\begin{exe} {Disk Encryption}

   \begin{lfbox}
      In this exercise, you will encrypt a partition on the
      disk in order to provide a measure of security in the
      event that the hard drive or laptop is stolen. Reviewing
      the \textbf{cryptsetup} documentation first would be a
      good idea (\verb?man cryptsetup? and
      \verb?cryptsetup --help?).
   \end{lfbox}

   \begin{enumerate}
      \item Create a new partition for the encrypted block
      device with \textbf{fdisk}.  Make sure the kernel is
      aware of the new partition table.  A reboot will do
      this but there are other methods.
      \item Format the partition with \textbf{cryptsetup}
      using \textbf{LUKS} for the crypto layer.
      \item Create the un-encrypted pass through device by
      opening the encrypted block device,
      i.e., \texttt{secret-disk}.
      \item Add an entry to \filelink{/etc/crypttab} so that
      the system prompts for the passphrase on reboot.
      \item Format the filesystem as an \textbf{ext4}
      filesystem.
      \item Create a mount point for the new filesystem,
      i.e. \filelink{/secret}.
      \item Add an entry to \filelink{/etc/fstab} so that the
      filesystem is mounted on boot.
      \item Try and mount the encrypted filesystem.
      \item Validate the entire configuration by rebooting.
   \end{enumerate}

   \begin{sol}

      \begin{enumerate}
         \item
         \begin{cmd}
$ sudo fdisk /dev/sda
         \end{cmd}
         Create a new partition (in the below
         \filelink{/dev/sda4} to be concrete) and then either
         issue:
         \begin{cmd}
$ sudo partprobe -s
         \end{cmd}
         to have the system re-read the modified partition
         table, or reboot (which is far safer).

         \textbf{Note:} If you can't use a real partition, use
         the technique in the previous chapter to use a
         loop device or image file for the same purpose.
         \item
         \begin{cmd}
$ sudo cryptsetup luksFormat /dev/sda4
         \end{cmd}
         \item
         \begin{cmd}
$ sudo cryptsetup luksOpen /dev/sda4 secret-disk
         \end{cmd}
         \item
         Add the following to \filelink{/etc/crypttab}:
         \begin{configlst}[in \texttt{/etc/crypttab}]
secret-disk    /dev/sda4
         \end{configlst}
         \item
         \begin{cmd}
$ sudo mkfs -t ext4 /dev/mapper/secret-disk
         \end{cmd}
         \item
         \begin{cmd}
$ sudo mkdir -p /secret
         \end{cmd}
         \item
         Add the following to \filelink{/etc/fstab}:
         \begin{configlst}[in \texttt{/etc/fstab}]
/dev/mapper/secret-disk    /secret    ext4    defaults    1 2
         \end{configlst}
         \item
         Mount just the one filesystem:
         \begin{cmd}
$ sudo mount /secret
         \end{cmd}
         or mount all filesystems mentioned in
         \filelink{/etc/fstab}:
         \begin{cmd}
$ sudo mount -a
         \end{cmd}

         \item
         Reboot.
      \end{enumerate}
   \end{sol}
\end{exe}

