Protecting Data with LUKS and NBDE

# Kickstart
autopart --type=lvm --encrypted --passphrase=PASSPHRASE
part /home --fstype=ext4 --size=10000 --onpart=vda2 --encrypted --passphrase=PASSPHRASE
part pv.01 --size=10000 --encrypted --passphrase=PASSPHRASE
# After Installation 
cryptsetup luksFormat /dev/vdb1
cryptsetup luksDump /dev/vdb1
cryptsetup luksOpen /dev/vdb1 example
cryptsetup luksClose example
parted -l
parted /dev/vdb 
>mklabel msdos 
>mkpart primary xfs 1M 1G
parted /dev/vdb print
cryptsetup luksOpen /dev/vdb1 encryptedvdb1
ls /dev/mapper/encryptedvdb1
mkfs.xfs /dev/mapper/encryptedvdb1
mkdir /encrypted
mount -t xfs /dev/mapper/encryptedvdb1 /encrypted
mount | grep /encrypted
touch /encrypted/testfile
cryptsetup luksClose encryptedvdb1

# File System Decryption with NBDE
# Configuring Clevis and Tang 
yum install clevis clevis-luks clevis-dracut
clevis luks bind  -d /dev/vdb1 tang '{ "url":"http_server" }'
systemctl enable clevis-luks-askpass.path
vi /etc/crypttab
decrypted1  /dev/vdb1  none  _netdev
vi /etc/fstab
/dev/mapper/decrypted1   /encrypted       xfs    _netdev        1 2

yum install tang
firewall-cmd --zone=public --add-service=http --permanent
firewall-cmd --reload
systemctl enable tangd.socket --now
cd /var/db/tang
jose jwk gen -i '{"alg":"ES512"}' \>-o signature.jwk
jose jwk gen -i '{"alg":"ECMR"}' \>-o exchange.jwk