text: Network-Bound Disk Encryption
  I was reading the redhat release notes on 7.4 and came across: Chapter 15. Security
  New packages: tang, clevis, jose, luksmeta
  Network Bound Disk Encryption (NBDE) allows the user to encrypt root volumes of the hard drives on physical and virtual machines without requiring to manually enter password when systems are rebooted.
  That means, we can now have an encrypted (luks) volume that will be de-crypted on reboot, without the need of typing a passphrase!!!
  Really - really useful on VPS (and general in cloud infrastructures)
  Useful Links
  -
  -
  -
  CentOS 7.4 with Encrypted rootfs
  (aka client machine)
  Below is a test centos 7.4 virtual machine with an encrypted root filesystem:
  /boot
  /
  Tang Server
  (aka server machine)
  Tang is a server for binding data to network presence. This is a different centos 7.4 virtual machine from the above.
  Installation
  Let’s install the server part:
  # yum -y install tang
  Start socket service:
  # systemctl restart tangd.socket
  Enable socket service:
  # systemctl enable tangd.socket
  TCP Port
  Check that the tang server is listening:
  # netstat -ntulp | egrep -i systemd
  tcp6 0 0 :::80 :::* LISTEN 1/systemd
  Firewall
  Dont forget the firewall:
  Firewall Zones
  # firewall-cmd --get-active-zones
  public interfaces: eth0
  Firewall Port
  # firewall-cmd --zone=public --add-port=80/tcp --permanent
  or
  # firewall-cmd --add-port=80/tcp --permanent
  success
  Reload
  # firewall-cmd --reload
  success
  We have finished with the server part!
  Client Machine - Encrypted rootfs
  Now it is time to configure the client machine, but before let’s check the encrypted partition:
  CryptTab
  Every encrypted block devices is configured under crypttab file:
  [root@centos7 ~]# cat /etc/crypttab
  luks-3cc09d38-2f55-42b1-b0c7-b12f6c74200c UUID=3cc09d38-2f55-42b1-b0c7-b12f6c74200c none
  FsTab
  and every filesystem that is static mounted on boot, is configured under fstab:
  [root@centos7 ~]# cat /etc/fstab
  UUID=c5ffbb05-d8e4-458c-9dc6-97723ccf43bc /boot xfs defaults 0 0 /dev/mapper/luks-3cc09d38-2f55-42b1-b0c7-b12f6c74200c / xfs defaults,x-systemd.device-timeout=0 0 0
  Installation
  Now let’s install the client (clevis) part that will talk with tang:
  # yum -y install clevis clevis-luks clevis-dracut
  Configuration
  with a very simple command:
  # clevis bind luks -d /dev/vda2 tang '{"url":""}'
  The advertisement contains the following signing keys: FYquzVHwdsGXByX_rRwm0VEmFRo/vda2? [yn] y Enter existing LUKS password:
  we’ve just configured our encrypted volume against tang!
  Luks MetaData
  We can verify it’s luks metadata with:
  [root@centos7 ~]# luksmeta show -d /dev/vda2
  0 active empty 1 active cb6e8904-81ff-40da-a84a-07ab9ab5715e 2 inactive empty 3 inactive empty 4 inactive empty 5 inactive empty 6 inactive empty 7 inactive empty
  dracut
  We must not forget to regenerate the initramfs image, that on boot will try to talk with our tang server:
  [root@centos7 ~]# dracut -f
  Reboot
  Now it’s time to reboot!
  A short msg will appear in our screen, but in a few seconds and if successfully exchange messages with the tang server, our server with de-crypt the rootfs volume.
  Tang messages
  To finish this article, I will show you some tang msg via journalct:
  Initialization
  Getting the signing key from the client on setup:
  Jan 31 22:43:09 centos7 systemd[1]: Started Tang Server (192.168.122.195:58088). Jan 31 22:43:09 centos7 systemd[1]: Starting Tang Server (192.168.122.195:58088)... Jan 31 22:43:09 centos7 tangd[1219]: 192.168.122.195 GET /adv/ => 200 (src/tangd.c:85)
  reboot
  Client is trying to decrypt the encrypted volume on reboot
  Jan 31 22:46:21 centos7 systemd[1]: Started Tang Server (192.168.122.162:42370). Jan 31 22:46:21 centos7 systemd[1]: Starting Tang Server (192.168.122.162:42370)... Jan 31 22:46:22 centos7 tangd[1223]: 192.168.122.162 POST /rec/Shdayp69IdGNzEMnZkJasfGLIjQ => 200 (src/tangd.c:168)
  A Counterintuitive Approach to Living a Good Life
  by Mark Manson - Narrated By Roger Wayne
  >>IMAGE
  Fabric
  Fabric is a Python (2.5-2.7) library and command-line tool for streamlining the use of SSH for application deployment or systems administration tasks.
  You can find the documentation here
  Installation
  # yum -y install epel-release
  # yum -y install fabric
  Hello World
  # cat > fabfile.py <<EOF > def hello(): > print("Hello world!") > > EOF
  and run it
  # fab hello -f ./fabfile.py
  Hello world! Done.
  A more complicated example
  def HelloWorld(): print("Hello world!") def hello(name="world"): print("Hello %s!" % name )
  # fab HelloWorld -f ./fabfile.py Hello world! Done. # fab hello -f ./fabfile.py Hello world! Done. # fab hello:name=ebal -f ./fabfile.py Hello ebal! Done.
  A remote example
  from fabric.api import run , env env.use_ssh_config = True def HelloWorld(): print("Hello world!") def hello(name="world"): print("Hello %s!" % name ) def uptime(): run('uptime')
  ssh configuration file
  with the below variable declaration
  (just remember to import env)
  fabric can use the ssh configuration file of your system
  env.use_ssh_config = True
  and run it against server test
  $ fab -H test uptime -f ./fabfile.py
  [test] Executing task 'uptime' [test] run: uptime [test] out: 20:21:30 up 10 days, 11 min, 1 user, load average: 0.00, 0.00, 0.00 [test] out: Done. Disconnecting from 192.168.122.1:22... done.