Gentoo Forums
Gentoo Forums
Gentoo Forums
Quick Search: in
Encrypted Root File System, Swap, etc...
View unanswered posts
View posts from last 24 hours

Goto page Previous  1, 2, 3, 4, 5, 6 ... 11, 12, 13  Next  
Reply to topic    Gentoo Forums Forum Index Documentation, Tips & Tricks
View previous topic :: View next topic  
Author Message
chadders
Tux's lil' helper
Tux's lil' helper


Joined: 21 Jan 2003
Posts: 113

PostPosted: Thu May 22, 2003 3:02 am    Post subject: Reply with quote

Woah cool! Thanks eonic and watersb. I still havent found out how to make a bootable cd for /boot and the initrd stuff but i havent been working on it very much lately because my computer died and I had to find new motherboard which wasnt very easy. It would work for 20 seconds and then lock up even on a dos diskette :( I finally got a motherboard from a old pc for 10 dollars so now I'm BACK.

The good thing is that my disk drive is ok YAY and the encrypted root stuff still works on it. Can you give me the steps that you used to make a bootable /boot on cd?

Chad :D
Back to top
View user's profile Send private message
Aonoa
Guru
Guru


Joined: 23 May 2002
Posts: 589

PostPosted: Thu May 22, 2003 6:24 am    Post subject: Reply with quote

Sure :)

mke2fs /dev/fd0
mount /dev/fd0 /mnt/floppy

mkdir -p /mnt/floppy/boot/grub

cp /boot/bzImage /mnt/floppy/boot
cp /boot/initrd.gz /mnt/floppy/boot
cp /boot/grub/grub.conf /mnt/floppy/boot/grub

Now edit grub.conf on the floppy to read something like this:

Code:

default 0
timeout 15
splashimage=/boot/grub/splash.xpm.gz

title=Boot
root (hd0,0)
kernel /bzImage ro root=/dev/ram0
initrd /initrd.gz


cd /usr/share/grub/i386-pc

dd if=stage1 of=/dev/fd0 bs=512 count=1
dd if=stage2 of=/dev/fd0 bs=512 seek=1
dd if=/dev/fd0 of=/boot/image bs=1024

cd /
mkisofs -rlDJLV "boot" -b boot/image -c boot/catalog -o boot.iso boot/

Then burn boot.iso with your favourite cd-r tool :)
Back to top
View user's profile Send private message
watersb
Apprentice
Apprentice


Joined: 04 Sep 2002
Posts: 297
Location: where the hell is Tesuque, New Mexico?

PostPosted: Sat May 24, 2003 5:38 pm    Post subject: Reply with quote

eonic wrote:
Sure :)

mke2fs /dev/fd0
mount /dev/fd0 /mnt/floppy

...


Great info, eonic!

I think that you can use a loopback file instead of a floppy disk... I am working through this today and will post my results when I know more.


Last edited by watersb on Sat May 24, 2003 6:02 pm; edited 1 time in total
Back to top
View user's profile Send private message
watersb
Apprentice
Apprentice


Joined: 04 Sep 2002
Posts: 297
Location: where the hell is Tesuque, New Mexico?

PostPosted: Sat May 24, 2003 6:01 pm    Post subject: Reply with quote

xi wrote:
is it possible to use encrypted swap (cryptoloop or loop-aes) with swsusp (suspend to disk) ?


This is an EXCELLENT question -- because of course if you use suspend-to-disk with an unencrypted swap, ANYONE with access to your hard disk can read your memory -- including any kernel structures that hold your keys to the encrypted disk!

The short answer is, No I don't think so -- the reason is that the resume-from-swsup is looking for a standard swap partition.

The new kernel cryptoAPI would permit kernel-land to make the encryption on the swap transparent..

There might be a way to tweak swsup-enabled systems so that you set up a loop before invoking swsup resume, but I rather suspect this would involve some changes to swsup.

I have a laptop, and got interested in disk encryption for exactly the reasons posted on this thread: for a laptop that's relatively easy to steal, if you're not running encrypted disk you should not bother with user and root passwords, either.

Likewise swsup: if you use it and your machine is stolen, hard disk encryption won't matter much, nor will passwords.

So I don't use swsup. I'd certainly like to have it encrypted!
Back to top
View user's profile Send private message
karrots
n00b
n00b


Joined: 06 Mar 2003
Posts: 11
Location: Ogden, Ut

PostPosted: Sat May 24, 2003 6:16 pm    Post subject: CD Booting Reply with quote

Skip the floppy image and put the kernel and initrd on the cd directly. Then use ISOLinux to boot the kernel.

http://syslinux.zytor.com/iso.php

Heck if you still want to use a floppy image us ISOLinux in conjunction with memdisk then you can have multiple boot images on one CD. Thats what I do with one of my utilitiy CD's works great.

karrots
Back to top
View user's profile Send private message
watersb
Apprentice
Apprentice


Joined: 04 Sep 2002
Posts: 297
Location: where the hell is Tesuque, New Mexico?

PostPosted: Sat May 24, 2003 9:54 pm    Post subject: Reply with quote

I could not get the XFS filesystem to work well with loop-AES under 2.5.69-mm8; I get I/O errors after a very short while and the filesystem disappears.

I am using reiserfs now and it seems to work fine.

I seem to recall that encrypted loopback systems need to ensure serialized writes, but I thought that restriction applied only to file-backed loops, and I'm using a drive partition (a block device, not a file).

Chadders, do you recall the mkfs.xfs settings that you used?

Has anyone else tried this with 2.5.69?
Back to top
View user's profile Send private message
Naughtyus
Guru
Guru


Joined: 14 Jul 2002
Posts: 463
Location: Vancouver, BC

PostPosted: Sat May 24, 2003 10:15 pm    Post subject: Reply with quote

Is there any way to get this to work with a passkey file instead of a password?

I would like to have the system boot from CD (as above), but instead of asking for a pass, just look on the CD for a passkey file (or something which effectivly makes the boot secure, and does not require the user to enter anything).
Back to top
View user's profile Send private message
Naughtyus
Guru
Guru


Joined: 14 Jul 2002
Posts: 463
Location: Vancouver, BC

PostPosted: Sun May 25, 2003 12:35 am    Post subject: Reply with quote

Also - is there any way I can make the password (if not using a GPG key, or whatever) less than 20 characters? Thats overkill for the system I'd like to do this for.
Back to top
View user's profile Send private message
watersb
Apprentice
Apprentice


Joined: 04 Sep 2002
Posts: 297
Location: where the hell is Tesuque, New Mexico?

PostPosted: Sun May 25, 2003 1:02 am    Post subject: Reply with quote

2.5.69-mm8 status report...

Getting close; it loads the initrd.gz that is built by loop-AES/build-initrd.sh -- and then it's getting confused, attempting to mount the partition as a UDF-fs filesystem. I dunno...

I disabled UDF-fs in my kernel, and I'm trying again.

Overall, I am happy that this is closer to working than the cryptoAPI stuff, but I am not happy at the impossibility of debugging the linuxrc script of the init ramdisk!

If I cannot get the loop-AES linuxrc process to work, then I will tweak the ramdisk that I built for 2.4.19 -- my ramdisk is 100x larger, but it gives you an entire Linux distribution in the 300K ramdisk (using uClibc for running on embedded systems). Which means that I can get a shell and manually type some losetup commands...

Grr...

oh, and there's a number of bugs in 2.5.59-mm8 and interactions with all this stuff... but I'm almost there...
Back to top
View user's profile Send private message
watersb
Apprentice
Apprentice


Joined: 04 Sep 2002
Posts: 297
Location: where the hell is Tesuque, New Mexico?

PostPosted: Tue May 27, 2003 1:34 am    Post subject: CryptoAPI in 2.5.69 Reply with quote

I just got CryptoAPI loopback to work with kernel 2.5.69, (by working on a port to 2.5.58 of Adam Richter's cryptoloop by Furwith Clemens.)

This uses the same API in the 2.5.x kernels as the gentoo-sources use in the 2.4 series -- and what's even better (in my opinion), in 2.5 it uses the new overall kernel infrastructure for crypto, so there is ONE place for all of the cipher implementations.

This CryptoAPI stuff is a slightly different approach that Jaari's loop-AES, but the two should converge at some point. Anyway I'm happy that I got it to work.

For the question of which is the better API, I would have to answer, "the one that works the most reliably". The CryptoAPI-loop developers have all wandered off in the past couple of months, at least they are not actively answering e-mail the way that Jaari does! I suspect that they have more-pressing kernel work to get done; AdamJ is also working on the re-work of devfs, which is more important. And so on.

I will be testing my CryptoAPI loopback for a while. Here's hoping...


If it works, the next step will be to work with Jaari to get the changes included into util-linux; Jarri's util-linux extensions are nice, providing GPG support and password "salt". But his extensions are rather loop-AES oriented. I think that it can converge without too much more work, though.
Back to top
View user's profile Send private message
chadders
Tux's lil' helper
Tux's lil' helper


Joined: 21 Jan 2003
Posts: 113

PostPosted: Tue May 27, 2003 2:12 am    Post subject: Reply with quote

HI watersb! I didnt use anything special on my mkfs.xfs and used the defaults. Only problem I had is I can't make aespipe work and I don't know why. I only used xfs for my root because I wanted to check it out. My big encrypted partition where most of my stuff is at is reiserfs just because its been that way for a long time and I didnt want to reload everything yet.

I'm thinking about trying out crypto-api again because I want to use 2.5 kernels. I tried loop-AES on 2.5.something a while ago and it didnt work too good. Do you think crypto-API is stable enough now?

Chad :D
Back to top
View user's profile Send private message
watersb
Apprentice
Apprentice


Joined: 04 Sep 2002
Posts: 297
Location: where the hell is Tesuque, New Mexico?

PostPosted: Sat May 31, 2003 12:43 am    Post subject: Reply with quote

chadders wrote:
HI watersb! I didnt use anything special on my mkfs.xfs and used the defaults.


OK, thanks, I get it... your XFS partition is NOT encrypted, right? I had horrible I/O errors with encrypted XFS under 2.5.69-bk18, with both loop-AES and cryptoAPI.

Quote:

I'm thinking about trying out crypto-api again because I want to use 2.5 kernels. I tried loop-AES on 2.5.something a while ago and it didnt work too good. Do you think crypto-API is stable enough now?


Do I think it's stable enough now... um, no. It seems to work for me, and it seems like a relatively small layer on top of the CryptoAPI, but things could break in the next kernel release (which I will try Real Soon Now).

I'd like it to say it works, but I posted my patches for 2.5.69-bk18 to the cryptoapi-devel list on Monday and so far have received NO response. But Jari Ruusu, the loop-AES guy, has been exchanging emails with me all week.

If you would like to test this CryptoAPI, then you can get the patches here:

http://www.kerneli.org/pipermail/cryptoapi-devel/2003-May/000562.html

If I understand correctly, you will NOT be able to use the same kernel for both loop-AES and CryptoAPI disk encryption. So make a new kernel with "loopback devices" enabled in BLOCK devices, and enable the CryptoAPI. You'll also want to enable the "Encryption for Loopback devices" option.

I build a kernel, rebooted with it, and then loaded modules for twofish, loop, and cryptoloop. Then I used a patched version of util-linux-2.11y (pulled from kerneli.org CVS, then patched with the patch that I refined and tested), compiled a new losetup and mount, and then used those to mount the loopback devices.

Jari is trying to help me get the initrd (initial RAM disk) to work with the recent 2.5 kernel, so stay tuned...
Back to top
View user's profile Send private message
TinheadNed
Guru
Guru


Joined: 05 Apr 2003
Posts: 339
Location: Farnborough, UK

PostPosted: Sat May 31, 2003 12:54 pm    Post subject: Mounting the boot partition Reply with quote

Has anybody had problems getting the initial ramdisk to mount the boot partition?

I am really confused as to the problem, but it just tells me that mounting /dev/hda2 as /lib failed, and shuts down. The boot partition is (obviously) not encrypted, and on ext3. Ext3 and ext2 support are in the kernel. Grub can read off the boot partition to load the kernel and initrd so i'm very confused. I might unencrypt my HD again (it'll only take 20 minutes) but it just seems a bit of a waste.
Back to top
View user's profile Send private message
viperlin
Veteran
Veteran


Joined: 15 Apr 2003
Posts: 1317
Location: UK

PostPosted: Sat May 31, 2003 2:33 pm    Post subject: Reply with quote

been folowing this fr a while but this is my forst post, so well done on this tutorial and i'm 15 myself and fixed the devfs problem pretty quickly after reading a little.

i was wondering if anybody has tryed this with a framebuffer image (tutorials on this forum https://forums.gentoo.org/viewtopic.php?t=49036 and on http://www.bootsplash.org, as the framebuffer requires:


Code:
Code maturity level options  --->
    [*] Prompt for development and/or incomplete code/drivers
Processor type and features  --->
    [*] MTRR (Memory Type Range Register) support
Block Devices ->
    [*] Loopback device support
    [*] RAM disk support
    (4096)   Default RAM disk size
    [*] Initial RAM disk (initrd) support
Console Drivers ->
    [*] VGA text console
    [*] Video mode selection support
Frame-buffer support ->
    [*] Support for frame buffer devices
    [*] VESA VGA graphics console
    [*] Use splash screen instead of boot logo


it also requires a special initrd file which contains the framebuffer theme loaded at boot, so i assume you cannot have a framebuffer image and encrypted harddrive, unless 2 initrd's are allowed. i will experiment with this but i assume that since one requires loopback devices enabled and one requires it disabled.

hope that made sence.
Back to top
View user's profile Send private message
Aonoa
Guru
Guru


Joined: 23 May 2002
Posts: 589

PostPosted: Sat May 31, 2003 8:02 pm    Post subject: Reply with quote

I already had a system using framebuffer and a bootsplash, then when encrypting i changed the initrd entry in grub with the one I made using the encrypt howto. (I still kept my original bootsplash initrd file)

So I have a system that boots from cd-rom with framebuffer support and when it finishes the boot process and awaits login, it inserts the background picture.

I would however like to be able to maybe merge the two initrd's to get the image displayed during boot, but maybe that will make the image too large? I've not investigated how to do this yet if it is possible, rather busy at school with a large project.

As I don't have the time, it would be awesome if someone figured it out.
Back to top
View user's profile Send private message
TinheadNed
Guru
Guru


Joined: 05 Apr 2003
Posts: 339
Location: Farnborough, UK

PostPosted: Sat May 31, 2003 10:44 pm    Post subject: Reply with quote

Right, I sovled my failed to mount /lib errors (missed the do not mount devfs at boot bit in there), but now I'm stuck on a second problem which recompiling the source and kernel has not helped. I've also tried compiling the encrypted loopback driver into the kernel with no difference.

Now it (presumably) correctly mounts the boot partition, but all it says is "could not open initial console" and halts again. I have absolutely no idea where this comes from in the source for build-initrd, it only appears to open /dev/console after mounting the root partition (which I never get asked the password for), so it seems to be doing it before trying to mount any other drives.

Any ideas? My laptop is only usable as a chrooted Knoppix install right now, which as you can imagine is a bit of a shame.
Back to top
View user's profile Send private message
chadders
Tux's lil' helper
Tux's lil' helper


Joined: 21 Jan 2003
Posts: 113

PostPosted: Mon Jun 02, 2003 3:05 am    Post subject: Reply with quote

watersb wrote:


OK, thanks, I get it... your XFS partition is NOT encrypted, right? I had horrible I/O errors with encrypted XFS under 2.5.69-bk18, with both loop-AES and cryptoAPI.


My root is XFS and it IS encrypted. I havent had any troubles with it.

Thanks for patches im trying it out now.

Chad :D
Back to top
View user's profile Send private message
Ian
l33t
l33t


Joined: 28 Oct 2002
Posts: 834
Location: Somerville, MA

PostPosted: Mon Jun 02, 2003 6:48 pm    Post subject: Reply with quote

If I set this up on a home file/web server, would it automatically decrypt when sending files out over the network?

I'm basically doing this for the hell of it, and I heavily use samba with the machine i'll be testing it on (well, I will be, when ever i get some free time to set it up :p). I want to make sure that if a user logs in, they'll be able to read files like normal. i assume this is so, but i'd like confirmation. hell, i'll probably go do it anyways. i can always decrypt/reinstall :p.
Back to top
View user's profile Send private message
barlad
l33t
l33t


Joined: 22 Feb 2003
Posts: 673

PostPosted: Mon Jun 02, 2003 7:40 pm    Post subject: Reply with quote

Sure you won't have any problem at all. Like it was previously said, it is totally transparent to any user.
Back to top
View user's profile Send private message
Ian
l33t
l33t


Joined: 28 Oct 2002
Posts: 834
Location: Somerville, MA

PostPosted: Mon Jun 02, 2003 8:16 pm    Post subject: Reply with quote

ok, i figured as much, and by now it's really too late, cause i've already started encrypting my system :p.

as i finish up this system though, i will be moving /dev/hda to /dev/hde, and adding /dev/hdg, and i'm not sure if this will pose any problems. the reason it starts at 'e', is because i have a ultra 100 controller, and it's currently in use in the first server that my dad is stealing in a week or so. i could leave hda as hda, and just add in the second harddrive as hde (on the controller), but i'd like it all at higher speeds, as it does help when transfering files over the network.

also, if i can't move the first hard drive, i'd still like to encrypt the second. can i use the instructions to encrypt /usr to encrypt the second hard drive?
Back to top
View user's profile Send private message
watersb
Apprentice
Apprentice


Joined: 04 Sep 2002
Posts: 297
Location: where the hell is Tesuque, New Mexico?

PostPosted: Thu Jun 05, 2003 5:04 pm    Post subject: Reply with quote

TinheadNed wrote:

Now it (presumably) correctly mounts the boot partition, but all it says is "could not open initial console" and halts again. I have absolutely no idea where this comes from in the source for build-initrd, it only appears to open /dev/console after mounting the root partition (which I never get asked the password for), so it seems to be doing it before trying to mount any other drives.


This sounds like a /dev/vc/... issue to me.

Since you are not mounting devfs automatically, the initrd might be trying to look at device files that are not there; under 2.5.70 I ran into this, since it is best not to mount devfs upon boot... my /etc/inittab has lines in it like this:
Code:

# TERMINALS
c1:12345:respawn:/sbin/agetty 38400 vc/1 liunx
c2:12345:respawn:/sbin/agetty 38400 vc/2 liunx


Note that the terminal devices are listed as "vc/1"... not "tty0" (or some other thing).

I don't know for certain that this is your problem, but I am running into problems with the initrd under 2.5.x and I think that this might be part of it.

I suspect that the build-initrd script needs some work before it is reliable with devfs. Not certain.

I hope this is not confusing the issue...
Back to top
View user's profile Send private message
Spider
Retired Dev
Retired Dev


Joined: 26 May 2002
Posts: 163
Location: Sweden

PostPosted: Thu Jun 05, 2003 9:24 pm    Post subject: hints Reply with quote

those who had problems getting the initrd to load properly, heres a hint from the developers:

http://mail.nl.linux.org/linux-crypto/2003-05/msg00122.html
_________________
For immediate answers, @gentoo.org :
gentoo-users, gentoo-desktop, gentoo-dev, spider
Back to top
View user's profile Send private message
bryon
Apprentice
Apprentice


Joined: 14 Feb 2003
Posts: 163

PostPosted: Fri Jun 06, 2003 6:56 am    Post subject: usb dirve? Reply with quote

Has anyone figured out how to get /boot on a USB drive to work yet?
Back to top
View user's profile Send private message
watersb
Apprentice
Apprentice


Joined: 04 Sep 2002
Posts: 297
Location: where the hell is Tesuque, New Mexico?

PostPosted: Sat Jun 07, 2003 5:39 am    Post subject: Re: usb dirve? Reply with quote

bryon wrote:
Has anyone figured out how to get /boot on a USB drive to work yet?


Check this out...
https://forums.gentoo.org/viewtopic.php?t=57754

Your system needs to support bootable USB devices from the BIOS...
Back to top
View user's profile Send private message
watersb
Apprentice
Apprentice


Joined: 04 Sep 2002
Posts: 297
Location: where the hell is Tesuque, New Mexico?

PostPosted: Sat Jun 07, 2003 5:41 am    Post subject: Re: hints Reply with quote

Spider wrote:
those who had problems getting the initrd to load properly, heres a hint from the developers:

http://mail.nl.linux.org/linux-crypto/2003-05/msg00122.html


Thanks! That wasn't it... still trying... :lol:
Back to top
View user's profile Send private message
Display posts from previous:   
Reply to topic    Gentoo Forums Forum Index Documentation, Tips & Tricks All times are GMT
Goto page Previous  1, 2, 3, 4, 5, 6 ... 11, 12, 13  Next
Page 5 of 13

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum