 --> 03:16.840 create a 87 03:16.840 --> 03:20.480 new playbook called play2.yml. 88 03:20.480 --> 03:23.220 So we're going to insert more to have our three hyphens at the top to denote 89 03:23.220 --> 03:23.640 the ammo 90 03:23.640 --> 03:24.640 file. 91 03:24.640 --> 03:25.840 We'll have a name for this playbook. 92 03:25.840 --> 03:30.800 Let's just call this play2 and we'll just say encrypts a partition. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 92 03:25.840 --> 03:30.800 Let's just call this play2 and we'll just say encrypts a partition. 93 03:30.800 --> 03:34.050 In this case, I'm just going to target one device, my blue box and I'm going to 94 03:34.050 --> 03:34.480 set gather 95 03:34.480 --> 03:37.360 facts to be the billion value false. 96 03:37.360 --> 03:41.300 Now I'm going to specify my variables that I'm going to be using and passing in 97 03:41.300 --> 03:41.720 to the 98 03:41.720 --> 03:45.880 storage role and the variable I want to set is going to be the storage 99 03:45.880 --> 03:47.400 underscore volumes. 100 03:47.400 --> 03:49.120 So let's give this a name. 101 03:49.120 --> 03:51.080 Let's just call this test volume. 102 03:51.080 --> 03:52.080 What is the media type? 103 03:52.080 --> 03:53.320 Well, it's going to be a disk. 104 03:53.320 --> 03:55.640 Let's specify the disks that are going to be in use. 105 03:55.640 --> 04:01.540 Now again, in my case here, if I go to my blue box, if I do an LS BLK dash F, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 105 03:55.640 --> 04:01.540 Now again, in my case here, if I go to my blue box, if I do an LS BLK dash F, 106 04:01.540 --> 04:02.280 it is this 107 04:02.280 --> 04:07.720 particular disk here, NVMe 0 and 3, which has nothing on it at all yet. 108 04:07.720 --> 04:11.190 This is a disk that I want to be targeting and effectively I want to create an 109 04:11.190 --> 04:11.800 encrypted 110 04:11.800 --> 04:16.480 partition on it as well as by the way, make it accessible via a mount point. 111 04:16.480 --> 04:19.880 So for me, this is going to be NVMe 0 and 3. 112 04:19.880 --> 04:23.480 Again, changes to suit whatever value you have on your particular system. 113 04:23.480 --> 04:25.800 I'll specify the file system type I want to be. 114 04:25.800 --> 04:29.920 It's going to be let's go with XFS here and let's give this a little label here 115 04:29.920 --> 04:30.360 , say WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 115 04:29.920 --> 04:30.360 , say 116 04:30.360 --> 04:31.520 file system label. 117 04:31.520 --> 04:35.600 Let's just call this test label of K, the name itself doesn't matter too much. 118 04:35.600 --> 04:39.030 Let's specify the mount point here and let's just mount this in the mount 119 04:39.030 --> 04:39.800 directory. 120 04:39.800 --> 04:42.960 In fact, if you just go to the target device, let's create a little directory 121 04:42.960 --> 04:43.600 just for that 122 04:43.600 --> 04:48.480 quickly and let's just do sudo mkdir and let's just call this one crypto dir. 123 04:48.480 --> 04:52.000 And of course, if you so wish, you could have easily created this directory 124 04:52.000 --> 04:52.640 using Ansible 125 04:52.640 --> 04:55.240 Directly, but nevertheless, let's go back to our playbook. 126 04:55.240 --> 04:58.380 So the mount point is going to be in crypto dir and now let's get to the 127 04:58.380 --> 04:59.200 encryption. 128 04:59.200 --> 05:02.740 What I will do is specify the keyword encryption and give the billion value WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 128 04:59.200 --> 05:02.740 What I will do is specify the keyword encryption and give the billion value 129 05:02.740 --> 05:03.240 true. 130 05:03.240 --> 05:07.040 Now I'm going to specify my encryption password and let's just give the 131 05:07.040 --> 05:07.480 password. 132 05:07.480 --> 05:12.020 Let's just go with green truck 78 doesn't actually matter so much and it goes 133 05:12.020 --> 05:12.240 without 134 05:12.240 --> 05:17.200 saying in a real live situation, you would not want to hard code this password. 135 05:17.200 --> 05:20.880 Now if you so wish, you could add in additional values such as the encryption 136 05:20.880 --> 05:21.560 key size or 137 05:21.560 --> 05:24.850 you could specify the path to the encryption key if you didn't want to use a 138 05:24.850 --> 05:25.560 password. 139 05:25.560 --> 05:29.650 But for now, let's keep things nice and simple and all it will do is I'll now 140 05:29.650 --> 05:30.520 go and call WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 140 05:29.650 --> 05:30.520 go and call 141 05:30.520 --> 05:31.760 the storage role. 142 05:31.760 --> 05:36.600 So let's say roles and then I'll say it rail system roles dot storage. 143 05:36.600 --> 05:39.520 So let's save this and let's try it running the playbook. 144 05:39.520 --> 05:43.330 So the playbook kicks off and we can see the modifications being made and the 145 05:43.330 --> 05:43.840 playbook 146 05:43.840 --> 05:44.840 completes. 147 05:44.840 --> 05:46.200 So let's go back to our device right now. 148 05:46.200 --> 05:51.520 And if I do an LSBOK dash F look at what we actually have down here on device 149 05:51.520 --> 05:51.880 number 150 05:51.880 --> 05:54.080 three, we have this encrypted partition. 151 05:54.080 --> 05:58.320 It has the XFS file system here is a test label and it has actually been 152 05:58.320 --> 05:59.120 mounted and 153 05:59.120 --> 06:01.640 is accessible via mount crypto dir. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 153 05:59.120 --> 06:01.640 is accessible via mount crypto dir. 154 06:01.640 --> 06:06.520 So what I can do therefore is I can go into CD, MNT, crypto dir and I can just 155 06:06.520 --> 06:07.320 say pseudo 156 06:07.320 --> 06:11.550 them and that just maybe create a file called file one dot txt going to type in 157 06:11.550 --> 06:12.360 my password 158 06:12.360 --> 06:17.360 go into insert mode and just say this is some secret stuff right in quits. 159 06:17.360 --> 06:20.840 There we have our file as we can see right now it is accessible to us. 160 06:20.840 --> 06:24.810 But if we so wish we could close down this partition and have it protected via 161 06:24.810 --> 06:25.920 the encryption. 162 06:25.920 --> 06:29.900 So let's see the other directory and I can say pseudo U mounts and target the 163 06:29.900 --> 06:30.680 mount crypto WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 163 06:29.900 --> 06:30.680 mount crypto 164 06:30.680 --> 06:31.680 directory. 165 06:31.680 --> 06:35.820 I can then say pseudo crypt setup and then close the partition and I can 166 06:35.820 --> 06:36.680 reference the 167 06:36.680 --> 06:41.780 locks container with this UUID right here just paste this in and to enter and 168 06:41.780 --> 06:42.080 now the 169 06:42.080 --> 06:44.000 partition is fully encrypted. 170 06:44.000 --> 06:47.550 And if I want to open it manually and test the password I can say pseudo crypt 171 06:47.550 --> 06:47.960 setup 172 06:47.960 --> 06:53.440 open and say dev N V M E zero N three and let's just give this a device name 173 06:53.440 --> 06:54.520 which is called 174 06:54.520 --> 06:55.520 my disk. 175 06:55.520 --> 06:57.160 Now I'm going to have to enter the passphrase. 176 06:57.160 --> 07:02.150 So if I type in something wrong such as random pass one it's going to be WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 176 06:57.160 --> 07:02.150 So if I type in something wrong such as random pass one it's going to be 177 07:02.150 --> 07:03.280 incorrect. 178 07:03.280 --> 07:06.920 However if I use the password be specified in the answerable playbook when we 179 07:06.920 --> 07:07.400 created 180 07:07.400 --> 07:12.310 this encrypted partition let's copy this and let's paste this in and to enter 181 07:12.310 --> 07:12.680 as we can 182 07:12.680 --> 07:14.840 see here we now get a success. 183 07:14.840 --> 07:19.620 So LSBLK dash F now we have access to the actual disk itself and I can now 184 07:19.620 --> 07:20.360 mount it by 185 07:20.360 --> 07:25.130 saying pseudo mount dev matter and this time I have named the device my disk 186 07:25.130 --> 07:25.760 and now I 187 07:25.760 --> 07:28.850 can specify the mount points let's put it in the same mount point as before I 188 07:28.850 --> 07:29.240 'll say 189 07:29.240 --> 07:34.900 MNT and it'll be encrypted and now if I see the enter the MNT crypto directory WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 189 07:29.240 --> 07:34.900 MNT and it'll be encrypted and now if I see the enter the MNT crypto directory 190 07:34.900 --> 07:35.680 and do an 191 07:35.680 --> 07:40.370 LS now we can see we have access to that secret file which was encrypted but 192 07:40.370 --> 07:41.000 now that 193 07:41.000 --> 07:45.260 it is open as we can see here we have access to that particular file. 194 07:45.260 --> 07:48.620 So as you can see this is how we can use answerable to easily create encrypted 195 07:48.620 --> 07:49.560 partitions on 196 07:49.560 --> 07:53.700 our devices and once we have those partitions mounted we can also use answer 197 07:53.700 --> 07:54.560 able to easily 198 07:54.560 --> 07:59.180 push out and create data within those encrypted drives which has really really 199 07:59.180 --> 08:00.160 handy when dealing WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 199 07:59.180 --> 08:00.160 handy when dealing 200 08:00.160 --> 08:02.560 with sensitive data on a large scale.