Forum Discussion

Roman_'s avatar
Roman_
Icon for Altostratus rankAltostratus
Jun 20, 2023

APM client side security, check disk encpytion in linux

hello,

I Would like to ask if there is any way how to check whether there is disk encryption enabled.

I found some iRules:

 

when CLIENT_ACCEPTED {
    set client_ip [IP::client_addr]
    set disk_encrypted [exec dmsetup status | grep <device_name>]

    if {[string length $disk_encrypted] > 0} {
        # Disk encryption is enabled
        log local0.info "Client $client_ip has disk encryption enabled"
        # Perform additional actions or allow access to the application
    } else {
        # Disk encryption is not enabled
        log local0.warn "Client $client_ip does not have disk encryption enabled"
        # Optionally deny access or perform additional actions
        reject
    }
}

 

 

 

when CLIENT_ACCEPTED {
    set client_ip [IP::client_addr]
    set encrypted_devices [exec cryptsetup luksDump <device_name>]

    if {[string length $encrypted_devices] > 0} {
        # Disk encryption is enabled
        log local0.info "Client $client_ip has disk encryption enabled"
        # Perform additional actions or allow access to the application
    } else {
        # Disk encryption is not enabled
        log local0.warn "Client $client_ip does not have disk encryption enabled"
        # Optionally deny access or perform additional actions
        reject
    }
}

 

 could this work? if yes where they should be implemeted in APM as iRule event? it si possible to do within CLIENT_ACCEPTED?

Thank you

  • Please note that these iRules execute custom code on the underlying user operating system. This is then stored into a variable and checked.

     Therefore, a solution would be custom depending on many factors, such as a) operating systems in use and b) encryption program sanctioned for use. Not sure if there is enough client side inspection magic happening to check against a database of multiple encryption types and simply toggle a variable for use in iRules.

    You may need professional services for this.