| View previous topic :: View next topic |
| Author |
Message |
Ryonez
n00b
Joined: 22 Aug 2015
Posts: 22
Location: New Zealand
|
 Posted: Sun Aug 23, 2015 5:02 am Post subject: Question regarding encryption for laptops |
 |
|
So, after having sorted out what init system to use, I'm left with only one other issue to sort before I install Gentoo onto my laptop.
Encryption.
I properly wouldn't bother with this on a desktop (ok maybe profile encryption there) however as a laptop isn't always going to be in a secure environment, I feel it's imported to use.
Heads up, I know a fair bit when it comes to encryption on windows having used bitlock, truecrypt and veracrypt. My knowledge on cmdline and linux use is rather pitiful.
I've only dealt with profile encryption on my ubuntu server, but dropped that after password issue over ssh forced me to chroot and replace root and user passwords.
Ubunutu hides a lot of the background from the user, so all I know is lvm is important somewhere.
One more things is I'm aware of at least two methods possible on linux. Profile encryption and system/drive encryption.
Could some please explain how encryption works with Gentoo?
Last edited by Ryonez on Sun Aug 23, 2015 3:40 pm; edited 1 time in total |
|
| Back to top |
|
 |
ian.au
Guru
Joined: 07 Apr 2011
Posts: 593
Location: Australia
|
|
| Back to top |
|
|
The Doctor
Moderator
Joined: 27 Jul 2010
Posts: 2678
|
| Posted: Sun Aug 23, 2015 5:58 am Post subject: |
|
|
I'll add that in general on Gentoo encryption is only as hard or as fancy as you make it. I encrypted my laptop using luks with serpent and lvm. Basically, all it did was add a fairly simple step to partitioning the disks. Writing an init can be more of a challenge, but it still doesn't need to really do much so a ridiculously simple one will suffice. All it needs to do is ask for a password and switch to the real root.
If you want to get fancy, you can make it ask for a password or check for a specific thumb drive placed in a specific USB port containing a specific key file that doubles as an innocuous image in a family album. That can speed up the boot and protect your password, but remember, security and usability are inverses of each other and encryption does nothing if you leave the computer on.
_________________
First things first, but not necessarily in that order.
Apologies if I take a while to respond. I'm currently working on the dematerialization circuit for my blue box. |
|
| Back to top |
|
|
Ryonez
n00b
Joined: 22 Aug 2015
Posts: 22
Location: New Zealand
|
| Posted: Sun Aug 23, 2015 7:12 am Post subject: |
|
|
| The Doctor wrote: | I'll add that in general on Gentoo encryption is only as hard or as fancy as you make it. I encrypted my laptop using luks with serpent and lvm. Basically, all it did was add a fairly simple step to partitioning the disks. Writing an init can be more of a challenge, but it still doesn't need to really do much so a ridiculously simple one will suffice. All it needs to do is ask for a password and switch to the real root.
If you want to get fancy, you can make it ask for a password or check for a specific thumb drive placed in a specific USB port containing a specific key file that doubles as an innocuous image in a family album. That can speed up the boot and protect your password, but remember, security and usability are inverses of each other and encryption does nothing if you leave the computer on. |
Could I ask for a rough diagram on your partition layout?
I've been going through the guides, but they don't mention lvm. My knowledge on it is slim... |
|
| Back to top |
|
|
Hu
Administrator
Joined: 06 Mar 2007
Posts: 21706
|
| Posted: Sun Aug 23, 2015 2:27 pm Post subject: |
|
|
The most convenient approach for encryption is to have:
- sdX1 /boot
- sdX2 LUKS
- LVM
- /
- /home (if separate from / -- recommended, but not required)
- /var (if separate from / -- recommended, but not required)
Feel free to reorder the volumes within the LVM node. The important part is that unlocking the LUKS partition exposes the LVM, so that there is one LUKS key for all the filesystems. The other choice is to go:
This design puts each filesystem in its own LUKS container, meaning you need a separate password or key for each filesystem.
In either case, you will want a swap volume if you expect to use hibernation. If you use swap, you should put it inside a LUKS container too. You can follow either of the two models above for where to put swap. I put it outside the LVM, so that I do not need to worry about the resume kernel accessing the LVM at all. That would produce this arrangement:
- sdX1 /boot
- sdX2 LUKS
- sdX3 LUKS
Again, reorder individual partitions as you like. |
|
| Back to top |
|
|
Roman_Gruber
Advocate
Joined: 03 Oct 2006
Posts: 3846
Location: Austro Bavaria
|
| Posted: Sun Aug 23, 2015 2:34 pm Post subject: Re: Question regarding encryption for laptops |
|
|
| Quote: | | So, after sorting out what init system to use, I'm left with only one other issue to sort before I install Gentoo onto my laptop. |
openrc, as you can easily switch later to sytemd, but not that easily form systemd to openrc afaik.
| Code: | Encryption.
I properly wouldn't bother with this on a desktop (ok maybe profile encryption there) however as a laptop isn't always going to be in a secure environment, I feel it's imported to use. |
512mb ext2 / boot partition
root => lvm container => luks container => ext4
do not use any fishy filesystem as btrfs / reiserfs
xfs is slow in my expierence
use something widely used and proven somehow mature and stable => ext4
initramfs => generated with genkernel
grub2 => install a linux mint with 10gb as secondary os, and reuse the grub2 from that (thats my way to handle things ) mint is only for emergency issues, never keep any personal data / anything else on it, just bare minimum, to have network access / file browsers / disc burners / forensic tools.
amd64 profile with both 32/64bit support.
Thats my proven setup for years. I do not want to explain details. Please check the docs regarding each thing like gentoo-wiki, and such ... |
|
| Back to top |
|
|
Ryonez
n00b
Joined: 22 Aug 2015
Posts: 22
Location: New Zealand
|
| Posted: Sun Aug 23, 2015 4:06 pm Post subject: |
|
|
To Hu, thank you for the diagrams. One question about swap, would that be needed for sleep mode as well?
To tw04l124 a couple of things.
1: As you already know from my other post regarding the init system, I've already chosen OpenRC. I don't need to be told what to use.
Granted my wording above did make it seems like a question. I've made it clearer and apologize if it caused confusion.
2: You're suggestion for a setup is a tad over the top. I'm not really interested in dual booting unless there is a very good reason too. And having an insecure OS installed would allow for a point to potentially attack from and chroot from.
3: | Quote: | | I do not want to explain details. Please check the docs regarding each thing like gentoo-wiki, and such ... |
That is useless to me. The whole point of me posting here for help is because I'm struggling to figure this out. Links to pages you think might help with the question would be usefull.
Even then, they don't necessarily explain in a way that is easy for me to get.
Note: I plan to try anything I do in a virtual machine before I install Gentoo on the laptop. |
|
| Back to top |
|
|
Roman_Gruber
Advocate
Joined: 03 Oct 2006
Posts: 3846
Location: Austro Bavaria
|
| Posted: Sun Aug 23, 2015 4:17 pm Post subject: |
|
|
| Quote: |
1: As you already know from my other post regarding the init system, I've already chosen OpenRC. I don't need to be told what to use.
Granted my wording above did make it seems like a question. I've made it clearer and apologize if it caused confusion. |
I am sorry, I try to answer as many posts as possible to improve my knowledge. I may just have forgotten that ..
| Quote: |
2: You're suggestion for a setup is a tad over the top. I'm not really interested in dual booting unless there is a very good reason too. And having an insecure OS installed would allow for a point to potentially attack from and chroot from. |
Well 10gb do not hurt, do they ? and i see a lot of grub does not install bla bla... when you are setting up a box, I usually chroot from a working binary linux. that way i can utilize a terminal, watch cookie recipes on my favourite cookie recipe site and look up the handbook during install. You can later ditch the binary distro or keep it when something goes wrong. you can still boot up taht bnary distro and use it. warning do not update htat binary distro. linux minst for example overwrites grub config without a backup (happened recently, well what do you expcet from a binary noobie distro .... my bug regarding htis is still unanswered from ubuntu side)
Easy workaround is to use the binary distro partition for swap later for example.
Sysrescue cd is nice, but is not a full blown desctop much nicer where you can do whatever you like while you watch building your gentoo installation?
Well i gave you the summary of my research on this topic. and which works as of now.
I read about 2 months about lvm / luks and other stuff. I just wanted to present you a full solution. Feel free to do the same.
I have my reason why I suggested that lvm is on top of the hardrive and not luks for example (lvm features ...)
Well form the system point of view you just use a different file system. Well its not exactly true, but see it that way.
some packages need some additional build in stuff / flags / ... that it works.
and the hint about genkernel initramfs is very important. a lot will tell you write a custom init script, sigh.
Also note that you should align the lvm container according to your hdd specs, and choose useful values. That needs a bit reading else you get performance losses.[/code] |
|
| Back to top |
|
|
Ryonez
n00b
Joined: 22 Aug 2015
Posts: 22
Location: New Zealand
|
| Posted: Sun Aug 23, 2015 4:57 pm Post subject: |
|
|
Thanks tw04l124,
Your explanation for why you do a dual boot was informative. cheers.
I think I'll stick with just having Gentoo on it. The laptop wouldn't handle me playing media on it while Gentoo is building(Got another 2 computers to play stuff on anyways) and maintaining Mint manually down the road would be an extra hassle for me.
About LVM. I've found this page: https://wiki.gentoo.org/wiki/LVM#Features
After having a look though it, I'm not really sure if I'd get any benefits from having LUKS inside the LVM on a laptop. Could you please point out what features you see of being a benefit?
Regarding using a genkernel initramfs, that make a lot of sense. I'll probably go through what it makes and modify it as I need. |
|
| Back to top |
|
|
Roman_Gruber
Advocate
Joined: 03 Oct 2006
Posts: 3846
Location: Austro Bavaria
|
| Posted: Sun Aug 23, 2015 5:12 pm Post subject: |
|
|
Basically I was able to move my / while I was working. Than I physically moved it and rebooted and had my installation on an SSD.
Luks is unflexible. With lvm you can move the data junks as you like. Thats the reason why you hsould have luks inside an lvm thing and not lvm inside luks.
And you can make software raid and whatever you like afaik. but these are detail knowledge. I have not tweaked my lvm for ages, I may tell you half facts. Those linux server pages explain lvm quite in details but you need to find a good source for that.
Assume you have 3 harddiscs and you want to upgrade one harddisc / replace it. You just need to connect the new harddisc via usb (works most of the time) and move the physical extents, thats it. after you moved all of your physical extents that particular harddisc is unused and can be removed, the new harddisc needs to be phyiscal moved and thats it.
AFAIK you can also physically make a duplicate of your lvm setup. thats a real backup and not those fishy scripts or stage 4 where you need to bother to create partions and such. you just create a duplicate which you can just swap drives ...
As i mentioned eaerlier, please refer to the docs. I have not read / used about lvm for a few years now. My setup dates back to 2012 or earlier
I will never set up any of my boxes without an lvm setup. It has too many benefits and moving the data junks with ordinary file systems is not that easy as it seems.
e.g. https://www.howtoforge.com/linux_lvm_snapshots
| Quote: | | This tutorial shows how you can create backups of LVM partitions with an LVM feature called LVM snapshots. An LVM snapshot is an exact copy of an LVM partition that has all the data from the LVM volume from the time the snapshot was created. The big advantage of LVM snapshots is that they can be used to greatly reduce the amount of time that your services/databases are down during backups because a snapshot is usually created in fractions of a second. After the snapshot has been created, you can back up the snapshot while your services and databases are in normal operation. |
Personally I beleive that gentoo wiki page about lvm is poor. It was written from someone who does not focus on someone who never dealt with it. You are better of with a ressource which starts by explaining the idea behind it and how it works and not just a plain summary of a huge pile of commands.
Reusing an existing installation is a pain in the ass without proper knowledge ...
and ever tried to backup your hole box?
lvm backup + binary distro which i install on demand fresh (reuse grub2 from that) + manual copy the boot entry for gentoo + kernel (thats it)
you can also reinstall grub2 to the new drive, copy /boot, + lvm backup (thats a matter of choice=)
It is more likely that you swap out drives that you do a fresh installation. I did several times swapped drives in this 6 year old box. 4x harddrive, 1x ssd. |
|
| Back to top |
|
|
Ryonez
n00b
Joined: 22 Aug 2015
Posts: 22
Location: New Zealand
|
| Posted: Sun Aug 23, 2015 6:10 pm Post subject: |
|
|
| tw04l124 wrote: | Basically I was able to move my / while I was working. Than I physically moved it and rebooted and had my installation on an SSD.
Luks is unflexible. With lvm you can move the data junks as you like. Thats the reason why you hsould have luks inside an lvm thing and not lvm inside luks.
And you can make software raid and whatever you like afaik. but these are detail knowledge. I have not tweaked my lvm for ages, I may tell you half facts. Those linux server pages explain lvm quite in details but you need to find a good source for that.
Assume you have 3 harddiscs and you want to upgrade one harddisc / replace it. You just need to connect the new harddisc via usb (works most of the time) and move the physical extents, thats it. after you moved all of your physical extents that particular harddisc is unused and can be removed, the new harddisc needs to be phyiscal moved and thats it.
AFAIK you can also physically make a duplicate of your lvm setup. thats a real backup and not those fishy scripts or stage 4 where you need to bother to create partions and such. you just create a duplicate which you can just swap drives ...
As i mentioned eaerlier, please refer to the docs. I have not read / used about lvm for a few years now. My setup dates back to 2012 or earlier
I will never set up any of my boxes without an lvm setup. It has too many benefits and moving the data junks with ordinary file systems is not that easy as it seems.
e.g. https://www.howtoforge.com/linux_lvm_snapshots
| Quote: | | This tutorial shows how you can create backups of LVM partitions with an LVM feature called LVM snapshots. An LVM snapshot is an exact copy of an LVM partition that has all the data from the LVM volume from the time the snapshot was created. The big advantage of LVM snapshots is that they can be used to greatly reduce the amount of time that your services/databases are down during backups because a snapshot is usually created in fractions of a second. After the snapshot has been created, you can back up the snapshot while your services and databases are in normal operation. |
Personally I beleive that gentoo wiki page about lvm is poor. It was written from someone who does not focus on someone who never dealt with it. You are better of with a ressource which starts by explaining the idea behind it and how it works and not just a plain summary of a huge pile of commands.
Reusing an existing installation is a pain in the ass without proper knowledge ...
and ever tried to backup your hole box?
lvm backup + binary distro which i install on demand fresh (reuse grub2 from that) + manual copy the boot entry for gentoo + kernel (thats it)
you can also reinstall grub2 to the new drive, copy /boot, + lvm backup (thats a matter of choice=)
It is more likely that you swap out drives that you do a fresh installation. I did several times swapped drives in this 6 year old box. 4x harddrive, 1x ssd. |
That's a lot to go through,
I'll give it a go and see what I think. Not completely sold on dual-booting with Mint. I'll try it both with and without Mint |
|
| Back to top |
|
|
Hu
Administrator
Joined: 06 Mar 2007
Posts: 21706
|
| Posted: Sun Aug 23, 2015 8:23 pm Post subject: |
|
|
| Swap is not required to use S3 sleep, since RAM remains powered and therefore does not need to be written to swap. However, depending on the amount of RAM in the system, you may want a swap device for general usage. That swap device can do double duty as the hibernation area, provided that you do not hibernate while swap is heavily used. |
|
| Back to top |
|
|
The Doctor
Moderator
Joined: 27 Jul 2010
Posts: 2678
|
| Posted: Sun Aug 23, 2015 8:51 pm Post subject: |
|
|
Do keep in mind that if you sleep or hyphenate you are undoing your encryption protection. The protection only works so long as they have to decrypt the drive to read it. If they steel it with the key they can see everything you are trying to protect.
_________________
First things first, but not necessarily in that order.
Apologies if I take a while to respond. I'm currently working on the dematerialization circuit for my blue box. |
|
| Back to top |
|
|
HMC
Tux's lil' helper
Joined: 06 Jul 2005
Posts: 79
Location: Australia
|
| Posted: Mon Aug 24, 2015 1:50 pm Post subject: |
|
|
The scheme I use on all of my systems is full disk encryption with LVM on a LUKS encrypted DISK and boot from a USB key. The disk does not have a partition table, no volumes are visible and everything is encrypted except the LUKS header.
The commands are probably the simplest and most self explanatory howto: Fix it as required. The following is for a key that is entered manually during the boot process to open the drive.
Erase the disk:
dd if=/dev/urandom of=/dev/sda bs=1M
Wait a few days or there are other ways to do it including encrypting the disk with a temporary key and writing from /dev/zero...
DO NOT use fdisk.
Setup encrypted disk
cryptsetup -c aes-xts-plain -h whirlpool -s 512 luksFormat /dev/sda use the encryption scheme of your choice - this was chosen randomly for this example. You'll be prompted to type in a key.
cryptsetup luksOpen /dev/sda luks Enter the key.
pvcreate /dev/mapper/luks
vgcreate lvm /dev/mapper/luks
vgscan --mknodes
vgchange -ay
lvcreate -L<disk size in GB>G -n root lvm
Simple volume scheme on a 320GB(?) drive:
lvcreate -L40G -n root lvm
lvcreate -L4G -n swap lvm
lvcreate -L254G -n home lvm
File systems and mount:
mkfs.ext4 /dev/lvm/root
mkfs.ext4 /dev/lvm/home
mkswap /dev/lvm/swap
swapon /dev/lvm/swap
mount /dev/lvm/root /mnt/gentoo
mkdir /mnt/gentoo/home
mkdir /mnt/gentoo/boot
mount /dev/lvm/home /mnt/gentoo/home
Now off you go with the handbook...
To remount after a reboot (in case there are problems)
cryptsetup luksOpen /dev/sda lvm
vgscan --mknodes
vgchange -ay
mount /dev/lvm/root /mnt/gentoo
mount /dev/lvm/home /mnt/gentoo/home
swapon /dev/lvm/swap
then follow the handbook to chroot....
Some packages:
sys-fs/cryptsetup
sys-fs/lvm2
genkernel
Add support for LVM and DM-Crypt.
Multiple devices driver support (RAID and LVM)
<*> Device mapper support
[ ] Device mapper debugging support
<*> Crypt target support
CONFIG_BLK_DEV_DM=y
# CONFIG_DM_DEBUG is not set
CONFIG_DM_CRYPT=y
Cryptographic API
<*> SHA1 digest algorithm
<*> SHA224 and SHA256 digest algorithm
<*> XTS support (EXPERIMENTAL)
<*> AES cipher algorithms
CONFIG_CRYPTO_SHA1=y
CONFIG_CRYPTO_SHA256=y
CONFIG_CRYPTO_XTS=y
CONFIG_CRYPTO_AES=y
CONFIG_CRYPTO_AES_X86_64=y
whirlpool
Prepare a USB key:
fdisk /dev/sdX
mkfs.ext2 /dev/sdXn
e2label /dev/sdXn GENTOO_BOOT
fstab something like this:
LABEL=GENTOO_BOOT /boot ext2 noauto,noatime 1 2
/dev/mapper/lvm-root / ext4 noatime 0 1
/dev/mapper/lvm-swap none swap sw 0 0
/dev/mapper/lvm-home /home ext4 noatime 0 1
This method is supported by Genkernel so there is no rooting around on updates.
/etc/default/grub will want some kernel parameters:
crypt_root=/dev/sda root=/dev/mapper/lvm-root dolvm rootfstype=ext4
and in the default section... real_resume=/dev/mapper/lvm-swap
genkernel.conf will want some options:
LVM="yes" <<-- Important
LUKS="yes" <<-- Important
INSTALL="yes"
DISKLABEL="yes"
BOOTLOADER="grub2"
More advanced subjects are LUKS header relocation and key files...
Cheers |
|
| Back to top |
|
|
Roman_Gruber
Advocate
Joined: 03 Oct 2006
Posts: 3846
Location: Austro Bavaria
|
| Posted: Mon Aug 24, 2015 5:59 pm Post subject: |
|
|
Most unflexible setup out there.
you are unable to move your data, because hole disk is luks
and booting from usb stick is kinda not convinient. those who are knowledgeable enough do not need your key anyway so why bother booting from a fragile usb port?
encryption is only that you can dump your harddisc with not worring that someone may access your data. In case your harddisc does not work anymore. could be defective pcb but the data is still there. on ssd / hdd the firmware unmark sectors and than you have your data in plain there because you did not used encryption inthe first place when writing your data.
encryption is for that case that a windows noob want to use your device without your knowledge.
anyone else can dump the header and start cracking anyway the pass..
in your luks header htere is everything you start reverse engineering and afaik there is it several times on your disk.
when you are paranoid about your /boot, you should hash it and compare it on every bootup, much better.
Have you ever thought which spyware are in those Bios. especially lenovo had several issues with that. anyone with knowledge can compromise your hdd / bios whatever of your hardware and you will never see it. the point of these usb keys, to have grub and the kernel on it, is as useless as anything. make a hash sum and compare it after bootup, when you do not trust your environment. |
|
| Back to top |
|
|
frostschutz
Advocate
Joined: 22 Feb 2005
Posts: 2977
Location: Germany
|
| Posted: Mon Aug 24, 2015 6:32 pm Post subject: |
|
|
| tw04l124 wrote: | | you are unable to move your data, because hole disk is luks |
One partitioning software or stray bootloader is all it takes and the LUKS header is in valhalla.
Even if you use a full disk for something, I'd always create a regular partition table first.
| tw04l124 wrote: | | and booting from usb stick is kinda not convinient |
I boot from USB stick myself (with encrypted keyfiles, so a simple keylogger is not good enough).
I don't find it inconvenient. It's the same boot process as from internal disk (GRUB menu appears, select something, off you go). But you can take it with you; and put several recovery ISO images on it, etc. and it can still function as a regular data stick on Windows PCs if you make the first partition a FAT32 (and install FreeDOS on it while you're at it so you also have something for updating firmwares.
| tw04l124 wrote: | | anyone else can dump the header and start cracking anyway the pass. |
That might take a while.
| tw04l124 wrote: | | afaik there is it several times on your disk. |
Nope, just once. A single bit flip in the header is a total failure. (well, not really, since you can brute-force for single-bit-flips, but you get the idea)
Lack of LUKS header copies is a security consideration, the more copies there are the easier to recover [for malignamous persons] and old header copies will accept old passphrases. The LUKS header is much larger than it needs to be simply to make such recovery efforts harder (so a single reallocated / undeletable sector on a HDD won't result in anything useful).
If you desire LUKS header copies, you have to take care of it yourself.
| tw04l124 wrote: | | when you are paranoid about your /boot, you should hash it and compare it on every bootup, much better. |
That's kind of security by obscurity. I can modify your boot & undo the modification before your hash check runs so - modified boot, correct hash, no problem.
But that's not usually what a regular user has to worry about. $5 keyloggers you can consider [USB-Stick and encrypted keyfile more or less handles those - they get the passphrase for a key they don't have] but apart from that...
Either you know really really REALLY well how all of these things work and you create protections that you could not break yourself; or you don't know how anything works and you're screwed when someone comes along who does.
Regular LUKS encryption with no shenanigans whatsoever works well as a simply anti theft device - at least, if you have a screen lock that works and no root shells left open (I tend to forget those, so I make my root-shell auto-timeout after a few minutes of inactivity - which works well, unless the root shell was running some other process). |
|
| Back to top |
|
|
HMC
Tux's lil' helper
Joined: 06 Jul 2005
Posts: 79
Location: Australia
|
| Posted: Tue Aug 25, 2015 1:47 am Post subject: |
|
|
| tw04l124 wrote: | Most unflexible setup out there.
you are unable to move your data, because hole disk is luks
and booting from usb stick is kinda not convinient. those who are knowledgeable enough do not need your key anyway so why bother booting from a fragile usb port?
encryption is only that you can dump your harddisc with not worring that someone may access your data. In case your harddisc does not work anymore. could be defective pcb but the data is still there. on ssd / hdd the firmware unmark sectors and than you have your data in plain there because you did not used encryption inthe first place when writing your data.
encryption is for that case that a windows noob want to use your device without your knowledge.
anyone else can dump the header and start cracking anyway the pass..
in your luks header htere is everything you start reverse engineering and afaik there is it several times on your disk.
when you are paranoid about your /boot, you should hash it and compare it on every bootup, much better.
Have you ever thought which spyware are in those Bios. especially lenovo had several issues with that. anyone with knowledge can compromise your hdd / bios whatever of your hardware and you will never see it. the point of these usb keys, to have grub and the kernel on it, is as useless as anything. make a hash sum and compare it after bootup, when you do not trust your environment. |
Seriously? |
|
| Back to top |
|
|
HMC
Tux's lil' helper
Joined: 06 Jul 2005
Posts: 79
Location: Australia
|
| Posted: Tue Aug 25, 2015 2:36 am Post subject: |
|
|
| frostschutz wrote: |
But that's not usually what a regular user has to worry about. $5 keyloggers you can consider [USB-Stick and encrypted keyfile more or less handles those - they get the passphrase for a key they don't have] but apart from that...
Either you know really really REALLY well how all of these things work and you create protections that you could not break yourself; or you don't know how anything works and you're screwed when someone comes along who does.
Regular LUKS encryption with no shenanigans whatsoever works well as a simply anti theft device - at least, if you have a screen lock that works and no root shells left open (I tend to forget those, so I make my root-shell auto-timeout after a few minutes of inactivity - which works well, unless the root shell was running some other process). |
That was the intent of my post. A basic bootable setup to work with and build upon that covers encryption in an uncomplicated way with as few holes as possible. It may want a hand typed passphrase for redundancy and things like gpg encrypted keys, hash checks and other security measures come later.
One thing though. I accidentally (la la moment) hosed a system exactly once by running fdisk on a drive, but everything was backed up (a good practice before major operations regardless of setup) and it was running again within a couple of hours with zero data loss. Otherwise there has been no disadvantage to using a disk without a partition table. |
|
| Back to top |
|
|
Ryonez
n00b
Joined: 22 Aug 2015
Posts: 22
Location: New Zealand
|
| Posted: Tue Aug 25, 2015 12:41 pm Post subject: |
|
|
This is a lot of information and ideas on how to do this.
Thank you, it's gonna take me a while, but after I try different things I'll post back here to let you know what I chose to do and why.
Current things to try:
1->
2->
Because it's to go on the laptop, I'm learning towards 2. This laptop doesn't support usb boot(at least I'm pretty sure it doesn't).
And when the LUKS volume is unlocked, the LVM features should all be available.
If this discussion has shown anything, it's that linux can bloody well do anything. Damn all those windows only games... |
|
| Back to top |
|
|
Roman_Gruber
Advocate
Joined: 03 Oct 2006
Posts: 3846
Location: Austro Bavaria
|
| Posted: Tue Aug 25, 2015 12:48 pm Post subject: |
|
|
Well wine may be your friend for some windows games.
I do not get hte point in hidng a partition. Why should anyone has a partition in a device without beeing used?
I never used HDD => LUKS => LVM So I can not say if the advanced features of lvm are such easy to use like in my setup HDD => LVM => LUKS => DATA.
I value Frostschutz opinion because he knew a lot about these things before I even used LUKS.
It just depends on the usability and paranoia. But I really doubt that these days you will get any decent hardware which you can trust. More annoyingly those lenovo notebooks have some open bios open source thing which may work, but lenovo is known for its spyware in bios. Others like Dell, Samsung are suspect to that.
Anyway up to you waht you choose.
I realized that it*s only feasable to encrypt the box as much that the ordinary windows noob, scriptkiddy won*t be able to access it. The government and others will point a gun at your head and ask for the usb key or the passphrase, so what ... |
|
| Back to top |
|
|
Ryonez
n00b
Joined: 22 Aug 2015
Posts: 22
Location: New Zealand
|
| Posted: Tue Aug 25, 2015 1:45 pm Post subject: |
|
|
| tw04l124 wrote: | | I do not get hte point in hidng a partition. Why should anyone has a partition in a device without beeing used? |
Sorry, I don't get that. What wouldn't be used? I fancy no. 2 because I have no clue what data LVM leaves lying around. In the software I use in windows, the partition is maintained inside the container, and doesn't loose features. The only impacted I noticed(very rarely if at all) was a drive speed slowdown while encryption/decryption was going on.
What I'm after here is security, not plausible deniability, which is the only case I can think of that would have a barely used partition. In that case it should be impossible to even know that there is a hidden partition(IF you do it right). |
|
| Back to top |
|
|
szatox
Advocate
Joined: 27 Aug 2013
Posts: 3150
|
| Posted: Tue Aug 25, 2015 7:17 pm Post subject: |
|
|
I'd go with lvm inside luks simply for convenience it offers. It's basicaly "launch and forget about LUKS".
The oposite is kinda "you know when you need it", like when you want to have a part of filesystem protected. |
|
| Back to top |
|
|
Ryonez
n00b
Joined: 22 Aug 2015
Posts: 22
Location: New Zealand
|
| Posted: Thu Sep 10, 2015 8:29 am Post subject: |
|
|
Right, I'm sorting out the Virtual Machine now. Could someone help with a guide for this set-up please?
I've got around 6 tabs open all with different information up, lot of it was written ages ago and my headache is getting worse...
I'd really appreciate it! |
|
| Back to top |
|
|
khayyam
Watchman
Joined: 07 Jun 2012
Posts: 6227
Location: Room 101
|
| Posted: Thu Sep 10, 2015 1:36 pm Post subject: |
|
|
| The Doctor wrote: | | Do keep in mind that if you sleep or hyphenate you are undoing your encryption protection. The protection only works so long as they have to decrypt the drive to read it. If they steel it with the key they can see everything you are trying to protect. |
Doc ... hehe "hyphenate", anyhow, actually no. If you're hibernating (suspend-to-disk) the image is (normally) written to the LVM swap, it can't be read, or booted, without your having opened the LUKS volume on restarting the machine (ie, via the initramfs). While the machine is in hibernation the disk is in the same state it would be if the machine were shutdown, so there is no inherent problem there. Obviously, with suspend-to-ram the image isn't similarly protected, it could theoretically be read, and if the machine returns to the state that it was before suspending that is, as you say, "undoing your encryption", but this isn't the case with hibernation/suspend-to-disk when using LVM within a LUKS volume.
best ... khay |
|
| Back to top |
|
|
|
Installing Gentoo
