HOWTO: Install truecrypt and encrypt your Firefox/TB files

[Guenther Brunthaler]

This guide will show you how to

• Fetch and install the truecrypt package on your box
  
• Create a virtual disk inside an encrypted file as a container using truecrypt.
  
• Create a "$HOME/p" directory that can be used as a safe place for private or classified data.
  
• Move your Thunderbird/Firebird settings/emails into that directory, thus securing them by encryption.
  

So, here's the guide:

• Truecrypt needs the "device mapper" to work. If you haven't enabled it in your kernel, please do so now before continuing. The device mapper can be configured as a kernel module as well as directly built into the kernel in order for truecrypt to work. If you are using Genkernel, this should not be an issue as device mapper will be available.
  
• Get the newest version of the truecrypt source package from the truecrypt homepage (http://www.truecrypt.org/downloads.php). As the time of writing this guide, this was version 4.2a.
  
• Extract the package contents:
  

  Code:

  tar -xvzf <packagename>.tar.gz

  
  where <packagename>.tar.gz is the name of the archive you downloaded.
  
• Use 'cd' to go into the directory created by the extraction, and from there into the Linux subdirectory.
  
• Run

  Code:

  ./build.sh

  to compile truecrypt.
  
• Run

  Code:

  ./install.sh

  to install it. The installation script will prompt you for the directories where truecrypt should be installed. I suggest installing it into /usr/local/sbin, as it's not an official part of the Gentoo distribution (yet).
  
• That's it for the truecrypt installation. Easy, wasn't it?
  
• Now we'll create a truecrypt volume container. This is an encrypted file which will contain the data to be protected by encryption. But first let's create directories for the volume as well for the mount points. You can choose anything you like; I chose the following:
  

  Code:

  mkdir -p /var/local/lib/truecrypt/{volumes,mnt}

  
  
• Now let's create the encrypted container file. Any name will do; I chose "private.tc":
  

  Code:

  cd /var/local/lib/truecrypt/volumes truecrypt -c private.tc

  
  Truecrypt will ask you now several questions, such as how large the volume is going to be, what of the available ciphers to use, what password, etc.
  
  Just answer all of them according to your requirements. It may be a good idea to read the truecrypt manual before answering the questions.
  
  However, here is what I chose to create a container to be formatted with ReiserFS later:
  
  • Volume type = normal
    
  • Filesystem = none (we'll format it later)
    
  • Hash-algorithm = RIPEMD-160 (it's safer than SHA-1 which is near to be broken)
    
  • Encryption Algorithm = AES-Twofish-Serpent (Yes, I'm a bit paranoid. I don't trust AES too much. But it may be good enough for warming up the bits for TWOFISH, which I trust much more. But then, I could be wrong, so lets SERPENT encrypt the thing again like a post-processor just to be sure. Triple-Encryption is fun!)
    
  
  
• Truecrypt will then create the container. Depending on the size you have requested, this may take some time.
  
• After truecrypt finishes creating the volume container file, we have to mount it into truecrypt for creating a filesystem inside it:
  

  Code:

  truecrypt -N64 private.tc

  
  The 64 here is used to force truecrypt to create the device node for the virtual disk as /dev/mapper/truecrypt64. It's an arbitrary choice, and truecrypt would have choosen an unused number by itself if -N64 was not used. But I'm specifying it here explicitly, so that I don't have to figure out which number truecrypt has actually chosen for the next step.
  
• Truecrypt will prompt you for the password which you have chosen when creating the container file. Enter it.
  
• Now, /dev/mapper/truecrypt64 will be available, presenting us the decrypted data inside the encrypted container file. Which means we can use it like any disk. Let's create a filesystem first:
  

  Code:

  mkreiserfs -l "Personal Data" /dev/mapper/truecrypt64

  
  Of course, you are free to choose any other filesystem or volume label you might prefer instead of this.
  
• Let's create a mountpoint directory and mount the freshly created filesystem on it:
  

  Code:

  cd ../mnt mkdir -m0 private chown nobody:nogroup private mount /dev/mapper/truecrypt64 private

  
  (I always assign mountpoint directories to user nobody without any permissions. This way you can see quickly whether something is mounted at the mount point or not when using ls -l, even without looking into the mountpoint directory's contents.)
  
• The encrypted volume is now mounted ready to use!
  
• Let's create a /home-hierarchy inside the encrypted filesystem now, mirroring the hierarchy of /home in the root filesystem. We'll also create a directory for user "joe" (replace this by your username accordingly):
  

  Code:

  cd private mkdir -p home/joe chown joe home/joe chmod 700 home/joe

  
  
• Now let's go to joe's home directory and create a symlink named "p" (for "private") pointing to the "joe" directory on the encrypted filesystem:
  

  Code:

  cd /home/joe ln -s /var/local/lib/truecrypt/mnt/private/home/joe p

  
  
• Now user joe has a symlink "p" in his home directory, which will work like an encrypted subdirectory. All data within this subdirectory will be transparently encrypted as part of the private.tc container file.
  
• But user joe will have to know nothing about truecrypt or anything about encryption. For joe, "p" is just another directory, only that he know it's "safe" and accessing it will be a tiny bit slower (because it has to be encrypted/decrypted on the fly in the background as he accesses it).
  
• Feel free to create similar subdirectories and symlinks for other users also, just like for joe.
  
• Now let's move joe's thunderbird and firefox files (mails, bookmarks, saved password, settings) into that safe directory "p". But be sure that there's enough space in "p" before continuing! Use
  

  Code:

  df -h

  
  in order to see the free space available on the various volumes, including the filesystem mounted in the truecrypt container.
  Then check the size of the combined firefox/thunderbird subdirectories:
  

  Quote:

  du -hsc .thunderbird/ .mozilla/

  
  Continue only if the combined size of those directories is less by at least a couple of megabytes than the available space in the encrypted volume!
  
• Move the FF and TB files into the p subdirectory. Be sure none of both applications is currently running while you are doing this!
  

  Code:

  mv .thunderbird .mozilla p/

  
  
• Finally, let's create symlinks at the old location, so that FF and TB find their files where they expect them to be:
  

  Code:

  ln -s p/.thunderbird ln -s p/.mozilla

  
  
• You can do the same trick for any other subdirectories you want to be secure as well. Just follow the same pattern: Move them into the p subdirectory, and create a symlink in the old location, pointing to the new location.
  
• Hint: Use relative symlinks if you can (relative to "p"). That way, if you ever chose to move the mount point for the truecrypt volume somewhere else, all you have to update will be the "p" symlink. The other symlinks will not need to be changed, because they are relative to "p" no matter where "p" actually points to.
  
• Congratulations, you are done! When you will be starting FF or TB, they will using the encrypted volume for all of their data.
  

There is one problem, though: The encrypted volumes must be unmounted before shutting down the system, or otherwise the contents may be damaged like it is the case for any filesystem that is not unmounted before the system goes down.

For normal volumes, the Gentoo shutdown scripts will take care of this. But as those scripts do not know anything about truecrypt, we can't count on that.

One way is to do it manually:

[Paidhi]

Hi Guenther!

Great Howto. I used TrueCrypt on Windows and this information about using it on Gentoo was exactly what I was looking for.
I would very much like to see a sequel about shrinking and expanding when using LVM. As you mentioned at the end of your posting.


Servus,
-Markus-
_________________
Unix _IS_ userfriendly. It's just selective about who it's friends are.

[Guenther Brunthaler]