+encryption +LVM [solved]

Beelzebub_ · Posted: Sun Mar 10, 2013 4:05 pm Post subject: +encryption +LVM [solved]

Hi,

i have installed gentoo a long time ago, without any encryption and without a LVM.
I dont want to install gentoo and all my stuff once again. Therefore i am looking for a way to change my installation in some steps. The problem is i have no experience in that topic.

I have one SSD and one HDD.
At the SSD is my /boot / and some free space about the half. - 50GB
At the HDD is my /more partition which i use for my stuff (videos, dokuments..) - 400GB

I think i should start to make a new partition with a encrypted LVM at my sdb (HDD) and copy my stuff over to a /more partition at the LVM, but how can i prozess that i get a complete encrypted system?

Do you have any ideas?
_________________
Ich habe keine Angst vorm Sterben, ich habe nur Angst ich habe nicht genug gelebt.

jpc22 · Apprentice Joined: 29 Jan 2012 Posts: 195

To get a fully encrypted system like you asked, if you really require and want the best security, means you will need an external drive to backup your data.

There are many ways to set up a such system, depending on your needs / level of paranoia.

Tell us what you want to acheive with crypto and we will know beter what to reccomend you.

Like if it's a laptop and you want to protect data if it is stolen, or you want the device to be protected against high profile attacks including physical acess to your machine, like keyloggers / van eck phreacking , cold boot attacks , tampering with your bootloader and ultimately a tree letter agency breaking in when the computer is running pushing you away from it and dumping it in a liquid nitrogen vat and taking it to a lab.

You surely dont need protection against the latest(s), but it is always good to know what hackers have pulled off in the past.

The best encryption will only protect your data when the machine is turned off and the ram content has been cleared by waiting long enough or was wiped during the shutdown.
Encryption itself does not have a huge performance impact on modern hardware, especially with the AES cipher, compared to security measures you can implement to protect your machine when its running, like selinux+pax+grsecurity+hardened kernel+ firewall/iptables.

You should forget about hibernation on an encrypted system , for it has many security issues.

There is a kernel patch (TRESOR) that keeps the encryption key in cpu registers instead of ram for protection against cold reboot attacks http://www1.informatik.uni-erlangen.de/tresor .

Ultimately you should remember that the user will always be the weakest part of any system as they can be forced by law or tortured to reveal encryption keys/passwords.

That being said, the boot partition cannot be encrypted and will remain vulnerable unless you put it on a usb key that you always carry with you.this is the best protection against tampering with your bootloader. If you happen to loose the usb key you can always make another one with a livecd by chrooting in your system after you decrypt and mount your partitions.
If you dont need that much security just leave a normal boot partition on one of your disks.

If the root partition is encrypted, you will need an initramfs and bootloader that supports it and the proper config. Personally i use mkinitcpio to make my initramfs and grub2 as my bootloader.
Your initramfs also needs lvm support if you go that way.

You may opt to fully encrypt the disk(s) and have lvm over the encryption, or split the disk with lvm and encrypt only the partitions with your personal data.
Since you intend to move data around your disks a few encrypted partitions with lvm on them might be better unless you have a spare disk to make backups, which would be a good idea with 400gb of data you mentionned. Each encrypted partition will require you to enter a password at boot if the are required by the system, like the root partition so a single encrypted partition with lvm over it to keep some flexibility might be better.

Encrypting only your personal stuff should be enough if your machine is stolen as long as your encryption has not been compromised.
Full encryption with separate boot makes it harder to compromise your system, but may not be necessary.

For encryption to be effective, you need to write random data on the hard drive, which is always best done on a brand new disk.
SSD's also have some security and performance issues with encryption:
They keep a mapping of used sectors which can be used to determine where there is data, and help in some cryptographic attacks.
Their use of wear leveling(mapping bad sectors) wich could leave unencrypted data behind since your disk is not new, and means you cannot be certain to have completely deleted something.
TRIM tells the disk about deleted data and keeps a mapping of free sectors, but this data is no deleted until something takes its place, which can leave data behind and also be used in attacks.
If you disable trim or other some features to increase security , your ssd performance will decrease faster with time.

If you have a processor(some intel core and i-series) that carries AES-NI instruction, i would recommend you use aes as you cipher and put it in your use flags, as it will give you a performance boost on decryption speed. #cryptsetup --cipher aes-xts-plain64 --key-size 512 --hash sha512 --iter-time 5000 --use-random --verify-passphrase luksFormat <device/logical partiton>

Dm-crypt with luks is interesting ,since it allows for up to 8 passwords/keyfiles to decrypt the disk. keyfiles are kept on your usb key and can be password protected.
The encryption will only be as good as the password protecting it so a long truly random password and correct PBKDF2 iteration parameter will make it unlikely someone can bruteforce your password in a lifetime, the ciphers will have to be changed as they get less secure in a few years tough.

Remember that encryption can and go wrong sometimes , and that you should really backup your data and encryption headers.

Feel free to ask if i missed something, or you need help with something.

Beelzebub_ · Posted: Sun Mar 10, 2013 7:18 pm Post subject:

Thanks for your detailed reply.

Now, i know i have to do a lot to get a full secure system....

I have a desktop pc [AMD Bulldozer FX6100,12GB RAM] and at the moment i am not using TRIM because my system is kinda like construction area..
i have switched my window manager (to awesome and i am still figuring out how it works) and i also have to upgrade to systemd.

To come back to your question what i want to archive, i really want to get a super save system whitch should resist against high profile attacks and cold reboot attacks.

That being said, its maybe better when i install gentoo again at my free space including all these aspekts (selinux+pax+grsecurity+hardened kernel+ firewall/iptables).
But whats the reason for the boot partition at the usb-stick i mean it doesnt contain important informations or does it? I really like the idea.

Thanks again for all these detailed informations.

Beelzebub
_________________
Ich habe keine Angst vorm Sterben, ich habe nur Angst ich habe nicht genug gelebt.

jpc22 · Apprentice Joined: 29 Jan 2012 Posts: 195

The boot on usb key is like the key to your car, you cant start the computer whitout it.if the key is big enough and fast enough you could have an entire encrypted squashed live system with aufs.
you could use that live system to checksum your boot partition to be sure no one has messed with it and added keyloggers or implemented other nasty things at the kernel level.

With 12gb ram and a such processor you could ramdisk a wholesystem, something i tought of since i got my laptop with 16gb ram.

My computers too are like a construction site at the moment, building a 3 nodes cluster with multiscreen and maybe multiseat.

Beelzebub_ · Posted: Sun Mar 17, 2013 7:28 pm Post subject:

Hi,

i have now created my lvm, but i am not sure which encryption i should use for the partitions.
_________________
Ich habe keine Angst vorm Sterben, ich habe nur Angst ich habe nicht genug gelebt.

SlashBeast · Retired Dev Joined: 23 May 2006 Posts: 2922

Depends on how big the partition is I would go with aes-xts-plain64 with sha512.

Beelzebub_ · Posted: Mon Mar 18, 2013 11:36 am Post subject:

Something went wrong:

SlashBeast · Retired Dev Joined: 23 May 2006 Posts: 2922

Try reduce the command a bit and see if that does work, to at least narrow the issue:

Beelzebub_ · Posted: Mon Mar 18, 2013 12:53 pm Post subject:

I tried to reduce the command by myself with

khayyam · Posted: Mon Mar 18, 2013 2:53 pm Post subject:

Beelzebub_ ...

The most obvious reason would be missing one or other of the following:

CONFIG_CRYPTO_XTS
CONFIG_CRYPTO_SHA512

This is what the error points to ... though if that is too *obvious* then please ignore.

best ... khay

SlashBeast · Retired Dev Joined: 23 May 2006 Posts: 2922

You sure you have aes, xts and sha512 support in kernel that you are running? is that a livecd maybe?

edit: ninje'd by khayyam.

Beelzebub_ · Posted: Mon Mar 18, 2013 3:26 pm Post subject:

Solved.. before reading your comments.

You are right is was a missing kernel option. (Crypt target support)

..thought i already had checked it.

That side helped me. (http://wiki.gentoo.org/wiki/DM-Crypt) - But thank you, too.
_________________
Ich habe keine Angst vorm Sterben, ich habe nur Angst ich habe nicht genug gelebt.

Beelzebub_ · Posted: Mon Mar 18, 2013 3:58 pm Post subject:

At the moment i have created something

khayyam · Posted: Mon Mar 18, 2013 4:11 pm Post subject:

Beelzebub_ ...

After the 'lvcreate' you would need to 'vgscan && vgchange -ay' ... which looks to be missing in the above.

HTH & best ... khay

Beelzebub_ · Posted: Mon Mar 18, 2013 4:14 pm Post subject:

Solved.

Filesystem was not working, now it is.
_________________
Ich habe keine Angst vorm Sterben, ich habe nur Angst ich habe nicht genug gelebt.

Beelzebub_ · Posted: Mon Mar 18, 2013 4:25 pm Post subject:

Would it make sense to copy my old installaton over to the new locations?
Or should i install gentoo completly new?
_________________
Ich habe keine Angst vorm Sterben, ich habe nur Angst ich habe nicht genug gelebt.

SlashBeast · Retired Dev Joined: 23 May 2006 Posts: 2922

If you have no real reason to start with new install, just backup your current one. I sugest you do it from livecd so no /proc, /dev or /sys are mounted and dev some static nodes, tarball it with numeric-ids and extract it with -p.

Beelzebub_ · Posted: Tue Mar 19, 2013 2:40 pm Post subject:

SlashBeast · Retired Dev Joined: 23 May 2006 Posts: 2922

Define not working.

Beelzebub_ · Posted: Tue Mar 19, 2013 3:44 pm Post subject:

The boot process abort with the new kernel before i could enter a password for the encrypted partitions.
_________________
Ich habe keine Angst vorm Sterben, ich habe nur Angst ich habe nicht genug gelebt.

SlashBeast · Retired Dev Joined: 23 May 2006 Posts: 2922

Provide at least blurry photo of the error. Maybe your inittramfs's /init is not +x or something, or fetch better-initramfs binary image and test if that work to at least tell if the initramfs is to blame, with better-initramfs you need to add to kernel params:

Beelzebub_ · Posted: Tue Mar 19, 2013 5:55 pm Post subject:

Some part of the error tells me:

SlashBeast · Retired Dev Joined: 23 May 2006 Posts: 2922

So you got to the initramfs's part, check my initramfs and see if you have the same issue.

Beelzebub_ · Posted: Tue Mar 19, 2013 7:50 pm Post subject:

So i am trying to install your better-initramfs i got that error:

khayyam · Posted: Tue Mar 19, 2013 8:17 pm Post subject:

Beelzebub_ ...

Did you run 'bootstrap/bootstrap-all' prior to the above? ... anyhow, I guess you downloaded the zip, which should work none the less ... but here is the recommended method.