source: postlfs/security/cryptsetup.xml@ de5db85

11.0 11.1 lazarus qt5new trunk upgradedb xry111/intltool xry111/test-20220226
Last change on this file since de5db85 was de5db85, checked in by Douglas R. Reno <renodr@…>, 17 months ago

Update to qpdf-10.3.1
Update to libxkbcommon-1.1.0
Update to gptfdisk-1.0.7
Update to cryptsetup-2.3.5
Update to pango-1.48.3
Update to Wireshark-3.4.4

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@24371 af4574ff-66df-0310-9fd7-8a98e5e911e0

  • Property mode set to 100644
File size: 9.0 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3 "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7 <!ENTITY cryptsetup-download-http "&kernel-dl;/linux/utils/cryptsetup/v&cryptsetup-minor;/cryptsetup-&cryptsetup-version;.tar.xz">
8 <!ENTITY cryptsetup-download-ftp " ">
9 <!ENTITY cryptsetup-md5sum "408620e0df577ec04108ec0bc2b91dee">
10 <!ENTITY cryptsetup-size "11 MB">
11 <!ENTITY cryptsetup-buildsize "34 MB (add 102 MB for tests)">
12 <!ENTITY cryptsetup-time "0.2 SBU (add 14 SBU for tests)">
13]>
14
15<sect1 id="cryptsetup" xreflabel="cryptsetup-&cryptsetup-version;">
16 <?dbhtml filename="cryptsetup.html"?>
17
18 <sect1info>
19 <othername>$LastChangedBy$</othername>
20 <date>$Date$</date>
21 </sect1info>
22
23 <title>cryptsetup-&cryptsetup-version;</title>
24
25 <indexterm zone="cryptsetup">
26 <primary sortas="a-cryptsetup">cryptsetup</primary>
27 </indexterm>
28
29 <sect2 role="package">
30 <title>Introduction to cryptsetup</title>
31
32 <para>
33 cryptsetup is used to set up transparent encryption of block devices
34 using the kernel crypto API.
35 </para>
36
37 &lfs101_checked;
38
39 <bridgehead renderas="sect3">Package Information</bridgehead>
40 <itemizedlist spacing="compact">
41 <listitem>
42 <para>
43 Download (HTTP): <ulink url="&cryptsetup-download-http;"/>
44 </para>
45 </listitem>
46 <listitem>
47 <para>
48 Download (FTP): <ulink url="&cryptsetup-download-ftp;"/>
49 </para>
50 </listitem>
51 <listitem>
52 <para>
53 Download MD5 sum: &cryptsetup-md5sum;
54 </para>
55 </listitem>
56 <listitem>
57 <para>
58 Download size: &cryptsetup-size;
59 </para>
60 </listitem>
61 <listitem>
62 <para>
63 Estimated disk space required: &cryptsetup-buildsize;
64 </para>
65 </listitem>
66 <listitem>
67 <para>
68 Estimated build time: &cryptsetup-time;
69 </para>
70 </listitem>
71 </itemizedlist>
72
73<!-- No longer needed with 2.3.2.
74 <bridgehead renderas="sect3">Additional Downloads</bridgehead>
75 <itemizedlist spacing="compact">
76 <listitem>
77 <para>
78 Required patch:
79 <ulink url="&patch-root;/cryptsetup-&cryptsetup-version;-upstream_fixes-1.patch"/>
80 </para>
81 </listitem>
82 </itemizedlist>
83-->
84
85 <bridgehead renderas="sect3">cryptsetup Dependencies</bridgehead>
86
87 <bridgehead renderas="sect4">Required</bridgehead>
88 <para role="required">
89 <xref linkend="json-c"/>,
90 <xref linkend="lvm2"/>, and
91 <xref linkend="popt"/>
92 </para>
93
94 <bridgehead renderas="sect4">Optional</bridgehead>
95 <para role="optional">
96 <xref linkend="libpwquality"/>,
97 <ulink url="https://github.com/P-H-C/phc-winner-argon2">argon2</ulink>, and
98 <ulink url="http://www.openwall.com/passwdqc/">passwdqc</ulink>
99 </para>
100
101
102 <para condition="html" role="usernotes">User Notes:
103 <ulink url="&blfs-wiki;/cryptsetup"/>
104 </para>
105 </sect2>
106
107 <sect2 role="kernel" id="cryptsetup-kernel">
108 <title>Kernel Configuration</title>
109
110 <para>
111 Encrypted block devices require kernel support. To use it, the
112 appropriate kernel configuration parameters need to be set:
113 </para>
114
115<screen><literal>Device Drivers ---&gt;
116 [*] Multiple devices driver support (RAID and LVM) ---&gt; [CONFIG_MD]
117 &lt;*/M&gt; Device mapper support [CONFIG_BLK_DEV_DM]
118 &lt;*/M&gt; Crypt target support [CONFIG_DM_CRYPT]
119
120Cryptographic API ---&gt;
121 &lt;*/M&gt; XTS support [CONFIG_CRYPTO_XTS]
122 &lt;*/M&gt; SHA224 and SHA256 digest algorithm [CONFIG_CRYPTO_SHA256]
123 &lt;*/M&gt; AES cipher algorithms [CONFIG_CRYPTO_AES]
124 &lt;*/M&gt; User-space interface for symmetric key cipher algorithms
125 [CONFIG_CRYPTO_USER_API_SKCIPHER]
126 For tests:
127 &lt;*/M&gt; Twofish cipher algorithm [CONFIG_CRYPTO_TWOFISH]</literal></screen>
128
129 <indexterm zone="cryptsetup cryptsetup-kernel">
130 <primary sortas="d-cryptsetup">cryptsetup</primary>
131 </indexterm>
132
133 </sect2>
134
135 <sect2 role="installation">
136 <title>Installation of cryptsetup</title>
137
138<!-- No longer needed with 2.3.2
139 <para>
140 First, apply a patch to fix a build problem caused by API changes in
141 <xref role="nodep" linkend="json-c"/>:
142 </para>
143
144<screen><userinput remap="pre">patch -Np1 -i ../cryptsetup-&cryptsetup-version;-upstream_fixes-1.patch</userinput></screen>
145-->
146
147 <para>
148 Install <application>cryptsetup</application> by running the following
149 commands:
150 </para>
151
152<screen><userinput>./configure --prefix=/usr &amp;&amp;
153make</userinput></screen>
154
155 <para>
156 To test the result, issue as the <systemitem
157 class="username">root</systemitem> user: <command>make check</command>.
158 Some tests will fail if appropriate kernel configuration options are not
159 set. Some additional options that may be needed for tests are:
160 CONFIG_SCSI_LOWLEVEL,
161 CONFIG_SCSI_DEBUG,
162 CONFIG_BLK_DEV_DM_BUILTIN,
163 CONFIG_CRYPTO_USER,
164 CONFIG_CRYPTO_CRYPTD,
165 CONFIG_CRYPTO_LRW,
166 CONFIG_CRYPTO_XTS,
167 CONFIG_CRYPTO_ESSIV,
168 CONFIG_CRYPTO_CRCT10DIF,
169 CONFIG_CRYPTO_AES_TI,
170 CONFIG_CRYPTO_AES_NI_INTEL,
171 CONFIG_CRYPTO_BLOWFISH,
172 CONFIG_CRYPTO_CAST5,
173 CONFIG_CRYPTO_SERPENT,
174 CONFIG_CRYPTO_SERPENT_SSE2_X86_64,
175 CONFIG_CRYPTO_SERPENT_AVX_X86_64,
176 CONFIG_CRYPTO_SERPENT_AVX2_X86_64, and
177 CONFIG_CRYPTO_TWOFISH_X86_64.
178 <!--I still had 5 of 19 tests fail after adding the above crypto options in the
179 kernel. bdubbs -->
180 </para>
181
182 <para>
183 Now, as the <systemitem class="username">root</systemitem> user:
184 </para>
185
186<screen role="root"><userinput>make install</userinput></screen>
187
188 </sect2>
189
190 <!--sect2 role="commands">
191 <title>Command Explanations</title>
192
193 </sect2-->
194
195 <sect2 role="configuration">
196 <title>Configuring cryptsetup</title>
197
198 <para>
199 Because of the number of possible configurations, setup of encrypted
200 volumes is beyond the scope of the BLFS book. Please see the
201 configuration guide in the cryptsetup <ulink
202 url="https://gitlab.com/cryptsetup/cryptsetup/wikis/FrequentlyAskedQuestions#2-setup">
203 FAQ</ulink>.
204 </para>
205
206 </sect2>
207
208 <sect2 role="content">
209 <title>Contents</title>
210
211 <segmentedlist>
212 <segtitle>Installed Programs</segtitle>
213 <segtitle>Installed Libraries</segtitle>
214 <segtitle>Installed Directories</segtitle>
215
216 <seglistitem>
217 <seg>
218 cryptsetup,
219 cryptsetup-reencrypt,
220 integritysetup, and
221 veritysetup
222 </seg>
223 <seg>
224 libcryptsetup.so
225 </seg>
226 <seg>
227 None
228 </seg>
229 </seglistitem>
230 </segmentedlist>
231
232 <variablelist>
233 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
234 <?dbfo list-presentation="list"?>
235 <?dbhtml list-presentation="table"?>
236
237 <varlistentry id="cryptsetup-prog">
238 <term><command>cryptsetup</command></term>
239 <listitem>
240 <para>
241 is used to setup dm-crypt managed device-mapper mappings
242 </para>
243 <indexterm zone="cryptsetup cryptsetup-prog">
244 <primary sortas="b-cryptsetup">cryptsetup</primary>
245 </indexterm>
246 </listitem>
247 </varlistentry>
248
249 <varlistentry id="cryptsetup-reencrypt">
250 <term><command>cryptsetup-reencrypt</command></term>
251 <listitem>
252 <para>
253 is a tool for offline LUKS device re-encryption
254 </para>
255 <indexterm zone="cryptsetup cryptsetup-reencrypt">
256 <primary sortas="b-cryptsetup-reencrypt">cryptsetup-reencrypt</primary>
257 </indexterm>
258 </listitem>
259 </varlistentry>
260
261 <varlistentry id="integritysetup">
262 <term><command>integritysetup</command></term>
263 <listitem>
264 <para>
265 is a tool to manage dm-integrity (block level integrity) volumes
266 </para>
267 <indexterm zone="cryptsetup integritysetup">
268 <primary sortas="b-integritysetup">integritysetup</primary>
269 </indexterm>
270 </listitem>
271 </varlistentry>
272
273 <varlistentry id="veritysetup">
274 <term><command>veritysetup</command></term>
275 <listitem>
276 <para>
277 is used to configure dm-verity managed device-mapper mappings.
278 Device-mapper verity target provides read-only transparent integrity
279 checking of block devices using kernel crypto API
280 </para>
281 <indexterm zone="cryptsetup veritysetup">
282 <primary sortas="b-veritysetup">veritysetup</primary>
283 </indexterm>
284 </listitem>
285 </varlistentry>
286
287 </variablelist>
288
289 </sect2>
290
291</sect1>
Note: See TracBrowser for help on using the repository browser.