Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #224039

Re: Advice on encrypted filesystem

Show all headers | View raw

On Thu 25 Jun 2020 at 07:40:43 (-0400), rhkramer@gmail.com wrote:
> On Wednesday, June 24, 2020 10:20:55 PM David Wright wrote:
> > On Wed 24 Jun 2020 at 21:28:38 (-0400), rhkramer@gmail.com wrote:
> > > On my Wheezy system, I used cryptsetup to set up a LUKs  encrypted file
> > > system on a dedicated partition
> > 
> > What were the contents of this partition: the OS itself, or /home,
> > or an independent filesystem that you'd probably mount under /media?
> 
> an independent filesystem mounted as a top level directory

Then I can't see any point in involving the Debian installer.
Some of the details depend on what scripts you use to unlock
and mount. My own method for creating a filesystem is
(from my notes):

--✄----

If encrypting an entire disk, scramble the disk first, then partition.
If only encrypting a partition, partition the disk first.
Alignments should be at least 2M (4096 x 512B sectors).
Scramble any sensitive pre-existing contents:

# dd bs=1M if=/dev/urandom of=/dev/sdz[9]

Partitioning is conventional.

# gdisk /dev/sdz

[… etc …]

Creating the encrypted partition.

# cryptsetup --align-payload 2048 luksFormat /dev/sdz9

WARNING!
========
This will overwrite data on /dev/sdb1 irrevocably.

[… etc …]

Add more passphrases:

# cryptsetup luksAddKey /dev/sdz9

[… etc …]

Create the filesystem:

# cryptsetup open --type luks /dev/sdz9 thename

# mkfs.ext4 -L name09 /dev/mapper/thename

[… etc …]

# e2label /dev/mapper/thename name09 (if forgotten above).

Finally:

# cryptsetup luksClose thename

--✄----

(I mangle the device names to make copy/paste less dangerous.)

> (I have some scripts to allow me to easily open (and close) those filesystems 
> -- when they open, the unencrypted content is put on a ramdisk (with the 
> intent if somebody gets physical possession of the device (which is a desktop, 
> not a laptop), the enencrypted data disappears on power off.) 

As I encrypt /home, it wouldn't make sense for me to copy it all.
I assume that nobody's going to freeze my PC when they steal it.

My scripts use LABELled filesystems (as seen above), so there's nothing
unusual about /etc/fstab; and I unlock with udisksctl, using the
/dev/disk/by-partlabel value, so there's no entry in /etc/crypttab.

> Well, the Buster system is a laptop, Jessie is a desktop.  I don't plan to put 
> much, if any, sensitive data on the laptop.  (I don't really even intend to 
> take the laptop out of the house, especially during this Covid thing -- I 
> installed Buster on it because I needed GCC 7+ and couldn't (easily) do that 
> on the Wheezy or Jessie systems.
> 
> > Do you use suspend? 
> 
> No.

Then you could encrypt swap with a random key. My method for that
is unusual, in that the swap partition is specified in fstab by
its (tiny) filesystem's LABEL. Its /etc/crypttab is thus fixed:

swap	LABEL=cryptswap	/dev/urandom	swap,offset=2048,cipher=aes-xts-plain64,size=512

> > Desktops? 
> 
> See above.
> 
> > Do you boot them remotely?
> 
> No, but they do stay up 24/7 unless there is a (longer that 2 minute (power is 
> UPS supported)) power outage, or a (very rare) reboot.

OK. This only really matters if you're encrypting /home (as I do)
or the system itself, as you then need a method of supplying the
passphrase before any users can login. (I use a pseudo-user whose
~ is in /var/local/home/ with a crafted .bash_profile.)

Cheers,
David.

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Advice on encrypted filesystem rhkramer@gmail.com - 2020-06-25 03:30 +0200
  Re: Advice on encrypted filesystem Roberto C. Sánchez <roberto@debian.org> - 2020-06-25 03:40 +0200
    Re: Advice on encrypted filesystem David Christensen <dpchrist@holgerdanske.com> - 2020-06-25 04:20 +0200
    Re: Advice on encrypted filesystem john doe <johndoe65534@mail.com> - 2020-06-25 09:50 +0200
    Re: Advice on encrypted filesystem rhkramer@gmail.com - 2020-06-25 13:40 +0200
      Re: Advice on encrypted filesystem David <bouncingcats@gmail.com> - 2020-06-25 15:30 +0200
        Re: Advice on encrypted filesystem Nicolas George <george@nsup.org> - 2020-06-25 15:40 +0200
          Sound in Jitsi/BBB [was: dvice on encrypted filesystem] <tomas@tuxteam.de> - 2020-06-25 16:00 +0200
            Re: Sound in Jitsi/BBB [was: dvice on encrypted filesystem] Nicolas George <george@nsup.org> - 2020-06-25 16:00 +0200
              Re: Sound in Jitsi/BBB [was: dvice on encrypted filesystem] <tomas@tuxteam.de> - 2020-06-25 16:10 +0200
        Zoom client for Linux (was: Re: Advice on encrypted filesystem) rhkramer@gmail.com - 2020-06-25 16:20 +0200
      Re: Advice on encrypted filesystem rhkramer@gmail.com - 2020-06-25 16:30 +0200
  Re: Advice on encrypted filesystem David Wright <deblis@lionunicorn.co.uk> - 2020-06-25 04:30 +0200
    Re: Advice on encrypted filesystem rhkramer@gmail.com - 2020-06-25 13:50 +0200
      Re: Advice on encrypted filesystem David Wright <deblis@lionunicorn.co.uk> - 2020-06-26 15:30 +0200
        Re: Advice on encrypted filesystem rhkramer@gmail.com - 2020-06-26 16:40 +0200
        Re: Advice on encrypted filesystem Michael Stone <mstone@debian.org> - 2020-06-26 17:50 +0200
          Re: Advice on encrypted filesystem David Wright <deblis@lionunicorn.co.uk> - 2020-06-26 21:10 +0200
            Re: Advice on encrypted filesystem Michael Stone <mstone@debian.org> - 2020-06-26 21:50 +0200
              Re: Advice on encrypted filesystem David Wright <deblis@lionunicorn.co.uk> - 2020-06-27 03:30 +0200
                Re: Advice on encrypted filesystem David Christensen <dpchrist@holgerdanske.com> - 2020-06-27 06:10 +0200
                Re: Advice on encrypted filesystem David Christensen <dpchrist@holgerdanske.com> - 2020-06-27 09:10 +0200
                Re: Advice on encrypted filesystem Admin4 <admin4@dwaves.de> - 2020-06-27 10:10 +0200
                Re: Advice on encrypted filesystem David Christensen <dpchrist@holgerdanske.com> - 2020-06-27 21:50 +0200
                Re: Advice on encrypted filesystem David Christensen <dpchrist@holgerdanske.com> - 2020-06-27 22:20 +0200
                Re: Advice on encrypted filesystem Andrei POPESCU <andreimpopescu@gmail.com> - 2020-06-27 10:50 +0200
                Re: Advice on encrypted filesystem David Christensen <dpchrist@holgerdanske.com> - 2020-06-27 23:30 +0200

csiph-web