تشفير القرص الكامل للأنظمة المثبتة في نظام التشغيل Windows Linux. متعدد مشفر

 cryptsetup -v -y luksFormat /dev/sda7 

 # default-  cryptsetup --help #     . 

 cryptsetup luksFormat /dev/sda7 -v -y -c twofish-xts-plain64 -s 512 -h sha512 -i 1500 --use-urandom 

 cryptsetup open /dev/sda7 sda7_crypt #       . 

 #    mkfs.ext4 -v -L DebSHIFR /dev/mapper/sda7_crypt 

 mount /dev/mapper/sda7_crypt /mnt 

 #   cryptsetup luksHeaderBackup --header-backup-file ~/_DebSHIFR /dev/sda7 

 #   cryptsetup luksHeaderRestore --header-backup-file <file> <device> 

 mount --bind /dev /mnt/dev mount --bind /proc /mnt/proc mount --bind /sys /mnt/sys chroot /mnt 

 ls /mnt<Tab-Tab> #   "/" 

 history #       su  . 

 nano /etc/crypttab 

# "اسم الهدف" "جهاز المصدر" "خيارات الملف" ""
مبادلة / dev / sda8 / dev / مبادلة عشوائية ، تشفير = twofish-xts-plain64 ، الحجم = 512 ، تجزئة = sha512

 #   fstab nano /etc/fstab 

# مبادلة كان على / dev / sda8 أثناء التثبيت
/ dev / معين / مبادلة بلا مبادلة sw 0 0

 fallocate -l 3G /swap #   3 (  ) chmod 600 /swap #  mkswap /swap #     swapon /swap #  swap free -m #,       printf "/swap none swap sw 0 0" >> /etc/fstab #    swap   

 # /etc/crypttab nano /etc/crypttab 

# "اسم الهدف" "جهاز المصدر" "خيارات الملف" ""
sda7_crypt UUID = 81048598-5bb9-4a53-af92-f3f9e709e2f2 none luks

# "اسم الهدف" "جهاز المصدر" "خيارات الملف" ""
sda7_crypt UUID = 81048598-5bb9-4a53-af92-f3f9e709e2f2 none cipher = twofish-xts-plain64 ، الحجم = 512 ، التجزئة = sha512

# "اسم الهدف" "جهاز المصدر" "خيارات الملف" ""
sda7_crypt UUID = 81048598-5bb9-4a53-af92-f3f9e709e2f2 / etc / skey luks

 fdisk -l #   blkid #  -  

/ dev / sda7: UUID = "81048598-5bb9-4a53-af92-f3f9e709e2f2" TYPE = "crypto_LUKS" PARTUUID = "0332d73c-07"
/ dev / mapper / sda7_crypt: LABEL = "DebSHIFR" UUID = "382111a2-f993-403c-aa2e-292b5eac4780" TYPE = "ext4"

 # ""   < >  691. head -c 691 /dev/urandom > /etc/skey 

 #   (691)  7-   luks cryptsetup luksAddKey --key-slot 7 /dev/sda7 /etc/skey 

 #  "/ luks-" cryptsetup luksDump /dev/sda7 

( . 2020., LUKS2, , LUKS1. — LUKS1 CLI).

 # Check " " file -s /dev/sda7 /dev/sda7: LUKS encrypted file, ver 1 [twofish, xts-plain64, sha512] UUID: -- #   LUKS /dev/sda7: data #   VeraCrypt 

 cryptsetup luksKillSlot /dev/sda7 7 # /  7  

 # /etc/fstab nano /etc/fstab 

# «file system» «mount poin» «type» «options» «dump» «pass»
# / was on /dev/sda7 during installation
/dev/mapper/sda7_crypt / ext4 errors=remount-ro 0 1

 #      swap ,  . nano /etc/initramfs-tools/conf.d/resume 

 nano /etc/initramfs-tools/conf.d/cryptsetup 

# /etc/initramfs-tools/conf.d/cryptsetup
CRYPTSETUP=yes
export CRYPTSETUP

 nano /etc/default/grub 

GRUB_DEFAULT=0
GRUB_TIMEOUT=1
GRUB_DISTRIBUTOR=`lsb_release -i -s 2> /dev/null || echo Debian`
GRUB_CMDLINE_LINUX_DEFAULT=«acpi_backlight=vendor»
GRUB_CMDLINE_LINUX=«quiet splash noautomount»
GRUB_ENABLE_CRYPTODISK=y

 nano /etc/cryptsetup-initramfs/conf-hook 

KEYFILE_PATTERN="/etc/skey"
UMASK=0077

 update-initramfs -u -k all 

 mkfs.ext4 -v -L GRUB2 /dev/sda6 

 mount /dev/sda6 /mnt 

 apt-get update apt-get install grub2 

 grub-install --force --root-directory=/mnt /dev/sda6 

 grub-mkconfig -o /mnt/boot/grub/grub.cfg 

 umount -a #     GNU/Linux Ctrl+d #   chroot umount /mnt/dev umount /mnt/proc umount /mnt/sys umount -a #     live usb reboot 

 update-initramfs -u -k all 

 mount /dev/sda6 /mnt grub-mkconfig -o /mnt/boot/grub/grub.cfg 

• GNU/Linuxinux , /boot/kernel and initrd;
• initrd.img;
• ( initrd; / ; Linux) .

• « » , – .
• - , CLI, -GRUB2.

 ls /<Tab-Tab> # - 

 grub-mkpasswd-pbkdf2 #/  . 

 mount /dev/sda6 /mnt 

 nano -$ /mnt/boot/grub/grub.cfg 

 nano /etc/grub.d/41_custom 

6.2.

, pgp- ( ). : gnuPG; kleopatra/GPA; Seahorse. - . Seahorse — 3.14.0 ( , , V3.20 – ).

PGP- // su!

 gpg - -gen-key 

 gpg --export -o ~/perskey 

 mount /dev/sda6 /mnt #sda6 –  GRUB2 

GRUB2

 rm -rf /mnt/ 

GRUB2 sda6, GRUB «core.img»

 grub-install --force --modules="gcry_sha256 gcry_sha512 signature_test gcry_dsa gcry_rsa" -k ~/perskey --root-directory=/mnt /dev/sda6 

* --force - , , ( ).
* --modules=«gcry_sha256 gcry_sha512 signature_test gcry_dsa gcry_rsa» - GRUB2 .
* -k ~/perskey - «PGP-» ( , ).
* --root-directory - boot sda6
/dev/sda6 - sda .

/ grub.cfg

 grub-mkconfig -o /mnt/boot/grub/grub.cfg 

«grub.cfg» «trust /boot/grub/perskey» ( pgp-.) GRUB2 , «signature_test.mod», «set check_signatures=enforce».

( grub.cfg)

### BEGIN /etc/grub.d/41_custom ###
if [ -f ${config_directory}/custom.cfg ]; then
source ${config_directory}/custom.cfg
elif [ -z "${config_directory}" -a -f $prefix/custom.cfg ]; then
source $prefix/custom.cfg;
fi
trust /boot/grub/perskey
set superusers=«root»
password_pbkdf2 root grub.pbkdf2.sha512.10000.DE10E42B01BB6FEEE46250FC5F9C3756894A8476A7F7661A9FFE9D6CC4D0A168898B98C34EBA210F46FC10985CE28277D0563F74E108FCE3ACBD52B26F8BA04D.27625A4D30E4F1044962D3DD1C2E493EF511C01366909767C3AF9A005E81F4BFC33372B9C041BE9BA904D7C6BB141DE48722ED17D2DF9C560170821F033BCFD8
### END /etc/grub.d/41_custom ###
#

"/boot/grub/perskey" , hd0,6, «» , GRUB2 (. set rot=..).

GRUB2 ( /GRUB) «perskey».
, ( nautilus/caja): «seahorse» . su.
sudo "/mnt/boot" – – .



"/mnt/boot/grub/perskey" ( grub) . , / [*.sig].
"/boot" ( kernel, initrd). - , bash- « ».

( - )

 rm -f $(find /mnt/boot/grub -type f -name '*.sig') 

, , GRUB2.

 apt-mark hold grub-common grub-pc grub-pc-bin grub2 grub2-common 

< > GRUB2 .

C6.3. Proof-test GRUB2,

GRUB2. - GNU/Linux CLI ( ) . / initrd


, GRUB2-.

- GRUB2/ grub.cfg, /, .mod, . GRUB2 .


, GRUB2 « ».

«» « », «0». ( « » «0» — ).

?

: / GRUB2 , , luks.mod.sig .

: CLI

 trust_list 

«perskey», «0», , .C6.2.
« GRUB2 » .

GRUB2

• / (/ . GRUB2 , , / , , «- » ).
• ( ).
• (/ GRUB2 ).
• .

• (, ).
• The Worst Evil Script ( /: GRUB , usb-/ , / , pass/_LUKS ).
• ( GNU/Linux).

.

 -$ hashdeep -c md5 -r /media/username/GRUB > /podpis.txt 

 #!/bin/bash #      GRUB2  . #  " /  ",        . !    :   GRUB2     OS GNU/Linux. echo -e "******************************************************************\n" >> '/var/log/podpis.txt' && date >> '/var/log/podpis.txt' && hashdeep -vvv -a -k '/podpis.txt' -r '/media/username/GRUB' >> '/var/log/podpis.txt' a=`tail '/var/log/podpis.txt' | grep failed` #  "cat"!! b="hashdeep: Audit failed" #:    -      GRUB2         "  "      gif- "warning". if [[ "$a" = "$b" ]] then echo -e "****\n" >> '/var/log/vtorjenie.txt' && echo "vtorjenie" >> '/var/log/vtorjenie.txt' && date >> '/var/log/vtorjenie.txt' & sudo -u username DISPLAY=:0 eom '/warning.gif' fi 

 -$ hashdeep -vvv -a -k '/podpis.txt' -r '/media/username/GRUB 

   2 11::41 MSK 2020 /media/username/GRUB/boot/grub/virus.mod: Moved from /media/username/GRUB/1nononoshifr /media/username/GRUB/boot/grub/i386-pc/mda_text.mod: Ok /media/username/GRUB/boot/grub/grub.cfg: Ok hashdeep: Audit failed Input files examined: 0 Known files expecting: 0 Files matched: 325 Files partially matched: 0 Files moved: 1 New files found: 0 Known files not found: 0 

 -$ sudo nano /etc/fstab 

LABEL=GRUB /media/username/GRUB ext4 defaults 0 0

 -$ sudo nano /etc/logrotate.d/podpis 

/var/log/podpis.txt {
daily
rotate 50
size 5M
dateext
compress
delaycompress
olddir /var/log/old
}

/var/log/vtorjenie.txt {
monthly
rotate 5
size 5M
dateext
olddir /var/log/old
}

 -$ sudo crontab -e 

reboot '/podpis' #
0 */6 * * * '/podpis # 0-00; 6; 12; 18.

 -$ sudo su -$ echo "alias _GRUB='hashdeep -c md5 -r /media/username/GRUB > /podpis.txt'" >> /root/.bashrc && bash -$ echo "alias _GRUB='hashdeep -vvv -a -k '/podpis.txt' -r /media/username/GRUB'" >> .bashrc && bash 

1. (/) VeraCrypt ;
2. / Rsync VeraCrypt;
3. VeraCrypt www.

1. ( Windows , GNU/Linux) ;
2. , « » ( ) – .

,
, .…

Linux.
, .
, .

 echo "alias veramount='cryptsetup open --veracrypt --tcrypt-system --type tcrypt /dev/sdaX Windows_crypt && mount /dev/mapper/ Windows_crypt /media/veracrypt1'" >> .bashrc && bash 

 cryptsetup open --veracrypt --tcrypt-system --type tcrypt /dev/sdaX Windows_crypt mount /dev/mapper/Windows_crypt /mnt 

 cryptsetup open --veracrypt --type tcrypt /dev/sdaY test_crypt mount /dev/mapper/test_crypt /mnt 

 # /   ntfs- mkdir /media/Winda7 && mkdir /media/ 

 #      VeraCrypt,  " "    printf 'bob' | base64 Ym9i #  cli   "bob" 

 echo 'Ym9i' | base64 -d | cryptsetup open --veracrypt --tcrypt-system --type tcrypt /dev/sda3 Windows_crypt && mount /dev/mapper/Windows_crypt /media/Winda7 #   base64 (bob)             Windows. echo 'Ym9i' | base64 -d | cryptsetup open --veracrypt --type tcrypt /dev/sda1 ntfscrypt && mount /dev/mapper/ntfscrypt /media/ #,     ntfs. 

 sudo chmod 100 /VeraOpen.sh 

 #!/bin/sh -e # # rc.local # # This script is executed at the end of each multiuser runlevel. # Make sure that the script will «exit 0» on success or any other # value on error. # # In order to enable or disable this script just change the execution # bits. # # By default this script does nothing. sh -c "sleep 1 && '/VeraOpen.sh'" #  ,  ~ 1     . exit 0 

 sudo chmod 100 /etc/rc.local && sudo chmod 100 /etc/init.d/rc.local 

 systemd-analyze && systemd-analyze blame 

 grub-install --force --root-directory=/mnt /dev/sda6 

set superusers=«root»
password_pbkdf2 root grub.pbkdf2.sha512.10000.DE10E42B01BB6FEEE46250FC5F9C3756894A8476A7F7661A9FFE9D6CC4D0A168898B98C34EBA210F46FC10985CE28277D0563F74E108FCE3ACBD52B26F8BA04D.27625A4D30E4F1044962D3DD1C2E493EF511C01366909767C3AF9A005E81F4BFC33372B9C041BE9BA904D7C6BB141DE48722ED17D2DF9C560170821F033BCFD8

menuentry 'GRUBx2' --class parrot --class gnu-linux --class gnu --class os $menuentry_id_option 'gnulinux-simple-382111a2-f993-403c-aa2e-292b5eac4780' {
load_video
insmod gzio
if [ x$grub_platform = xxen ]; then insmod xzio; insmod lzopio; fi
insmod part_msdos
insmod cryptodisk
insmod luks
insmod gcry_twofish
insmod gcry_twofish
insmod gcry_sha512
insmod ext2
cryptomount -u 15c47d1c4bd34e5289df77bcf60ee838
set root='cryptouuid/15c47d1c4bd34e5289df77bcf60ee838'
normal /boot/grub/grub.cfg
}

 cat /Tab-Tab 

 list_trusted 

«Note that even with GRUB password protection, GRUB itself cannot prevent someone with physical access to the machine from altering that machine's firmware (eg, Coreboot or BIOS) configuration to cause the machine to boot from a different (attacker-controlled) device. GRUB is at best only one link in a secure boot chain».