| View previous topic :: View next topic |
| Author |
Message |
gnuke
n00b
Joined: 03 Sep 2006
Posts: 11
|
 Posted: Mon Apr 14, 2008 8:21 pm Post subject: [HOWTO] Easy ISO Image Encryption With LUKS |
 |
|
HOWTO: Easy ISO Image Encryption With LUKS And Burning To Optical Media
1. Introduction
If you are looking for articles dealing with optical media encryption, you will rarely find useful ones, but one of them definitely is "HOWTO Burn Encrypted Optical Media With Luks" from Gentoo-Wiki. Nevertheless I found some points which could be bettered:
- The shell script at the end is inflexible: If you use exotical options for generating the ISO image, you have to do this via changing the script; it does also not follow the UNIX philosophy
- Currently there is no possibility for users of K3b, GnomeBaker or other GUI-Burners to use LUKS - these people have to stick to the shell.
The main purpose of this HOWTO is to present two bash scripts which solve the problems mentioned above.
2. Preparations
This sections is nearly identical to the one in the Gentoo-Wiki. If you want to do encryption as user, you additionally need to configure sudo which is described in a section below.
2.1 Kernel Configuration
You need device mapper and crypt target support in your kernel:
| Code: | | cd /usr/src/linux && make menuconfig |
| Code: | Device Drivers --->
Multi-device support (RAID and LVM) --->
<*> Device mapper support
<*> Crypt target support |
Also choose the cryptographic algorithms you are going to use, for example the modules beneath for the popular cipher "aes-cbc-essiv:sha256":
| Code: | Cryptographic options --->
<*> SHA256 digest algorithm
<*> AES cipher algorithms |
Note that it does not matter here whether you compile options as modules (do not forget to modprobe them) or as built-ins (do not forget to boot the newly built kernel).
2.2 Install And Configure Supplemantary Programs
Second step is to emerge cryptsetup (do not emerge cryptsetup-luks as said in the wiki, this package is deprecated):
| Code: | | emerge -va sys-fs/cryptsetup |
If you want to encrypt as user, you need to emerge sudo (if not have not done this already)
| Code: | | emerge -va app-admin/sudo |
2.3 Install The Isocrypt-Scripts
Download isocrypt here, unpack in a special directory and type:
Now you have got some new programs:
- mkisofs/genisoimage which both points to genisoimage.isocrypt and
- isocrypt
isocrypt does all the encryption related work, genisoimage.isocrypt is a simple wrapper script that makes it possible to use all the stuff in GUI programs (K3b, ...)
If you intend to use encryption as a user, you have to add these lines to your sudoers-file (type "visudo" to edit it):
| Code: | User_Alias ISOCRYPT_USERS = gnuke
Cmnd_Alias ISOCRYPT_CMD = /path/to/your/isocrypt
ISOCRYPT_USERS ALL= NOPASSWD: ISOCRYPT_CMD |
Make sure that the "Cmnd_Alias"-line points points to the isocrypt file you have extracted above.
2.4 OPTIONAL: Encrypt Swap
WARNING: Skip this section if you rely on hibernation - swap-encryption will break it !
It is possible that keys, passwords or other crucial data will be swapped (so that this data is clearly visible) - therefore it is better to encrypt your swap-partition before doing the actual encryption:
| Code: | cryptsetup -c aes -h sha256 -d /dev/urandom create crypt-swap /dev/your-hdd
mkswap /dev/mapper/crypt-swap
swapon /dev/mapper/crypt-swap |
This will hold swap encrypted until you do a restart of your computer; permanent swap-encryption is done if you add the following lines to your /etc/conf.d/dmcrypt:
| Code: | swap=crypt-swap
options='-s 384 -d /dev/urandom -c aes-cbc-essiv:sha256 -h sha256'
source='/dev/your-hdd' |
The above options will encrypt with "aes-cbc-essiv:sha256" and a randomly generated key from /dev/urandom.
3. Encryption Of ISO Images
WARNING: Never burn encrypted images to CDs in TAO mode - this will break / slow down them due to the readahead bug (you may read a detailed description of the problem here: Burning encrypted ISO image to CD / readahead bug)
3.1 Encryption With Shell
Now that you have installed all the things, encryption under your favorite shell is fairly easy (I am using the cdrkit-utilities, but this works with cdrecord/mkisofs as well):
| Code: | genisoimage -alotofoptions -o unencrypted.iso imagethis/
isocrypt --key-file "/savedir/mykey.file" -i unencrypted.iso -o encrypted.iso
wodim dev=/dev/burner encrypted.iso |
or shorter with using pipes:
| Code: | genisoimage -alotofoptions imagethis/ | isocrypt --key-file "/savedir/mykey.file" -o encrypted.iso
wodim dev=/dev/burner encrypted.iso |
or even shorter with using more pipes:
| Code: | | genisoimage -alotofoptions imagethis/ | isocrypt --key-file "/savedir/mykey.file" | wodim dev=/dev/burner |
3.2 Encryption With K3b
NOTE: This should similarly work with other GUI programs, but I have tested this with no programs except K3b 1.0.4
- Go to "Settings -> Configure K3b... -> Programs -> Search Path" and add the path where you have installed the isocrypt files
- Go to "User Parameters" and add an additional parameter for the mkisofs program:
| Code: | | --key-file /path/to/your/key.file |
Go to "Programs" and make sure that the custom genisoimage/mkisofs program is selected. If you do not see it, first click on the "Search"-button below
4. Use More Isocrypt Options And Verify Your Media
- For a full list of options isocrypt supports type:
If you are changing things in the script it is very useful to add the "--verify" option, which compares the encrypted and unencrypted image bitwise.
If you have successfully burned to disc, you can check it against the encrypted image with:
| Code: | | dd if=/dev/burner bs=2048 | cmp - encrypted.iso |
5. Finish
Try it and post what you think about it! |
|
| Back to top |
|
 |
Sadako
Advocate
Joined: 05 Aug 2004
Posts: 3792
Location: sleeping in the bathtub
|
| Posted: Mon Apr 14, 2008 8:44 pm Post subject: |
|
|
Nice howto, but there's one thing I'd take issue with;
The usage of the LUKS extensions seems kinda pointless, it would be very useful with rewritable media, but with readonly iso images it doesn't really offer anything...
_________________
"You have to invite me in" |
|
| Back to top |
|
|
msst
Apprentice
Joined: 07 Jun 2011
Posts: 259
|
|
| Back to top |
|
|
|
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
|
Documentation, Tips & Tricks
