LUKS(Linux Unified Key Setup)为Linux硬盘加密提供了一种标准

首先对硬盘进行分区：
[root@localhost ~]# fdisk /dev/sdb
[root@localhost ~]# partprobe /dev/sdb

安装加密工具
[root@localhost ~]# rpm -ivh /mnt/Packages/cryptsetup-1.6.7-1.el7.x86_64.rpm

设置加密分区
[root@localhost ~]# cryptsetup luksFormat /dev/sdb2

WARNING!

This will overwrite data on /dev/sda3 irrevocably.

Are you sure? (Type uppercase yes): YES
Enter passphrase:
Verify passphrase:
Password quality check failed:
The password is shorter than 8 characters
#密码要超过8个字节，而且要满足复杂性

映射
[root@localhost ~]# cryptsetup luksOpen /dev/sdb2 disk1
Enter passphrase for /dev/sdb2:
##输入密码
[root@localhost ~]# ll /dev/mapper/disk1
lrwxrwxrwx 1 root root 7 12月 9 20:38 /dev/mapper/disk1 -> ../dm-2

格式化加密分区
[root@localhost ~]# mkfs.xfs /dev/mapper/disk1
创建挂载点
[root@localhost ~]# mkdir /sdb2
挂载
[root@localhost ~]# mount /dev/mapper/disk1 /sdb2/

关闭加密分区
[root@localhost ~]# umount /sdb2
[root@localhost ~]# cryptsetup luksClose /dev/mapper/disk1
[root@localhost ~]# mount /dev/sdb2 /sdb2
mount: 未知的文件系统类型“crypto_LUKS”

生成加密分区的密码文件，实现开机自动挂载加密分区
[root@localhost ~]# vim /etc/crypttab
disk1 /dev/sdb2 /root/key
#（如果这里写none的话，当系统启动时在读取分区时候，会一直停在那，等待输入密码）

生成密码文件，修改文件权限
[root@localhost ~]# echo -n “pwd@123yy” > /root/key
[root@localhost ~]# chmod 700 /root/key

添加密码文件到/dev/sdb2 中
[root@localhost ~]# cryptsetup luksAddKey /dev/sdb2 /root/key
Enter any passphrase: ##输入密码
[root@localhost ~]# vim /etc/fstab
/dev/mapper/disk1 /sdb2 xfs defaults 0 0

[root@localhost ~]# mount -a
mount: special device /dev/mapper/disk1 does not exist

reboot重启生效
[root@localhost ~]# mount -a
[root@localhost ~]#