![如何在 FreeBSD 13 上添加加密交换文件](https://linux22.com/image/199224/%E5%A6%82%E4%BD%95%E5%9C%A8%20FreeBSD%2013%20%E4%B8%8A%E6%B7%BB%E5%8A%A0%E5%8A%A0%E5%AF%86%E4%BA%A4%E6%8D%A2%E6%96%87%E4%BB%B6.png)
答案1
提供的链接@r bert
很接近,但可以从一些微调中受益。
感谢原创者FreeBSD 论坛上的 mb2015。此方法创建自定义服务脚本并在/etc/rc.conf
.
首先,/usr/local/etc/rc.d/encrypted_swapfile
通过复制并粘贴这个大cat
命令来执行它来创建它,然后执行chmod
它后面的命令:
# cat << 'EOF' > /usr/local/etc/rc.d/encrypted_swapfile
#!/bin/sh
# PROVIDE: encrypted_swapfile
# REQUIRE: swaplate
# BEFORE: LOGIN
# KEYWORD: nojail shutdown
. /etc/rc.subr
name="encrypted_swapfile"
rcvar="encrypted_swapfile_enable"
start_cmd="${name}_start"
stop_cmd="${name}_stop"
load_rc_config "$name"
: ${encrypted_swapfile_enable:="NO"}
: ${encrypted_swapfile_file:="/usr/swap0"}
: ${encrypted_swapfile_size:="2G"}
SWFILE="$encrypted_swapfile_file";
SWFILEDIR="$(dirname "$SWFILE")";
SWDEVLINK="/var/run/encrypted_swapfile_device";
encrypted_swapfile_start()
{
# Create and mount a one-time encrypted swap file.
# This is a workaround for the inability to do this via an /etc/fstab entry.
# See https://forums.freebsd.org/threads/encrypt-swap-file.44519/#post-292933
#
if [ ! -e "$SWDEVLINK" ]; then
if [ -w "$SWFILEDIR" ]; then
truncate -s "$encrypted_swapfile_size" "$encrypted_swapfile_file" &&
chmod 0600 "$encrypted_swapfile_file" &&
SWMD="$(mdconfig -a -t vnode -f "$encrypted_swapfile_file")" &&
if [ $? -eq 0 ] && [ -n $SWMD ] && [ -e "/dev/$SWMD" ]; then
chmod 0600 "/dev/$SWMD" &&
geli onetime -e AES-XTS -l 256 -d "/dev/$SWMD" &&
chmod 0600 "/dev/$SWMD.eli" &&
swapon "/dev/$SWMD.eli" &&
ln -f -s "/dev/$SWMD.eli" "$SWDEVLINK";
unset SWMD;
fi
else
echo "Could not create encrypted swap file in $SWFILEDIR; check permissions." &&
return 1;
fi
else
SWMD="$(readlink "$SWDEVLINK")" &&
swapinfo | grep -vq "^$SWMD " &&
echo "Encrypted swap file already exists; enabling." &&
swapon "$SWMD";
unset SWMD;
fi
return 0;
}
encrypted_swapfile_stop()
{
if [ -e "$SWDEVLINK" ]; then
SWMD=$(readlink "$SWDEVLINK") &&
swapoff "$SWDEVLINK" &&
mdconfig -du "${SWMD%.eli}" &&
rm "$SWDEVLINK" &&
rm "$SWFILE";
else
echo "No encrypted swap file found; nothing to stop.";
rm -f "$SWDEVLINK";
fi
}
run_rc_command "$1"
EOF
# chmod 755 /usr/local/etc/rc.d/encrypted_swapfile
接下来,编辑/etc/rc.conf
以启用此新服务,并配置它使用的变量:
encrypted_swapfile_enable="yes"
encrypted_swapfile_file="/usr/swap0"
encrypted_swapfile_size="2G"
现在您的加密交换文件可以通过启动或停止服务来激活或停用encrypted_swapfile
:
# swapinfo
Device 1024-blocks Used Avail Capacity
# service encrypted_swapfile start
# swapinfo
Device 1024-blocks Used Avail Capacity
/dev/md0.eli 2097152 0 2097152 0%
# service encrypted_swapfile stop
# swapinfo
Device 1024-blocks Used Avail Capacity