Fedora - Getting started with Stratis encryption

Fedora - Getting started with Stratis encryption - Printable Version

+- Sick Gaming (https://www.sickgaming.net)
+-- Forum: Computers (https://www.sickgaming.net/forum-86.html)
+--- Forum: Linux, FreeBSD, and Unix types (https://www.sickgaming.net/forum-88.html)
+--- Thread: Fedora - Getting started with Stratis encryption (/thread-98180.html)

Fedora - Getting started with Stratis encryption - xSicKxBot - 11-09-2020

Getting started with Stratis encryption

<div>Stratis is described on its <a rel="noreferrer noopener" href="https://stratis-storage.github.io/" target="_blank">official website</a> as an “easy to use local storage management for Linux.” See this <a rel="noreferrer noopener" href="https://www.youtube.com/watch?v=CJu3kmY-f5o" target="_blank">short video</a> for a quick demonstration of the basics. The video was recorded on a Red Hat Enterprise Linux 8 system. The concepts shown in the video also apply to Stratis in Fedora.
Stratis version 2.1 introduces support for encryption. Continue reading to learn how to get started with encryption in Stratis.
 
<h2>Prerequisites</h2>
Encryption requires Stratis version 2.1 or greater. The examples in this post use a pre-release of Fedora 33. Stratis 2.1 will be available in the final release of Fedora 33.
You’ll also need at least one available block device to create an encrypted pool. The examples shown below were done on a KVM virtual machine with a 5 GB virtual disk drive (/dev/vdb).
<h2>Create a key in the kernel keyring</h2>
The Linux kernel keyring is used to store the encryption key. For more information on the kernel keyring, refer to the keyrings manual page (man keyrings).  
Use the stratis key set command to set up the key within the kernel keyring.  You must specify where the key should be read from. To read the key from standard input, use the –capture-key option. To retrieve the key from a file, use the –keyfile-path <file> option. The last parameter is a key description. It will be used later when you create the encrypted Stratis pool.
For example, to create a key with the description pool1key, and to read the key from standard input, you would enter:
<pre class="wp-block-preformatted"># stratis key set --capture-key pool1key
Enter desired key data followed by the return key:</pre>
The command prompts us to type the key data / passphrase, and the key is then created within the kernel keyring.  
To verify that the key was created, run stratis key list:
<pre class="wp-block-preformatted"># stratis key list
Key Description
pool1key</pre>
This verifies that the pool1key was created. Note that these keys are not persistent. If the host is rebooted, the key will need to be provided again before the encrypted Stratis pool can be accessed (this process is covered later).
If you have multiple encrypted pools, they can have a separate keys, or they can share the same key.
The keys can also be viewed using the following keyctl commands:
<pre class="wp-block-preformatted"># keyctl get_persistent @s
318044983
# keyctl show
Session Keyring
 701701270 --alswrv      0     0  keyring: _ses
 649111286 --alswrv      0 65534   \_ keyring: _uid.0
 318044983 ---lswrv      0 65534   \_ keyring: _persistent.0
1051260141 --alswrv      0     0       \_ user: stratis-1-key-pool1key
</pre>
<h2>Create the encrypted Stratis pool</h2>
Now that a key has been created for Stratis, the next step is to create the encrypted Stratis pool. Encrypting a pool can only be done at pool creation. It isn’t currently possible to encrypt an existing pool.
Use the stratis pool create command to create a pool. Add –key-desc and the key description that you provided in the previous step (pool1key). This will signal to Stratis that the pool should be encrypted using the provided key. The below example creates the Stratis pool on /dev/vdb, and names it pool1. Be sure to specify an empty/available device on your system.
<pre class="wp-block-preformatted"># stratis pool create --key-desc pool1key pool1 /dev/vdb</pre>
You can verify that the pool has been created with the stratis pool list command:
<pre class="wp-block-preformatted"># stratis pool list 
Name                     Total Physical   Properties
pool1   4.98 GiB / 37.63 MiB / 4.95 GiB      ~Ca, Cr</pre>
In the sample output shown above, ~Ca indicates that caching is disabled (the tilde negates the property). Cr indicates that encryption is enabled.  Note that caching and encryption are mutually exclusive. Both features cannot be simultaneously enabled.
Next, create a filesystem. The below example, demonstrates creating a filesystem named filesystem1, mounting it at the /filesystem1 mountpoint, and creating a test file in the new filesystem:
<pre class="wp-block-preformatted"># stratis filesystem create pool1 filesystem1
# mkdir /filesystem1
# mount /stratis/pool1/filesystem1 /filesystem1
# cd /filesystem1
# echo "this is a test file" > testfile
</pre>
<h2>Access the encrypted pool after a reboot</h2>
When you reboot you’ll notice that Stratis no longer shows your encrypted pool or its block device:
<pre class="wp-block-preformatted"># stratis pool list
Name   Total Physical   Properties</pre>
<pre class="wp-block-preformatted"># stratis blockdev list
Pool Name   Device Node   Physical Size   Tier</pre>
To access the encrypted pool, first re-create the key with the same key description and key data / passphrase that you used previously:
<pre class="wp-block-preformatted"># stratis key set --capture-key pool1key
Enter desired key data followed by the return key:</pre>
Next, run the stratis pool unlock command, and verify that you can now see the pool and its block device:
<pre class="wp-block-preformatted"># stratis pool unlock
# stratis pool list
Name                      Total Physical   Properties
pool1   4.98 GiB / 583.65 MiB / 4.41 GiB      ~Ca, Cr
# stratis blockdev list
Pool Name   Device Node   Physical Size   Tier
pool1       /dev/dm-2          4.98 GiB   Data
</pre>
Next, mount the filesystem and verify that you can access the test file you created previously:
<pre class="wp-block-preformatted"># mount /stratis/pool1/filesystem1 /filesystem1/
# cat /filesystem1/testfile 
this is a test file
</pre>
<h2>Use a systemd unit file to automatically unlock a Stratis pool at boot</h2>
It is possible to automatically unlock your Stratis pool at boot without manual intervention. However, a file containing the key must be available. Storing the key in a file might be a security concern in some environments.
The systemd unit file shown below provides a simple method to unlock a Stratis pool at boot and mount the filesystem. Feedback on a better/alternative methods is welcome. You can provide suggestions in the comment section at the end of this article.
Start by creating your key file with the following command. Be sure to substitute passphrase with the same key data / passphrase you entered previously.
<pre class="wp-block-preformatted"># echo -n passphrase > /root/pool1key</pre>
Make sure that the file is only readable by root:
<pre class="wp-block-preformatted"># chmod 400 /root/pool1key
# chown root:root /root/pool1key</pre>
Create a systemd unit file at /etc/systemd/system/stratis-filesystem1.service with the following content:
<pre class="wp-block-preformatted">[Unit]
Description = stratis mount pool1 filesystem1 file system
After = stratisd.service [Service]
ExecStartPre=sleep 2
ExecStartPre=stratis key set --keyfile-path /root/pool1key pool1key
ExecStartPre=stratis pool unlock
ExecStartPre=sleep 3
ExecStart=mount /stratis/pool1/filesystem1 /filesystem1
RemainAfterExit=yes [Install]
WantedBy = multi-user.target</pre>
Next, enable the service so that it will run at boot:
<pre class="wp-block-preformatted"># systemctl enable stratis-filesystem1.service</pre>
Now reboot and verify that the Stratis pool has been automatically unlocked and that its filesystem is mounted.
<h2>Summary and conclusion</h2>
In today’s environment, encryption is a must for many people and organizations. This post demonstrated how to enable encryption in Stratis 2.1.
</div>

https://www.sickgaming.net/blog/2020/11/09/getting-started-with-stratis-encryption/