P. 1
Unix Toolbox

Unix Toolbox

4.9

|Views: 702|Likes:
Published by Edycop
Collection of Unix/Linux/BSD commands and tasks which are useful for IT work or for advanced users.
Collection of Unix/Linux/BSD commands and tasks which are useful for IT work or for advanced users.

More info:

Published by: Edycop on Oct 21, 2008
Copyright:Attribution Non-commercial

Availability:

Read on Scribd mobile: iPhone, iPad and Android.
download as PDF, TXT or read online from Scribd
See more
See less

01/06/2014

pdf

text

original

Linux with LUKS(p31)|Linux dm-crypt only(p31)|FreeBSD GELI(p31)|FBSD pwd only(p32)

Thereare(many)otheralternativemethodstoencryptdisks,IonlyshowherethemethodsI
knowanduse.KeepinmindthatthesecurityisonlygoodaslongtheOShasnotbeentempered

— Encrypt Partitions —

30

with.Anintrudercouldeasilyrecordthepasswordfromthekeyboardevents.Furthermorethe
dataisfreelyaccessiblewhenthepartitionisattachedandwillnotpreventanintrudertohave
access to it in this state.

10.1Linux

Those instructions use the Linuxdm-crypt(device-mapper) facility available on the 2.6 kernel. In
thisexample,letsencryptthepartition/dev/sdc1,itcouldbehoweveranyotherpartitionor
disk,orUSBorafilebasedpartitioncreatedwithlosetup.Inthiscasewewoulduse/dev/
loop0
.Seefileimagepartition.Thedevicemapperuseslabelstoidentifyapartition.Weuse
sdc1in this example, but it could be any string.

dm-crypt with LUKS

LUKSwithdm-crypthasbetterencryptionandmakesitpossibletohavemultiplepassphrasefor
thesamepartitionortochangethepasswordeasily.TotestifLUKSisavailable,simplytype#
cryptsetup--help
,ifnothingaboutLUKSshowsup,usetheinstructionsbelowWithoutLUKS.
First create a partition if necessary:fdisk /dev/sdc.

Create encrypted partition

# dd if=/dev/urandom of=/dev/sdc1

# Optional. For paranoids only (takes days)

# cryptsetup -y luksFormat /dev/sdc1

# This destroys any data on sdc1

# cryptsetup luksOpen /dev/sdc1 sdc1
# mkfs.ext3 /dev/mapper/sdc1

# create ext3 file system

# mount -t ext3 /dev/mapper/sdc1 /mnt
# umount /mnt
# cryptsetup luksClose sdc1

# Detach the encrypted partition

Attach

# cryptsetup luksOpen /dev/sdc1 sdc1
# mount -t ext3 /dev/mapper/sdc1 /mnt

Detach

# umount /mnt
# cryptsetup luksClose sdc1

dm-crypt without LUKS

# cryptsetup -y create sdc1 /dev/sdc1

# or any other partition like /dev/loop0

# dmsetup ls

# check it, will display: sdc1 (254, 0)

# mkfs.ext3 /dev/mapper/sdc1

# This is done only the first time!

# mount -t ext3 /dev/mapper/sdc1 /mnt
# umount /mnt/
# cryptsetup remove sdc1

# Detach the encrypted partition

Doexactlythesame(withoutthemkfspart!)tore-attachthepartition.Ifthepasswordisnot
correct,themountcommandwillfail.Inthiscasesimplyremovethemapsdc1(cryptsetup
remove sdc1
) and create it again.

10.2FreeBSD

ThetwopopularFreeBSDdiskencryptionmodulesaregbdeandgeli.Inowusegelibecauseit
isfasterandalsousesthecryptodeviceforhardwareacceleration.SeeTheFreeBSDhandbook
Chapter 18.613

for all the details. The geli module must be loaded or compiled into the kernel:

13.http://www.freebsd.org/handbook/disks-encrypting.html

— Encrypt Partitions —

31

options GEOM_ELI
device crypto

# or as module:

# echo 'geom_eli_load="YES"' >> /boot/loader.conf

# or do: kldload geom_eli

Use password and key

Iusethosesettingsforatypicaldiskencryption,itusesapassphraseANDakeytoencryptthe
masterkey.Thatisyouneedboththepasswordandthegeneratedkey/root/ad1.keytoattach
thepartition.Themasterkeyisstoredinsidethepartitionandisnotvisible.Seebelowfortypical
USB or file based image.

Create encrypted partition

# dd if=/dev/random of=/root/ad1.key bs=64 count=1# this key encrypts the mater key
# geli init -s 4096 -K /root/ad1.key /dev/ad1

# -s 8192 is also OK for disks

# geli attach -k /root/ad1.key /dev/ad1

# DO make a backup of /root/ad1.key

# dd if=/dev/random of=/dev/ad1.eli bs=1m

# Optional and takes a long time

# newfs /dev/ad1.eli

# Create file system

# mount /dev/ad1.eli /mnt

Attach

# geli attach -k /root/ad1.key /dev/ad1
# fsck -ny -t ffs /dev/ad1.eli

# In doubt check the file system

# mount /dev/ad1.eli /mnt

Detach

The detach procedure is done automatically on shutdown.

# umount /mnt
# geli detach /dev/ad1.eli

/etc/fstab

Theencryptedpartitioncanbeconfiguredtobemountedwith/etc/fstab.Thepasswordwillbe
prompted when booting. The following settings are required for this example:

# grep geli /etc/rc.conf
geli_devices="ad1"
geli_ad1_flags="-k /root/ad1.key"
# grep geli /etc/fstab
/dev/ad1.eli /home/private ufs rw 0 0

Use password only

ItismoreconvenienttoencryptaUSBstickorfilebasedimagewithapassphraseonlyandno
key.Inthiscaseitisnotnecessarytocarrytheadditionalkeyfilearound.Theprocedureisvery
muchthesameasabove,simplywithoutthekeyfile.Let'sencryptafilebasedimage
/cryptedfileof 1 GB.

# dd if=/dev/zero of=/cryptedfile bs=1M count=1000# 1 GB file
# mdconfig -at vnode -f /cryptedfile
# geli init /dev/md0

# encrypts with password only

# geli attach /dev/md0
# newfs -U -m 0 /dev/md0.eli
# mount /dev/md0.eli /mnt
# umount /dev/md0.eli
# geli detach md0.eli

It is now possible to mount this image on an other system with the password only.

# mdconfig -at vnode -f /cryptedfile
# geli attach /dev/md0
# mount /dev/md0.eli /mnt

— Encrypt Partitions —

32

You're Reading a Free Preview

Download
scribd
/*********** DO NOT ALTER ANYTHING BELOW THIS LINE ! ************/ var s_code=s.t();if(s_code)document.write(s_code)//-->