Gentoo Forums
Gentoo Forums
Gentoo Forums
Quick Search: in
Question regarding encryption for laptops
View unanswered posts
View posts from last 24 hours

 
Reply to topic    Gentoo Forums Forum Index Installing Gentoo
View previous topic :: View next topic  
Author Message
Ryonez
n00b
n00b


Joined: 22 Aug 2015
Posts: 21
Location: New Zealand

PostPosted: Sun Aug 23, 2015 5:02 am    Post subject: Question regarding encryption for laptops Reply with quote

So, after having sorted out what init system to use, I'm left with only one other issue to sort before I install Gentoo onto my laptop.

Encryption.

I properly wouldn't bother with this on a desktop (ok maybe profile encryption there) however as a laptop isn't always going to be in a secure environment, I feel it's imported to use.

Heads up, I know a fair bit when it comes to encryption on windows having used bitlock, truecrypt and veracrypt. My knowledge on cmdline and linux use is rather pitiful.
I've only dealt with profile encryption on my ubuntu server, but dropped that after password issue over ssh forced me to chroot and replace root and user passwords.
Ubunutu hides a lot of the background from the user, so all I know is lvm is important somewhere.
One more things is I'm aware of at least two methods possible on linux. Profile encryption and system/drive encryption.

Could some please explain how encryption works with Gentoo?


Last edited by Ryonez on Sun Aug 23, 2015 3:40 pm; edited 1 time in total
Back to top
View user's profile Send private message
ian.au
Guru
Guru


Joined: 07 Apr 2011
Posts: 433
Location: Australia

PostPosted: Sun Aug 23, 2015 5:46 am    Post subject: Reply with quote

Did you read https://wiki.gentoo.org/wiki/Dm-crypt
and https://wiki.gentoo.org/wiki/DM-Crypt_LUKS
There should be enough info to get you going.
Back to top
View user's profile Send private message
The Doctor
Moderator
Moderator


Joined: 27 Jul 2010
Posts: 2574

PostPosted: Sun Aug 23, 2015 5:58 am    Post subject: Reply with quote

I'll add that in general on Gentoo encryption is only as hard or as fancy as you make it. I encrypted my laptop using luks with serpent and lvm. Basically, all it did was add a fairly simple step to partitioning the disks. Writing an init can be more of a challenge, but it still doesn't need to really do much so a ridiculously simple one will suffice. All it needs to do is ask for a password and switch to the real root.

If you want to get fancy, you can make it ask for a password or check for a specific thumb drive placed in a specific USB port containing a specific key file that doubles as an innocuous image in a family album. That can speed up the boot and protect your password, but remember, security and usability are inverses of each other and encryption does nothing if you leave the computer on.
_________________
First things first, but not necessarily in that order.

Apologies if I take a while to respond. I'm currently working on the dematerialization circuit for my blue box.
Back to top
View user's profile Send private message
Ryonez
n00b
n00b


Joined: 22 Aug 2015
Posts: 21
Location: New Zealand

PostPosted: Sun Aug 23, 2015 7:12 am    Post subject: Reply with quote

The Doctor wrote:
I'll add that in general on Gentoo encryption is only as hard or as fancy as you make it. I encrypted my laptop using luks with serpent and lvm. Basically, all it did was add a fairly simple step to partitioning the disks. Writing an init can be more of a challenge, but it still doesn't need to really do much so a ridiculously simple one will suffice. All it needs to do is ask for a password and switch to the real root.

If you want to get fancy, you can make it ask for a password or check for a specific thumb drive placed in a specific USB port containing a specific key file that doubles as an innocuous image in a family album. That can speed up the boot and protect your password, but remember, security and usability are inverses of each other and encryption does nothing if you leave the computer on.


Could I ask for a rough diagram on your partition layout?
I've been going through the guides, but they don't mention lvm. My knowledge on it is slim...
Back to top
View user's profile Send private message
Hu
Moderator
Moderator


Joined: 06 Mar 2007
Posts: 13830

PostPosted: Sun Aug 23, 2015 2:27 pm    Post subject: Reply with quote

The most convenient approach for encryption is to have:
  • sdX1 /boot
  • sdX2 LUKS
    • LVM
      • /
      • /home (if separate from / -- recommended, but not required)
      • /var (if separate from / -- recommended, but not required)

Feel free to reorder the volumes within the LVM node. The important part is that unlocking the LUKS partition exposes the LVM, so that there is one LUKS key for all the filesystems. The other choice is to go:
  • sdX1 /boot
  • sdX2 LVM
    • LUKS
      • /
    • LUKS
      • /home
    • LUKS
      • /var

This design puts each filesystem in its own LUKS container, meaning you need a separate password or key for each filesystem.

In either case, you will want a swap volume if you expect to use hibernation. If you use swap, you should put it inside a LUKS container too. You can follow either of the two models above for where to put swap. I put it outside the LVM, so that I do not need to worry about the resume kernel accessing the LVM at all. That would produce this arrangement:
  • sdX1 /boot
  • sdX2 LUKS
    • LVM
      • /
      • (others omitted)
  • sdX3 LUKS
    • swap
Again, reorder individual partitions as you like.
Back to top
View user's profile Send private message
Roman_Gruber
Advocate
Advocate


Joined: 03 Oct 2006
Posts: 3806
Location: Austro Bavaria

PostPosted: Sun Aug 23, 2015 2:34 pm    Post subject: Re: Question regarding encryption for laptops Reply with quote

Quote:
So, after sorting out what init system to use, I'm left with only one other issue to sort before I install Gentoo onto my laptop.


openrc, as you can easily switch later to sytemd, but not that easily form systemd to openrc afaik.

Code:
Encryption.

I properly wouldn't bother with this on a desktop (ok maybe profile encryption there) however as a laptop isn't always going to be in a secure environment, I feel it's imported to use.


512mb ext2 / boot partition

root => lvm container => luks container => ext4
do not use any fishy filesystem as btrfs / reiserfs
xfs is slow in my expierence
use something widely used and proven somehow mature and stable => ext4

initramfs => generated with genkernel

grub2 => install a linux mint with 10gb as secondary os, and reuse the grub2 from that (thats my way to handle things ) mint is only for emergency issues, never keep any personal data / anything else on it, just bare minimum, to have network access / file browsers / disc burners / forensic tools.

amd64 profile with both 32/64bit support.

Thats my proven setup for years. I do not want to explain details. Please check the docs regarding each thing like gentoo-wiki, and such ...
Back to top
View user's profile Send private message
Ryonez
n00b
n00b


Joined: 22 Aug 2015
Posts: 21
Location: New Zealand

PostPosted: Sun Aug 23, 2015 4:06 pm    Post subject: Reply with quote

To Hu, thank you for the diagrams. One question about swap, would that be needed for sleep mode as well?

To tw04l124 a couple of things.

1: As you already know from my other post regarding the init system, I've already chosen OpenRC. I don't need to be told what to use.
Granted my wording above did make it seems like a question. I've made it clearer and apologize if it caused confusion.

2: You're suggestion for a setup is a tad over the top. I'm not really interested in dual booting unless there is a very good reason too. And having an insecure OS installed would allow for a point to potentially attack from and chroot from.

3:
Quote:
I do not want to explain details. Please check the docs regarding each thing like gentoo-wiki, and such ...

That is useless to me. The whole point of me posting here for help is because I'm struggling to figure this out. Links to pages you think might help with the question would be usefull.
Even then, they don't necessarily explain in a way that is easy for me to get.


Note: I plan to try anything I do in a virtual machine before I install Gentoo on the laptop.
Back to top
View user's profile Send private message
Roman_Gruber
Advocate
Advocate


Joined: 03 Oct 2006
Posts: 3806
Location: Austro Bavaria

PostPosted: Sun Aug 23, 2015 4:17 pm    Post subject: Reply with quote

Quote:

1: As you already know from my other post regarding the init system, I've already chosen OpenRC. I don't need to be told what to use.
Granted my wording above did make it seems like a question. I've made it clearer and apologize if it caused confusion.


I am sorry, I try to answer as many posts as possible to improve my knowledge. I may just have forgotten that ..

Quote:

2: You're suggestion for a setup is a tad over the top. I'm not really interested in dual booting unless there is a very good reason too. And having an insecure OS installed would allow for a point to potentially attack from and chroot from.


Well 10gb do not hurt, do they ? and i see a lot of grub does not install bla bla... when you are setting up a box, I usually chroot from a working binary linux. that way i can utilize a terminal, watch cookie recipes on my favourite cookie recipe site and look up the handbook during install. You can later ditch the binary distro or keep it when something goes wrong. you can still boot up taht bnary distro and use it. warning do not update htat binary distro. linux minst for example overwrites grub config without a backup (happened recently, well what do you expcet from a binary noobie distro .... my bug regarding htis is still unanswered from ubuntu side)
Easy workaround is to use the binary distro partition for swap later for example.

Sysrescue cd is nice, but is not a full blown desctop much nicer where you can do whatever you like while you watch building your gentoo installation?



Quote:

3: ...


Well i gave you the summary of my research on this topic. and which works as of now.
I read about 2 months about lvm / luks and other stuff. I just wanted to present you a full solution. Feel free to do the same.
I have my reason why I suggested that lvm is on top of the hardrive and not luks for example (lvm features ...)

Well form the system point of view you just use a different file system. Well its not exactly true, but see it that way.

some packages need some additional build in stuff / flags / ... that it works.

and the hint about genkernel initramfs is very important. a lot will tell you write a custom init script, sigh.


Also note that you should align the lvm container according to your hdd specs, and choose useful values. That needs a bit reading else you get performance losses.[/code]
Back to top
View user's profile Send private message
Ryonez
n00b
n00b


Joined: 22 Aug 2015
Posts: 21
Location: New Zealand

PostPosted: Sun Aug 23, 2015 4:57 pm    Post subject: Reply with quote

Thanks tw04l124,

Your explanation for why you do a dual boot was informative. cheers.
I think I'll stick with just having Gentoo on it. The laptop wouldn't handle me playing media on it while Gentoo is building(Got another 2 computers to play stuff on anyways) and maintaining Mint manually down the road would be an extra hassle for me.

About LVM. I've found this page: https://wiki.gentoo.org/wiki/LVM#Features
After having a look though it, I'm not really sure if I'd get any benefits from having LUKS inside the LVM on a laptop. Could you please point out what features you see of being a benefit?

Regarding using a genkernel initramfs, that make a lot of sense. I'll probably go through what it makes and modify it as I need.
Back to top
View user's profile Send private message
Roman_Gruber
Advocate
Advocate


Joined: 03 Oct 2006
Posts: 3806
Location: Austro Bavaria

PostPosted: Sun Aug 23, 2015 5:12 pm    Post subject: Reply with quote

Basically I was able to move my / while I was working. Than I physically moved it and rebooted and had my installation on an SSD.

Luks is unflexible. With lvm you can move the data junks as you like. Thats the reason why you hsould have luks inside an lvm thing and not lvm inside luks.
And you can make software raid and whatever you like afaik. but these are detail knowledge. I have not tweaked my lvm for ages, I may tell you half facts. Those linux server pages explain lvm quite in details but you need to find a good source for that.

Assume you have 3 harddiscs and you want to upgrade one harddisc / replace it. You just need to connect the new harddisc via usb (works most of the time) and move the physical extents, thats it. after you moved all of your physical extents that particular harddisc is unused and can be removed, the new harddisc needs to be phyiscal moved and thats it.

AFAIK you can also physically make a duplicate of your lvm setup. thats a real backup and not those fishy scripts or stage 4 where you need to bother to create partions and such. you just create a duplicate which you can just swap drives ...

As i mentioned eaerlier, please refer to the docs. I have not read / used about lvm for a few years now. My setup dates back to 2012 or earlier

I will never set up any of my boxes without an lvm setup. It has too many benefits and moving the data junks with ordinary file systems is not that easy as it seems.

e.g. https://www.howtoforge.com/linux_lvm_snapshots

Quote:
This tutorial shows how you can create backups of LVM partitions with an LVM feature called LVM snapshots. An LVM snapshot is an exact copy of an LVM partition that has all the data from the LVM volume from the time the snapshot was created. The big advantage of LVM snapshots is that they can be used to greatly reduce the amount of time that your services/databases are down during backups because a snapshot is usually created in fractions of a second. After the snapshot has been created, you can back up the snapshot while your services and databases are in normal operation.


Personally I beleive that gentoo wiki page about lvm is poor. It was written from someone who does not focus on someone who never dealt with it. You are better of with a ressource which starts by explaining the idea behind it and how it works and not just a plain summary of a huge pile of commands.


Reusing an existing installation is a pain in the ass without proper knowledge ...

and ever tried to backup your hole box?

lvm backup + binary distro which i install on demand fresh (reuse grub2 from that) + manual copy the boot entry for gentoo + kernel (thats it)

you can also reinstall grub2 to the new drive, copy /boot, + lvm backup (thats a matter of choice=)

It is more likely that you swap out drives that you do a fresh installation. I did several times swapped drives in this 6 year old box. 4x harddrive, 1x ssd.
Back to top
View user's profile Send private message
Ryonez
n00b
n00b


Joined: 22 Aug 2015
Posts: 21
Location: New Zealand

PostPosted: Sun Aug 23, 2015 6:10 pm    Post subject: Reply with quote

tw04l124 wrote:
Basically I was able to move my / while I was working. Than I physically moved it and rebooted and had my installation on an SSD.

Luks is unflexible. With lvm you can move the data junks as you like. Thats the reason why you hsould have luks inside an lvm thing and not lvm inside luks.
And you can make software raid and whatever you like afaik. but these are detail knowledge. I have not tweaked my lvm for ages, I may tell you half facts. Those linux server pages explain lvm quite in details but you need to find a good source for that.

Assume you have 3 harddiscs and you want to upgrade one harddisc / replace it. You just need to connect the new harddisc via usb (works most of the time) and move the physical extents, thats it. after you moved all of your physical extents that particular harddisc is unused and can be removed, the new harddisc needs to be phyiscal moved and thats it.

AFAIK you can also physically make a duplicate of your lvm setup. thats a real backup and not those fishy scripts or stage 4 where you need to bother to create partions and such. you just create a duplicate which you can just swap drives ...

As i mentioned eaerlier, please refer to the docs. I have not read / used about lvm for a few years now. My setup dates back to 2012 or earlier

I will never set up any of my boxes without an lvm setup. It has too many benefits and moving the data junks with ordinary file systems is not that easy as it seems.

e.g. https://www.howtoforge.com/linux_lvm_snapshots

Quote:
This tutorial shows how you can create backups of LVM partitions with an LVM feature called LVM snapshots. An LVM snapshot is an exact copy of an LVM partition that has all the data from the LVM volume from the time the snapshot was created. The big advantage of LVM snapshots is that they can be used to greatly reduce the amount of time that your services/databases are down during backups because a snapshot is usually created in fractions of a second. After the snapshot has been created, you can back up the snapshot while your services and databases are in normal operation.


Personally I beleive that gentoo wiki page about lvm is poor. It was written from someone who does not focus on someone who never dealt with it. You are better of with a ressource which starts by explaining the idea behind it and how it works and not just a plain summary of a huge pile of commands.


Reusing an existing installation is a pain in the ass without proper knowledge ...

and ever tried to backup your hole box?

lvm backup + binary distro which i install on demand fresh (reuse grub2 from that) + manual copy the boot entry for gentoo + kernel (thats it)

you can also reinstall grub2 to the new drive, copy /boot, + lvm backup (thats a matter of choice=)

It is more likely that you swap out drives that you do a fresh installation. I did several times swapped drives in this 6 year old box. 4x harddrive, 1x ssd.


That's a lot to go through,

I'll give it a go and see what I think. Not completely sold on dual-booting with Mint. I'll try it both with and without Mint
Back to top
View user's profile Send private message
Hu
Moderator
Moderator


Joined: 06 Mar 2007
Posts: 13830

PostPosted: Sun Aug 23, 2015 8:23 pm    Post subject: Reply with quote

Swap is not required to use S3 sleep, since RAM remains powered and therefore does not need to be written to swap. However, depending on the amount of RAM in the system, you may want a swap device for general usage. That swap device can do double duty as the hibernation area, provided that you do not hibernate while swap is heavily used.
Back to top
View user's profile Send private message
The Doctor
Moderator
Moderator


Joined: 27 Jul 2010
Posts: 2574

PostPosted: Sun Aug 23, 2015 8:51 pm    Post subject: Reply with quote

Do keep in mind that if you sleep or hyphenate you are undoing your encryption protection. The protection only works so long as they have to decrypt the drive to read it. If they steel it with the key they can see everything you are trying to protect.
_________________
First things first, but not necessarily in that order.

Apologies if I take a while to respond. I'm currently working on the dematerialization circuit for my blue box.
Back to top
View user's profile Send private message
HMC
Tux's lil' helper
Tux's lil' helper


Joined: 06 Jul 2005
Posts: 79
Location: Australia

PostPosted: Mon Aug 24, 2015 1:50 pm    Post subject: Reply with quote

The scheme I use on all of my systems is full disk encryption with LVM on a LUKS encrypted DISK and boot from a USB key. The disk does not have a partition table, no volumes are visible and everything is encrypted except the LUKS header.

The commands are probably the simplest and most self explanatory howto: Fix it as required. The following is for a key that is entered manually during the boot process to open the drive.

Erase the disk:
dd if=/dev/urandom of=/dev/sda bs=1M
Wait a few days or there are other ways to do it including encrypting the disk with a temporary key and writing from /dev/zero...

DO NOT use fdisk.

Setup encrypted disk
cryptsetup -c aes-xts-plain -h whirlpool -s 512 luksFormat /dev/sda use the encryption scheme of your choice - this was chosen randomly for this example. You'll be prompted to type in a key.
cryptsetup luksOpen /dev/sda luks Enter the key.
pvcreate /dev/mapper/luks
vgcreate lvm /dev/mapper/luks
vgscan --mknodes
vgchange -ay
lvcreate -L<disk size in GB>G -n root lvm

Simple volume scheme on a 320GB(?) drive:
lvcreate -L40G -n root lvm
lvcreate -L4G -n swap lvm
lvcreate -L254G -n home lvm

File systems and mount:
mkfs.ext4 /dev/lvm/root
mkfs.ext4 /dev/lvm/home
mkswap /dev/lvm/swap
swapon /dev/lvm/swap
mount /dev/lvm/root /mnt/gentoo
mkdir /mnt/gentoo/home
mkdir /mnt/gentoo/boot
mount /dev/lvm/home /mnt/gentoo/home

Now off you go with the handbook...

To remount after a reboot (in case there are problems)

cryptsetup luksOpen /dev/sda lvm
vgscan --mknodes
vgchange -ay
mount /dev/lvm/root /mnt/gentoo
mount /dev/lvm/home /mnt/gentoo/home
swapon /dev/lvm/swap
then follow the handbook to chroot....


Some packages:
sys-fs/cryptsetup
sys-fs/lvm2
genkernel

Add support for LVM and DM-Crypt.

Multiple devices driver support (RAID and LVM)
<*> Device mapper support
[ ] Device mapper debugging support
<*> Crypt target support

CONFIG_BLK_DEV_DM=y
# CONFIG_DM_DEBUG is not set
CONFIG_DM_CRYPT=y

Cryptographic API
<*> SHA1 digest algorithm
<*> SHA224 and SHA256 digest algorithm
<*> XTS support (EXPERIMENTAL)
<*> AES cipher algorithms

CONFIG_CRYPTO_SHA1=y
CONFIG_CRYPTO_SHA256=y
CONFIG_CRYPTO_XTS=y
CONFIG_CRYPTO_AES=y
CONFIG_CRYPTO_AES_X86_64=y
whirlpool

Prepare a USB key:

fdisk /dev/sdX
mkfs.ext2 /dev/sdXn
e2label /dev/sdXn GENTOO_BOOT

fstab something like this:
LABEL=GENTOO_BOOT /boot ext2 noauto,noatime 1 2
/dev/mapper/lvm-root / ext4 noatime 0 1
/dev/mapper/lvm-swap none swap sw 0 0
/dev/mapper/lvm-home /home ext4 noatime 0 1


This method is supported by Genkernel so there is no rooting around on updates.

/etc/default/grub will want some kernel parameters:

crypt_root=/dev/sda root=/dev/mapper/lvm-root dolvm rootfstype=ext4
and in the default section... real_resume=/dev/mapper/lvm-swap


genkernel.conf will want some options:
LVM="yes" <<-- Important
LUKS="yes" <<-- Important
INSTALL="yes"
DISKLABEL="yes"
BOOTLOADER="grub2"


More advanced subjects are LUKS header relocation and key files...

Cheers
Back to top
View user's profile Send private message
Roman_Gruber
Advocate
Advocate


Joined: 03 Oct 2006
Posts: 3806
Location: Austro Bavaria

PostPosted: Mon Aug 24, 2015 5:59 pm    Post subject: Reply with quote

Most unflexible setup out there.

you are unable to move your data, because hole disk is luks

and booting from usb stick is kinda not convinient. those who are knowledgeable enough do not need your key anyway so why bother booting from a fragile usb port?

encryption is only that you can dump your harddisc with not worring that someone may access your data. In case your harddisc does not work anymore. could be defective pcb but the data is still there. on ssd / hdd the firmware unmark sectors and than you have your data in plain there because you did not used encryption inthe first place when writing your data.

encryption is for that case that a windows noob want to use your device without your knowledge.

anyone else can dump the header and start cracking anyway the pass..

in your luks header htere is everything you start reverse engineering and afaik there is it several times on your disk.

when you are paranoid about your /boot, you should hash it and compare it on every bootup, much better.

Have you ever thought which spyware are in those Bios. especially lenovo had several issues with that. anyone with knowledge can compromise your hdd / bios whatever of your hardware and you will never see it. the point of these usb keys, to have grub and the kernel on it, is as useless as anything. make a hash sum and compare it after bootup, when you do not trust your environment.
Back to top
View user's profile Send private message
frostschutz
Advocate
Advocate


Joined: 22 Feb 2005
Posts: 2970
Location: Germany

PostPosted: Mon Aug 24, 2015 6:32 pm    Post subject: Reply with quote

tw04l124 wrote:
you are unable to move your data, because hole disk is luks


One partitioning software or stray bootloader is all it takes and the LUKS header is in valhalla.

Even if you use a full disk for something, I'd always create a regular partition table first.

tw04l124 wrote:
and booting from usb stick is kinda not convinient


I boot from USB stick myself (with encrypted keyfiles, so a simple keylogger is not good enough).

I don't find it inconvenient. It's the same boot process as from internal disk (GRUB menu appears, select something, off you go). But you can take it with you; and put several recovery ISO images on it, etc. and it can still function as a regular data stick on Windows PCs if you make the first partition a FAT32 (and install FreeDOS on it while you're at it so you also have something for updating firmwares.

tw04l124 wrote:
anyone else can dump the header and start cracking anyway the pass.


That might take a while.

tw04l124 wrote:
afaik there is it several times on your disk.


Nope, just once. A single bit flip in the header is a total failure. (well, not really, since you can brute-force for single-bit-flips, but you get the idea)

Lack of LUKS header copies is a security consideration, the more copies there are the easier to recover [for malignamous persons] and old header copies will accept old passphrases. The LUKS header is much larger than it needs to be simply to make such recovery efforts harder (so a single reallocated / undeletable sector on a HDD won't result in anything useful).

If you desire LUKS header copies, you have to take care of it yourself.

tw04l124 wrote:
when you are paranoid about your /boot, you should hash it and compare it on every bootup, much better.


That's kind of security by obscurity. I can modify your boot & undo the modification before your hash check runs so - modified boot, correct hash, no problem.

But that's not usually what a regular user has to worry about. $5 keyloggers you can consider [USB-Stick and encrypted keyfile more or less handles those - they get the passphrase for a key they don't have] but apart from that...

Either you know really really REALLY well how all of these things work and you create protections that you could not break yourself; or you don't know how anything works and you're screwed when someone comes along who does.

Regular LUKS encryption with no shenanigans whatsoever works well as a simply anti theft device - at least, if you have a screen lock that works and no root shells left open (I tend to forget those, so I make my root-shell auto-timeout after a few minutes of inactivity - which works well, unless the root shell was running some other process).
Back to top
View user's profile Send private message
HMC
Tux's lil' helper
Tux's lil' helper


Joined: 06 Jul 2005
Posts: 79
Location: Australia

PostPosted: Tue Aug 25, 2015 1:47 am    Post subject: Reply with quote

tw04l124 wrote:
Most unflexible setup out there.

you are unable to move your data, because hole disk is luks

and booting from usb stick is kinda not convinient. those who are knowledgeable enough do not need your key anyway so why bother booting from a fragile usb port?

encryption is only that you can dump your harddisc with not worring that someone may access your data. In case your harddisc does not work anymore. could be defective pcb but the data is still there. on ssd / hdd the firmware unmark sectors and than you have your data in plain there because you did not used encryption inthe first place when writing your data.

encryption is for that case that a windows noob want to use your device without your knowledge.

anyone else can dump the header and start cracking anyway the pass..

in your luks header htere is everything you start reverse engineering and afaik there is it several times on your disk.

when you are paranoid about your /boot, you should hash it and compare it on every bootup, much better.

Have you ever thought which spyware are in those Bios. especially lenovo had several issues with that. anyone with knowledge can compromise your hdd / bios whatever of your hardware and you will never see it. the point of these usb keys, to have grub and the kernel on it, is as useless as anything. make a hash sum and compare it after bootup, when you do not trust your environment.



Seriously?
Back to top
View user's profile Send private message
HMC
Tux's lil' helper
Tux's lil' helper


Joined: 06 Jul 2005
Posts: 79
Location: Australia

PostPosted: Tue Aug 25, 2015 2:36 am    Post subject: Reply with quote

frostschutz wrote:


But that's not usually what a regular user has to worry about. $5 keyloggers you can consider [USB-Stick and encrypted keyfile more or less handles those - they get the passphrase for a key they don't have] but apart from that...

Either you know really really REALLY well how all of these things work and you create protections that you could not break yourself; or you don't know how anything works and you're screwed when someone comes along who does.

Regular LUKS encryption with no shenanigans whatsoever works well as a simply anti theft device - at least, if you have a screen lock that works and no root shells left open (I tend to forget those, so I make my root-shell auto-timeout after a few minutes of inactivity - which works well, unless the root shell was running some other process).


That was the intent of my post. A basic bootable setup to work with and build upon that covers encryption in an uncomplicated way with as few holes as possible. It may want a hand typed passphrase for redundancy and things like gpg encrypted keys, hash checks and other security measures come later.

One thing though. I accidentally (la la moment) hosed a system exactly once by running fdisk on a drive, but everything was backed up (a good practice before major operations regardless of setup) and it was running again within a couple of hours with zero data loss. Otherwise there has been no disadvantage to using a disk without a partition table.
Back to top
View user's profile Send private message
Ryonez
n00b
n00b


Joined: 22 Aug 2015
Posts: 21
Location: New Zealand

PostPosted: Tue Aug 25, 2015 12:41 pm    Post subject: Reply with quote

This is a lot of information and ideas on how to do this.

Thank you, it's gonna take me a while, but after I try different things I'll post back here to let you know what I chose to do and why.

Current things to try:

1->
  • sda1 /boot
  • sda2 LVM
    • LUKS
      • /
      • /home
      • /var

2->
  • sda1 /boot
  • sda2 LUKS
    • LVM
      • /
      • /home
      • /var


Because it's to go on the laptop, I'm learning towards 2. This laptop doesn't support usb boot(at least I'm pretty sure it doesn't).
And when the LUKS volume is unlocked, the LVM features should all be available.

If this discussion has shown anything, it's that linux can bloody well do anything. Damn all those windows only games...
Back to top
View user's profile Send private message
Roman_Gruber
Advocate
Advocate


Joined: 03 Oct 2006
Posts: 3806
Location: Austro Bavaria

PostPosted: Tue Aug 25, 2015 12:48 pm    Post subject: Reply with quote

Well wine may be your friend for some windows games.

I do not get hte point in hidng a partition. Why should anyone has a partition in a device without beeing used?

I never used HDD => LUKS => LVM So I can not say if the advanced features of lvm are such easy to use like in my setup HDD => LVM => LUKS => DATA.
I value Frostschutz opinion because he knew a lot about these things before I even used LUKS.

It just depends on the usability and paranoia. But I really doubt that these days you will get any decent hardware which you can trust. More annoyingly those lenovo notebooks have some open bios open source thing which may work, but lenovo is known for its spyware in bios. Others like Dell, Samsung are suspect to that.

Anyway up to you waht you choose.

I realized that it*s only feasable to encrypt the box as much that the ordinary windows noob, scriptkiddy won*t be able to access it. The government and others will point a gun at your head and ask for the usb key or the passphrase, so what ...
Back to top
View user's profile Send private message
Ryonez
n00b
n00b


Joined: 22 Aug 2015
Posts: 21
Location: New Zealand

PostPosted: Tue Aug 25, 2015 1:45 pm    Post subject: Reply with quote

tw04l124 wrote:
I do not get hte point in hidng a partition. Why should anyone has a partition in a device without beeing used?


Sorry, I don't get that. What wouldn't be used? I fancy no. 2 because I have no clue what data LVM leaves lying around. In the software I use in windows, the partition is maintained inside the container, and doesn't loose features. The only impacted I noticed(very rarely if at all) was a drive speed slowdown while encryption/decryption was going on.
What I'm after here is security, not plausible deniability, which is the only case I can think of that would have a barely used partition. In that case it should be impossible to even know that there is a hidden partition(IF you do it right).
Back to top
View user's profile Send private message
szatox
Veteran
Veteran


Joined: 27 Aug 2013
Posts: 1746

PostPosted: Tue Aug 25, 2015 7:17 pm    Post subject: Reply with quote

I'd go with lvm inside luks simply for convenience it offers. It's basicaly "launch and forget about LUKS".
The oposite is kinda "you know when you need it", like when you want to have a part of filesystem protected.
Back to top
View user's profile Send private message
Ryonez
n00b
n00b


Joined: 22 Aug 2015
Posts: 21
Location: New Zealand

PostPosted: Thu Sep 10, 2015 8:29 am    Post subject: Reply with quote

Right, I'm sorting out the Virtual Machine now. Could someone help with a guide for this set-up please?

  • sda1 /boot
  • sda2 LUKS
    • LVM
      • /
      • swap


I've got around 6 tabs open all with different information up, lot of it was written ages ago and my headache is getting worse...

I'd really appreciate it!
Back to top
View user's profile Send private message
khayyam
Watchman
Watchman


Joined: 07 Jun 2012
Posts: 6228
Location: Room 101

PostPosted: Thu Sep 10, 2015 1:36 pm    Post subject: Reply with quote

The Doctor wrote:
Do keep in mind that if you sleep or hyphenate you are undoing your encryption protection. The protection only works so long as they have to decrypt the drive to read it. If they steel it with the key they can see everything you are trying to protect.

Doc ... hehe "hyphenate", anyhow, actually no. If you're hibernating (suspend-to-disk) the image is (normally) written to the LVM swap, it can't be read, or booted, without your having opened the LUKS volume on restarting the machine (ie, via the initramfs). While the machine is in hibernation the disk is in the same state it would be if the machine were shutdown, so there is no inherent problem there. Obviously, with suspend-to-ram the image isn't similarly protected, it could theoretically be read, and if the machine returns to the state that it was before suspending that is, as you say, "undoing your encryption", but this isn't the case with hibernation/suspend-to-disk when using LVM within a LUKS volume.

best ... khay
Back to top
View user's profile Send private message
Display posts from previous:   
Reply to topic    Gentoo Forums Forum Index Installing Gentoo All times are GMT
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum