Encrypting swap every boot

abduct · Apprentice Joined: 19 Mar 2015 Posts: 215

I found this link (https://wiki.archlinux.org/index.php/Dm-crypt/Swap_encryption#Without_suspend-to-disk_support) on the arch site and I was wondering how I can implement such a thing on gentoo.

What it does is uses /dev/urandom as the key to the encrypted swap partition, and then re-encrypts it every boot resulting in any stagnate data remaining from a previous session being useless.

I currently have encrypted file volumes which i use loop devices to mount them to directories after using cryptsetup to open them, although I do not quite know how to setup this style of swap partition encryption.

I don't seem to have a file called crypttab so I assume I can't pull this off, unless someone here knows an alternative simple way to set this up.

Thanks all!

frostschutz · Advocate Joined: 22 Feb 2005 Posts: 2977 Location: Germany

crypttab is /etc/conf.d/dmcrypt in openrc gentoo and it has a swap example with random key

abduct · Apprentice Joined: 19 Mar 2015 Posts: 215

abduct · Apprentice Joined: 19 Mar 2015 Posts: 215

I setup /etc/conf.d/dmcrypt like so:

frostschutz · Advocate Joined: 22 Feb 2005 Posts: 2977 Location: Germany

cryptsetup will handle the loop device for you,

so you can cryptsetup luksOpen somefile somename and then mount /dev/mapper/somename without losetup without -o loop options

a dmcrypt entry should also work for this

you might still need fstab entries for the dmcrypt stuff you create

toralf · Posted: Sun Jun 21, 2015 9:07 am Post subject:

Put something like

abduct · Apprentice Joined: 19 Mar 2015 Posts: 215

Alright some things are working, but some are not.

Here is /etc/conf.d/dmcrypt

abduct · Apprentice Joined: 19 Mar 2015 Posts: 215

After some fiddling and researching which rc service mounts what I determined I need to add dmcrypt to the boot run level. My directories are mounting perfectly fine now and even though my swap still has a warning, it is showing up in free and /proc/meminfo.

Last few questions which would be helpful if answered:

How do you create a keyfile that dmcrypt can use? What settings should I use with gpg to create them?
When specifying a remote key such as that on a sd card or usb drive, does dmcrypt auto mount the device or do I need to write an init to mount it for me?
What does "remdev" do exactly?

Thanks for all the help so far!

Also is anyone allowed to contribute to the wiki? I'd like to add what I've learned to https://wiki.gentoo.org/wiki/Dm-crypt since it does not mention this nice automated config file and most of my questions should be documented more in depth either in the config file itself or in the wiki.

abduct · Apprentice Joined: 19 Mar 2015 Posts: 215

Last few questions which would be helpful if answered:

How do you create a keyfile that dmcrypt can use? What settings should I use with gpg to create them?
When specifying a remote key such as that on a sd card or usb drive, does dmcrypt auto mount the device or do I need to write an init to mount it for me?
What does "remdev" do exactly?

Thanks!

Massimo B. · Posted: Mon Oct 24, 2016 11:41 am Post subject:

Hi, same question about encrypting swap via OpenRC and dmcrypt. Usually that was working for me, but currently it does not work:

frostschutz · Advocate Joined: 22 Feb 2005 Posts: 2977 Location: Germany

What if you write PARTUUID= instead of /dev/disk/by-partuuid/?

You can also use this method to give it an actual UUID or LABEL https://wiki.archlinux.org/index.php/Dm-crypt/Swap_encryption#UUID_and_LABEL

Untested:

mvasi90 · n00b Joined: 16 Aug 2021 Posts: 19

To avoid reviving old posts, here I leave a link to this recent post in which I expose two ways of SWAP re-encryption: during boot and during shutdown.

The recommended way to re-encrypt the SWAP partition is during the normal shutdown. If you re-encrypt the SWAP on the boot process (initramfs or initscripts) your SWAP data will be susceptible to forensic analysis after the shutdown because the encryption key is the same.[/post]