| View previous topic :: View next topic |
| Author |
Message |
Sujao
l33t
Joined: 25 Sep 2004
Posts: 677
Location: Germany
|
 Posted: Sat May 07, 2005 1:16 am Post subject: how safe is encryption with loop in regard to fs-errors? |
 |
|
Hi all,
I am going to encrypt all my hdds (or at least try  ). I looked over some HOWTOs and almost all use encrypted loop devices. After thinking about it I wondered how safe this is considering that all your system is ONLY ONE file. Isnt this dangerous in the regard that if there is a single error in the file system layer your whole system is broken? I am not sure if I am thinking correctly.
In short: If you look at a encrypted filesystem...do you see only ONE signle file? Isnt this error-prone?
In case that is so: What are the alternatives? |
|
| Back to top |
|
 |
echto
Tux's lil' helper
Joined: 30 Jun 2002
Posts: 108
|
| Posted: Sat May 07, 2005 2:34 am Post subject: |
|
|
When you refer to one file your referring to systems that use one partition. You'll encrypt each partition and mount each partition just like one would mount a non-encrypted partition. When booting an encrypted system you may still check the file systems during the boot process for errors just like a non-encrypted system. 'Encrypted' doesn't necessarily create a sence of 'volatility'.  |
|
| Back to top |
|
|
Sujao
l33t
Joined: 25 Sep 2004
Posts: 677
Location: Germany
|
| Posted: Sat May 07, 2005 2:28 pm Post subject: |
|
|
| But isnt the partition image saved as one single file in the filesystem. Lets say my root partition is 130GB. Wouldnt XFS just see a huge 130GB file? |
|
| Back to top |
|
|
neuron
Advocate
Joined: 28 May 2002
Posts: 2371
|
| Posted: Sat May 07, 2005 2:56 pm Post subject: |
|
|
| Sujao wrote: | | But isnt the partition image saved as one single file in the filesystem. Lets say my root partition is 130GB. Wouldnt XFS just see a huge 130GB file? |
correct
you can use encfs + fuse to avoid this, that'll also allow you to use solutions like rsync for backup.
But read up on the different encfs options first, to make sure you use the options you need (such as encfs'es --public option). Also loopback encryption is more tested than encfs and fuse is, and that's something to keep in mind. |
|
| Back to top |
|
|
Sujao
l33t
Joined: 25 Sep 2004
Posts: 677
Location: Germany
|
| Posted: Sat May 07, 2005 3:11 pm Post subject: |
|
|
| What about encryption with a device mapper as descriped here? Is it one single file here too? I still wasnt able to understand if the file-system (in my case XFS) stayes unencrypted and saves the files in the usual manner just that they are all encrypted but you can still see the files or if there is a abstract encrypted data image that is written to the hdd containing the whole fs and its data. Where is the border, where does encryption start? |
|
| Back to top |
|
|
neuron
Advocate
Joined: 28 May 2002
Posts: 2371
|
| Posted: Sat May 07, 2005 4:01 pm Post subject: |
|
|
| Sujao wrote: | | What about encryption with a device mapper as descriped here? Is it one single file here too? I still wasnt able to understand if the file-system (in my case XFS) stayes unencrypted and saves the files in the usual manner just that they are all encrypted but you can still see the files or if there is a abstract encrypted data image that is written to the hdd containing the whole fs and its data. Where is the border, where does encryption start? |
device mapper directly to a device (not device mapper on top of a loopback file) would be somewhat safer, as your eliminating a few layers that could potentionally cause problems. Still if there are errors on encrypted filesystems they are harder to decrypt (of course).
with loopback you'd have:
device (/dev/hda1) - filesystem - one big file mounted on loopback - encryption layer - filesystem
device mapper directly you'd have:
device (/dev/hda1) - encryption layer - filesystem
so that is less error prone.
Also loopback uses it's own caching besides what the filesystem does, which can cause aditional problems when there are power cuts and such. |
|
| Back to top |
|
|
Sujao
l33t
Joined: 25 Sep 2004
Posts: 677
Location: Germany
|
| Posted: Sat May 07, 2005 4:09 pm Post subject: |
|
|
| Thx for the explanation. Do you use some kind of encrypted fs, too? |
|
| Back to top |
|
|
neuron
Advocate
Joined: 28 May 2002
Posts: 2371
|
| Posted: Sat May 07, 2005 5:11 pm Post subject: |
|
|
| Sujao wrote: | | Thx for the explanation. Do you use some kind of encrypted fs, too? |
on my server I use device mapper encryption on top of lvm2 and on my main computer I encrypt my home directory using encfs and a module I wrote myself to auto mount on login (http://hollowtube.mine.nu/wiki/index.php/PAM/PamEncfs). |
|
| Back to top |
|
|
|
Networking & Security
