source: postlfs/security/cryptsetup.xml@ b5db236

11.1 lazarus trunk xry111/intltool xry111/test-20220226
Last change on this file since b5db236 was b5db236, checked in by Douglas R. Reno <renodr@…>, 7 months ago

Package Updates:

Update to gnome-calculator-41.1
Update to gnome-disk-utility-41.0
Update to gnome-maps-41.2
Update to gnome-screenshot-41.0
Update to gnome-system-monitor-41.0
Update to gnome-terminal-3.42.2
Update to gnome-weather-41.0
Update to gucharmap-41.0.1
Update to epiphany-41.3 (Security Update)

Fix a validation failure in cryptsetup.xml

  • Property mode set to 100644
File size: 9.2 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3 "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7 <!ENTITY cryptsetup-download-http "&kernel-dl;/linux/utils/cryptsetup/v&cryptsetup-minor;/cryptsetup-&cryptsetup-version;.tar.xz">
8 <!ENTITY cryptsetup-download-ftp " ">
9 <!ENTITY cryptsetup-md5sum "2303d57e78d4977344188a46e125095c">
10 <!ENTITY cryptsetup-size "11 MB">
11 <!ENTITY cryptsetup-buildsize "29 MB (add 5 MB for tests)">
12 <!ENTITY cryptsetup-time "0.2 SBU (add 19 SBU for tests)">
13]>
14
15<sect1 id="cryptsetup" xreflabel="cryptsetup-&cryptsetup-version;">
16 <?dbhtml filename="cryptsetup.html"?>
17
18 <sect1info>
19 <date>$Date$</date>
20 </sect1info>
21
22 <title>cryptsetup-&cryptsetup-version;</title>
23
24 <indexterm zone="cryptsetup">
25 <primary sortas="a-cryptsetup">cryptsetup</primary>
26 </indexterm>
27
28 <sect2 role="package">
29 <title>Introduction to cryptsetup</title>
30
31 <para>
32 cryptsetup is used to set up transparent encryption of block devices
33 using the kernel crypto API.
34 </para>
35
36 &lfs110a_checked;
37
38 <bridgehead renderas="sect3">Package Information</bridgehead>
39 <itemizedlist spacing="compact">
40 <listitem>
41 <para>
42 Download (HTTP): <ulink url="&cryptsetup-download-http;"/>
43 </para>
44 </listitem>
45 <listitem>
46 <para>
47 Download (FTP): <ulink url="&cryptsetup-download-ftp;"/>
48 </para>
49 </listitem>
50 <listitem>
51 <para>
52 Download MD5 sum: &cryptsetup-md5sum;
53 </para>
54 </listitem>
55 <listitem>
56 <para>
57 Download size: &cryptsetup-size;
58 </para>
59 </listitem>
60 <listitem>
61 <para>
62 Estimated disk space required: &cryptsetup-buildsize;
63 </para>
64 </listitem>
65 <listitem>
66 <para>
67 Estimated build time: &cryptsetup-time;
68 </para>
69 </listitem>
70 </itemizedlist>
71
72<!-- No longer needed with 2.3.2.
73 <bridgehead renderas="sect3">Additional Downloads</bridgehead>
74 <itemizedlist spacing="compact">
75 <listitem>
76 <para>
77 Required patch:
78 <ulink url="&patch-root;/cryptsetup-&cryptsetup-version;-upstream_fixes-1.patch"/>
79 </para>
80 </listitem>
81 </itemizedlist>
82-->
83
84 <bridgehead renderas="sect3">cryptsetup Dependencies</bridgehead>
85
86 <bridgehead renderas="sect4">Required</bridgehead>
87 <para role="required">
88 <xref linkend="json-c"/>,
89 <xref linkend="lvm2"/>, and
90 <xref linkend="popt"/>
91 </para>
92
93 <bridgehead renderas="sect4">Optional</bridgehead>
94 <para role="optional">
95 <xref linkend="libpwquality"/>,
96 <ulink url="https://github.com/P-H-C/phc-winner-argon2">argon2</ulink>,
97 <ulink url="http://www.libssh.org/">libssh</ulink>, and
98 <ulink url="http://www.openwall.com/passwdqc/">passwdqc</ulink>
99 </para>
100
101
102 <para condition="html" role="usernotes">User Notes:
103 <ulink url="&blfs-wiki;/cryptsetup"/>
104 </para>
105 </sect2>
106
107 <sect2 role="kernel" id="cryptsetup-kernel">
108 <title>Kernel Configuration</title>
109
110 <para>
111 Encrypted block devices require kernel support. To use it, the
112 appropriate kernel configuration parameters need to be set:
113 </para>
114
115<screen><literal>Device Drivers ---&gt;
116 [*] Multiple devices driver support (RAID and LVM) ---&gt; [CONFIG_MD]
117 &lt;*/M&gt; Device mapper support [CONFIG_BLK_DEV_DM]
118 &lt;*/M&gt; Crypt target support [CONFIG_DM_CRYPT]
119
120Cryptographic API ---&gt;
121 &lt;*/M&gt; XTS support [CONFIG_CRYPTO_XTS]
122 &lt;*/M&gt; SHA224 and SHA256 digest algorithm [CONFIG_CRYPTO_SHA256]
123 &lt;*/M&gt; AES cipher algorithms [CONFIG_CRYPTO_AES]
124 &lt;*/M&gt; User-space interface for symmetric key cipher algorithms
125 [CONFIG_CRYPTO_USER_API_SKCIPHER]
126 For tests:
127 &lt;*/M&gt; Twofish cipher algorithm [CONFIG_CRYPTO_TWOFISH]</literal></screen>
128
129 <indexterm zone="cryptsetup cryptsetup-kernel">
130 <primary sortas="d-cryptsetup">cryptsetup</primary>
131 </indexterm>
132
133 </sect2>
134
135 <sect2 role="installation">
136 <title>Installation of cryptsetup</title>
137
138<!-- No longer needed with 2.3.2
139 <para>
140 First, apply a patch to fix a build problem caused by API changes in
141 <xref role="nodep" linkend="json-c"/>:
142 </para>
143
144<screen><userinput remap="pre">patch -Np1 -i ../cryptsetup-&cryptsetup-version;-upstream_fixes-1.patch</userinput></screen>
145-->
146
147 <para>
148 Install <application>cryptsetup</application> by running the following
149 commands:
150 </para>
151
152<screen><userinput>./configure --prefix=/usr --disable-ssh-token &amp;&amp;
153make</userinput></screen>
154
155 <para>
156 To test the result, issue as the <systemitem
157 class="username">root</systemitem> user: <command>make check</command>.
158 Some tests will fail if appropriate kernel configuration options are not
159 set. Some additional options that may be needed for tests are:
160 CONFIG_SCSI_LOWLEVEL,
161 CONFIG_SCSI_DEBUG,
162 CONFIG_BLK_DEV_DM_BUILTIN,
163 CONFIG_CRYPTO_USER,
164 CONFIG_CRYPTO_CRYPTD,
165 CONFIG_CRYPTO_LRW,
166 CONFIG_CRYPTO_XTS,
167 CONFIG_CRYPTO_ESSIV,
168 CONFIG_CRYPTO_CRCT10DIF,
169 CONFIG_CRYPTO_AES_TI,
170 CONFIG_CRYPTO_AES_NI_INTEL,
171 CONFIG_CRYPTO_BLOWFISH,
172 CONFIG_CRYPTO_CAST5,
173 CONFIG_CRYPTO_SERPENT,
174 CONFIG_CRYPTO_SERPENT_SSE2_X86_64,
175 CONFIG_CRYPTO_SERPENT_AVX_X86_64,
176 CONFIG_CRYPTO_SERPENT_AVX2_X86_64, and
177 CONFIG_CRYPTO_TWOFISH_X86_64.
178 <!--I had 1 of 21 tests fail with the above crypto options in the
179 kernel. Eight tests were not run. Version 2.4.3.
180 Failed test was tcrypt-compat-test
181 tcrypt-images/tc_1-ripemd160-cbc-aes [FAILED]
182 bdubbs -->
183 </para>
184
185 <para>
186 Now, as the <systemitem class="username">root</systemitem> user:
187 </para>
188
189<screen role="root"><userinput>make install</userinput></screen>
190
191 </sect2>
192
193 <sect2 role="commands">
194 <title>Command Explanations</title>
195 <para>
196 <option>--disable-ssh-token</option>: This option is required if
197 the optional libssh dependency is not installed.
198 </para>
199
200 </sect2>
201
202 <sect2 role="configuration">
203 <title>Configuring cryptsetup</title>
204
205 <para>
206 Because of the number of possible configurations, setup of encrypted
207 volumes is beyond the scope of the BLFS book. Please see the
208 configuration guide in the cryptsetup <ulink
209 url="https://gitlab.com/cryptsetup/cryptsetup/wikis/FrequentlyAskedQuestions#2-setup">
210 FAQ</ulink>.
211 </para>
212
213 </sect2>
214
215 <sect2 role="content">
216 <title>Contents</title>
217
218 <segmentedlist>
219 <segtitle>Installed Programs</segtitle>
220 <segtitle>Installed Libraries</segtitle>
221 <segtitle>Installed Directories</segtitle>
222
223 <seglistitem>
224 <seg>
225 cryptsetup,
226 cryptsetup-reencrypt,
227 integritysetup, and
228 veritysetup
229 </seg>
230 <seg>
231 libcryptsetup.so
232 </seg>
233 <seg>
234 None
235 </seg>
236 </seglistitem>
237 </segmentedlist>
238
239 <variablelist>
240 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
241 <?dbfo list-presentation="list"?>
242 <?dbhtml list-presentation="table"?>
243
244 <varlistentry id="cryptsetup-prog">
245 <term><command>cryptsetup</command></term>
246 <listitem>
247 <para>
248 is used to setup dm-crypt managed device-mapper mappings
249 </para>
250 <indexterm zone="cryptsetup cryptsetup-prog">
251 <primary sortas="b-cryptsetup">cryptsetup</primary>
252 </indexterm>
253 </listitem>
254 </varlistentry>
255
256 <varlistentry id="cryptsetup-reencrypt">
257 <term><command>cryptsetup-reencrypt</command></term>
258 <listitem>
259 <para>
260 is a tool for offline LUKS device re-encryption
261 </para>
262 <indexterm zone="cryptsetup cryptsetup-reencrypt">
263 <primary sortas="b-cryptsetup-reencrypt">cryptsetup-reencrypt</primary>
264 </indexterm>
265 </listitem>
266 </varlistentry>
267
268 <varlistentry id="integritysetup">
269 <term><command>integritysetup</command></term>
270 <listitem>
271 <para>
272 is a tool to manage dm-integrity (block level integrity) volumes
273 </para>
274 <indexterm zone="cryptsetup integritysetup">
275 <primary sortas="b-integritysetup">integritysetup</primary>
276 </indexterm>
277 </listitem>
278 </varlistentry>
279
280 <varlistentry id="veritysetup">
281 <term><command>veritysetup</command></term>
282 <listitem>
283 <para>
284 is used to configure dm-verity managed device-mapper mappings.
285 Device-mapper verity target provides read-only transparent integrity
286 checking of block devices using kernel crypto API
287 </para>
288 <indexterm zone="cryptsetup veritysetup">
289 <primary sortas="b-veritysetup">veritysetup</primary>
290 </indexterm>
291 </listitem>
292 </varlistentry>
293
294 </variablelist>
295
296 </sect2>
297
298</sect1>
Note: See TracBrowser for help on using the repository browser.