tutorial - encryption with LUKS of an iSCSI backup device

# To enable CHAP authentication for a discovery session to the target
# set discovery.sendtargets.auth.authmethod to CHAP. The default is None.
discovery.sendtargets.auth.authmethod = CHAP


# To set a discovery session CHAP username and password for the initiator
# authentication by the target(s), uncomment the following lines:
discovery.sendtargets.auth.username = discoverinuser
discovery.sendtargets.auth.password = discoverinpass


# To set a discovery session CHAP username and password for target(s)
# authentication by the initiator, uncomment the following lines:
discovery.sendtargets.auth.username_in = discoveroutuser
discovery.sendtargets.auth.password_in = discoveroutuserpass

omv-filer:~# parted /dev/sdc
GNU Parted 2.3
Using /dev/sdc
Welcome to GNU Parted! Type 'help' to view a list of commands.
(parted) mklabel gpt
Warning: The existing disk label on /dev/sdc will be destroyed and all data on
this disk will be lost. Do you want to continue?
Yes/No? yes
(parted) mkpart primary ext4 1M 100%
(parted) p
Model: IET VIRTUAL-DISK (scsi)
Disk /dev/sdc: 5369MB
Sector size (logical/physical): 512B/512B
Partition Table: gpt


Number  Start   End     Size    File system  Name     Flags
 1      1049kB  5368MB  5367MB               primary


(parted) q
Information: You may need to update /etc/fstab.

#! /bin/sh
### BEGIN INIT INFO
# Provides:          cryptdisks-late
# Required-Start:    checkroot
# Required-Stop:     umountroot
# Should-Start:      udev mdadm-raid lvm2 open-iscsi
# Should-Stop:       udev mdadm-raid lvm2 open-iscsi
# X-Start-Before:
# X-Stop-After:
# X-Interactive:     true
# Default-Start:     S
# Default-Stop:      0 6
# Short-Description: Setup late encrypted block devices.
# Description:
### END INIT INFO


iscsiUUIDList="ad0bca32-9393-40b4-ae1a-142ed8f374fc"
maxTries=3


do_start () {
        local iscsiUUID stopWaiting tries iscsiUUIDFound cryptedvol
        # try to open all encrypted volumes
        if [ -f /etc/crypttab ]
        then
                if [ -r /etc/crypttab ]
                then
                        for iscsiUUID in $iscsiUUIDList
                        do
                                echo "checking /dev/disk/by-uuid/$iscsiUUID ..."
                                stopWaiting=0
                                tries=0
                                iscsiUUIDFound=0
                                while [ $stopWaiting -eq 0 ]
                                do
                                        tries=`expr $tries + 1`
                                        if [ -e /dev/disk/by-uuid/$iscsiUUID ]
                                        then
                                                stopWaiting=1
                                                iscsiUUIDFound=1
                                                echo "device $iscsiUUID found"
                                        else
                                                if [ $tries -gt $maxTries ]
                                                then
                                                        stopWaiting=1
                                                        echo "device $iscsiUUID not found after $maxTries tries; giving up"
                                                else
                                                        echo "Tried $tries out of $maxTries waiting a second..."
                                                        sleep 1s
                                                fi
                                        fi
                                done
                                if [ $iscsiUUIDFound -eq 1 ]
                                then
                                        echo "finding in /etc/crypttab the mapped device name for $iscsiUUID"
                                        cryptedvol=$(tail -n +2 /etc/crypttab | grep $iscsiUUID | cut -f 1)
                                        # try to open the volume found in /etc/crypttab
                                        echo "trying to open $cryptedvol"
                                        cryptdisks_start $cryptedvol
                                        if [ $? -eq 0 ]
                                        then
                                                # try to mount once, if it exists un /etc/fstab
                                                echo "trying to mount the crypted volume $cryptedvol"
                                                mount /dev/mapper/$cryptedvol
                                                if [ $? -ne 0 ]
                                                then
                                                        echo "Could not mount $cryptedvol"
                                                fi
                                        else
                                                echo "Could not open encrypted volume with cryptdis_start"
                                        fi
                                fi
                        done
                fi
        fi
}


do_stop () {
        local iscsiUUID stopWaiting tries iscsiUUIDFound cryptedvol
        # try to open all encrypted volumes
        if [ -f /etc/crypttab ]
        then
                if [ -r /etc/crypttab ]
                then
                        for iscsiUUID in $iscsiUUIDList
                        do
                                echo "checking /dev/disk/by-uuid/$iscsiUUID ..."
                                stopWaiting=0
                                tries=0
                                iscsiUUIDFound=0
                                while [ $stopWaiting -eq 0 ]
                                do
                                        tries=`expr $tries + 1`
                                        if [ -e /dev/disk/by-uuid/$iscsiUUID ]
                                        then
                                                stopWaiting=1
                                                iscsiUUIDFound=1
                                                echo "device $iscsiUUID found"
                                        fi
                                done
                                if [ $iscsiUUIDFound -eq 1 ]
                                then
                                        echo "finding in /etc/crypttab the mapped device name for $iscsiUUID"
                                        cryptedvol=$(tail -n +2 /etc/crypttab | grep $iscsiUUID | cut -f 1)
                                        # try to unmount the volume found in /etc/crypttab
                                        echo "trying to unmount the crypted volume $cryptedvol"
                                        umount /dev/mapper/$cryptedvol
                                        if [ $? -eq 0 ]
                                        then
                                                # try to close the crypted volume
                                                echo "trying to close the crypted volume $cryptedvol"
                                                cryptdisks_stop $cryptedvol
                                                if [ $? -ne 0 ]
                                                then
                                                        echo "Could not close $cryptedvol"
                                                fi
                                        else
                                                echo "Could not unmount encrypted volume with umount"
                                        fi
                                fi
                        done
                fi
        fi
}


case "$CRYPTDISKS_ENABLE" in
[Nn]*)
        exit 0
        ;;
esac


case "$1" in
start)
        do_start
        ;;
stop)
        do_stop
        ;;
restart|reload|force-reload)
        do_stop
        do_start
        ;;
force-start)
        FORCE_START="yes"
        do_start
        ;;
*)
        echo "Usage: cryptdisks {start|stop|restart|reload|force-reload|force-start}"
        exit 1
        ;;
esac