LUKS - Revision history

PhilippeTeuwen: /* To encrypt the swap */

2017-01-04T14:22:37Z

To encrypt the swap

← Older revision		Revision as of 14:22, 4 January 2017
Line 5:		Line 5:
	== To encrypt the swap==		== To encrypt the swap==
	apt-get install cryptsetup		apt-get install cryptsetup
	Follow instructions of /usr/share/doc/cryptsetup/~~CryptoSwap~~.~~HowTo~~		Follow instructions of /usr/share/doc/cryptsetup/README.Debian.gz
	<br>The diff is that I had to destroy the content of the swap partition before /etc/init.d/cryptdisks otherwise cryptsetup refuses to work.		<br>The diff is that I had to destroy the content of the swap partition before /etc/init.d/cryptdisks otherwise cryptsetup refuses to work.

	== To encrypt disks ==		== To encrypt disks ==
	Creation		Creation

2010-11-24T20:31:58Z

Reverted edits by Etegohy (Talk) to last revision by PhilippeTeuwen

Can't load revision 6781

2010-11-24T00:25:52Z

Can't load revision 6619

2008-09-29T13:58:47Z

To encrypt disks

← Older revision		Revision as of 13:58, 29 September 2008
Line 13:		Line 13:
	mkfs.ext3 /dev/mapper/hdaX		mkfs.ext3 /dev/mapper/hdaX
	cryptsetup luksClose hdaX		cryptsetup luksClose hdaX
			Adding more passphrases (8 slots are available, keyfiles can also be used)
			cryptsetup luksAdd /dev/hdaX
	Usage		Usage
	cryptsetup luksOpen /dev/hdaX hdaX && mount -t ext3 /dev/mapper/hdaX /mnt/		cryptsetup luksOpen /dev/hdaX hdaX && mount -t ext3 /dev/mapper/hdaX /mnt/

2008-09-29T13:49:25Z

To encrypt the swap

← Older revision		Revision as of 13:49, 29 September 2008
Line 7:		Line 7:
	Follow instructions of /usr/share/doc/cryptsetup/CryptoSwap.HowTo		Follow instructions of /usr/share/doc/cryptsetup/CryptoSwap.HowTo
	<br>The diff is that I had to destroy the content of the swap partition before /etc/init.d/cryptdisks otherwise cryptsetup refuses to work.		<br>The diff is that I had to destroy the content of the swap partition before /etc/init.d/cryptdisks otherwise cryptsetup refuses to work.
	=== To encrypt disks ===		== To encrypt disks ==
	Creation		Creation
	cryptsetup luksFormat /dev/hdaX		cryptsetup luksFormat /dev/hdaX
Line 16:		Line 16:
	cryptsetup luksOpen /dev/hdaX hdaX && mount -t ext3 /dev/mapper/hdaX /mnt/		cryptsetup luksOpen /dev/hdaX hdaX && mount -t ext3 /dev/mapper/hdaX /mnt/
	umount /mnt && cryptsetup luksClose hdaX		umount /mnt && cryptsetup luksClose hdaX

	==To encrypt the root fs==		==To encrypt the root fs==
	===Get packages===		===Get packages===

2008-08-10T13:16:37Z

Avoiding to type many times the LUKS password

2008-06-28T11:52:01Z

Enabling autologin

← Older revision		Revision as of 11:52, 28 June 2008
Line 193:		Line 193:
	fi		fi
	</source>		</source>
	This method was ~~inspired~~ by Linux Mag France no 107. I added the AUTOX=false otherwise calls to "xterm -ls" in the graphical session would fail.		This method was taken from an article in Linux Mag France no 107. I added the AUTOX=false otherwise calls to "xterm -ls" in the graphical session would fail.

2008-06-28T11:41:33Z

Enabling autologin

← Older revision		Revision as of 11:41, 28 June 2008
Line 180:		Line 180:
	9:2345:respawn:/sbin/getty -L -n -l /usr/local/sbin/autologin 38400 tty9		9:2345:respawn:/sbin/getty -L -n -l /usr/local/sbin/autologin 38400 tty9
	This will launch another getty on tty9 without login prompt but a call to a handmade script /usr/local/sbin/autologin:		This will launch another getty on tty9 without login prompt but a call to a handmade script /usr/local/sbin/autologin:
			<source lang=bash>
	#!/bin/sh		#!/bin/sh
	/bin/login -f phil AUTOX=true		/bin/login -f phil AUTOX=true
			</source>
	And so if you want startx to be called automatically you can add to your ~/.bash_profile:		And so if you want startx to be called automatically you can add to your ~/.bash_profile:
			<source lang=bash>
	if [[ $AUTOX = true ]]		if [[ $AUTOX = true ]]
	then		then
	AUTOX=false
	~~startx~~		AUTOX=false
	~~logout~~		startx
			logout
	fi		fi
			</source>
	This method was inspired by Linux Mag France no 107. I added the AUTOX=false otherwise calls to "xterm -ls" in the graphical session would fail.		This method was inspired by Linux Mag France no 107. I added the AUTOX=false otherwise calls to "xterm -ls" in the graphical session would fail.

2008-06-28T11:40:33Z

Avoiding to type many times the LUKS password

← Older revision		Revision as of 11:40, 28 June 2008
Line 173:		Line 173:
	egrep -v "^[[:space:]]*(#\|$)" "$TABFILE" \| while read dst src key opts; do		egrep -v "^[[:space:]]*(#\|$)" "$TABFILE" \| while read dst src key opts; do
	</source>		</source>
			We can go one step further by
			===Enabling autologin===
			Indeed we already did the hardest security step: providing the LUKS password, so why should I prove I know my user password as well, sth so easy to circumvent with a LiveCD...
			<br>To enable autologin, you can use GDM or KDM facilities or (as I'm used of launching startx manually) you can choose a lighter way:
			<br>Add to /etc/inittab:
			9:2345:respawn:/sbin/getty -L -n -l /usr/local/sbin/autologin 38400 tty9
			This will launch another getty on tty9 without login prompt but a call to a handmade script /usr/local/sbin/autologin:
			#!/bin/sh
			/bin/login -f phil AUTOX=true
			And so if you want startx to be called automatically you can add to your ~/.bash_profile:
			if [[ $AUTOX = true ]]
			then
			AUTOX=false
			startx
			logout
			fi
			This method was inspired by Linux Mag France no 107. I added the AUTOX=false otherwise calls to "xterm -ls" in the graphical session would fail.

2008-06-18T23:13:00Z

TODO

@@ Line 68: / Line 68: @@
  dpkg-reconfigure linux-image-2.6.25-2-686
 Reboot
 One major drawback on my setup (you don't see it here) is that I've several partitions encrypted as such and it leads to some problems:
 * At boot time I've to enter the passphrase for each of the partitions
@@ Line 77: / Line 77: @@
 ** quintuple-agent could be used for example, but it has to be integrated into the initrd
 ** maybe a simple environment variable would be enough