Encrypted Root File System, Swap, etc...

Message

chadders · Post by **chadders** » Thu May 22, 2003 3:02 am

Woah cool! Thanks eonic and watersb. I still havent found out how to make a bootable cd for /boot and the initrd stuff but i havent been working on it very much lately because my computer died and I had to find new motherboard which wasnt very easy. It would work for 20 seconds and then lock up even on a dos diskette

I finally got a motherboard from a old pc for 10 dollars so now I'm BACK.

The good thing is that my disk drive is ok YAY and the encrypted root stuff still works on it. Can you give me the steps that you used to make a bootable /boot on cd?

Chad

Aonoa · Post by **Aonoa** » Thu May 22, 2003 6:24 am

Sure

mke2fs /dev/fd0
mount /dev/fd0 /mnt/floppy

mkdir -p /mnt/floppy/boot/grub

cp /boot/bzImage /mnt/floppy/boot
cp /boot/initrd.gz /mnt/floppy/boot
cp /boot/grub/grub.conf /mnt/floppy/boot/grub

Now edit grub.conf on the floppy to read something like this:

Code: Select all

default 0
timeout 15
splashimage=/boot/grub/splash.xpm.gz

title=Boot
root (hd0,0)
kernel /bzImage ro root=/dev/ram0
initrd /initrd.gz

cd /usr/share/grub/i386-pc

dd if=stage1 of=/dev/fd0 bs=512 count=1
dd if=stage2 of=/dev/fd0 bs=512 seek=1
dd if=/dev/fd0 of=/boot/image bs=1024

cd /
mkisofs -rlDJLV "boot" -b boot/image -c boot/catalog -o boot.iso boot/

Then burn boot.iso with your favourite cd-r tool

watersb · Post by **watersb** » Sat May 24, 2003 5:38 pm

eonic wrote:Sure

mke2fs /dev/fd0
mount /dev/fd0 /mnt/floppy

...

Great info, eonic!

I think that you can use a loopback file instead of a floppy disk... I am working through this today and will post my results when I know more.

watersb · Post by **watersb** » Sat May 24, 2003 6:01 pm

xi wrote:is it possible to use encrypted swap (cryptoloop or loop-aes) with swsusp (suspend to disk) ?

This is an EXCELLENT question -- because of course if you use suspend-to-disk with an unencrypted swap, ANYONE with access to your hard disk can read your memory -- including any kernel structures that hold your keys to the encrypted disk!

The short answer is, No I don't think so -- the reason is that the resume-from-swsup is looking for a standard swap partition.

The new kernel cryptoAPI would permit kernel-land to make the encryption on the swap transparent..

There might be a way to tweak swsup-enabled systems so that you set up a loop before invoking swsup resume, but I rather suspect this would involve some changes to swsup.

I have a laptop, and got interested in disk encryption for exactly the reasons posted on this thread: for a laptop that's relatively easy to steal, if you're not running encrypted disk you should not bother with user and root passwords, either.

Likewise swsup: if you use it and your machine is stolen, hard disk encryption won't matter much, nor will passwords.

So I don't use swsup. I'd certainly like to have it encrypted!

karrots · Post by **karrots** » Sat May 24, 2003 6:16 pm

Skip the floppy image and put the kernel and initrd on the cd directly. Then use ISOLinux to boot the kernel.

http://syslinux.zytor.com/iso.php

Heck if you still want to use a floppy image us ISOLinux in conjunction with memdisk then you can have multiple boot images on one CD. Thats what I do with one of my utilitiy CD's works great.

karrots

watersb · Post by **watersb** » Sat May 24, 2003 9:54 pm

I could not get the XFS filesystem to work well with loop-AES under 2.5.69-mm8; I get I/O errors after a very short while and the filesystem disappears.

I am using reiserfs now and it seems to work fine.

I seem to recall that encrypted loopback systems need to ensure serialized writes, but I thought that restriction applied only to file-backed loops, and I'm using a drive partition (a block device, not a file).

Chadders, do you recall the mkfs.xfs settings that you used?

Has anyone else tried this with 2.5.69?

Naughtyus · Post by **Naughtyus** » Sat May 24, 2003 10:15 pm

Is there any way to get this to work with a passkey file instead of a password?

I would like to have the system boot from CD (as above), but instead of asking for a pass, just look on the CD for a passkey file (or something which effectivly makes the boot secure, and does not require the user to enter anything).

Naughtyus · Post by **Naughtyus** » Sun May 25, 2003 12:35 am

Also - is there any way I can make the password (if not using a GPG key, or whatever) less than 20 characters? Thats overkill for the system I'd like to do this for.

watersb · Post by **watersb** » Sun May 25, 2003 1:02 am

2.5.69-mm8 status report...

Getting close; it loads the initrd.gz that is built by loop-AES/build-initrd.sh -- and then it's getting confused, attempting to mount the partition as a UDF-fs filesystem. I dunno...

I disabled UDF-fs in my kernel, and I'm trying again.

Overall, I am happy that this is closer to working than the cryptoAPI stuff, but I am not happy at the impossibility of debugging the linuxrc script of the init ramdisk!

If I cannot get the loop-AES linuxrc process to work, then I will tweak the ramdisk that I built for 2.4.19 -- my ramdisk is 100x larger, but it gives you an entire Linux distribution in the 300K ramdisk (using uClibc for running on embedded systems). Which means that I can get a shell and manually type some losetup commands...

Grr...

oh, and there's a number of bugs in 2.5.59-mm8 and interactions with all this stuff... but I'm almost there...

watersb · Post by **watersb** » Tue May 27, 2003 1:34 am

I just got CryptoAPI loopback to work with kernel 2.5.69, (by working on a port to 2.5.58 of Adam Richter's cryptoloop by Furwith Clemens.)

This uses the same API in the 2.5.x kernels as the gentoo-sources use in the 2.4 series -- and what's even better (in my opinion), in 2.5 it uses the new overall kernel infrastructure for crypto, so there is ONE place for all of the cipher implementations.

This CryptoAPI stuff is a slightly different approach that Jaari's loop-AES, but the two should converge at some point. Anyway I'm happy that I got it to work.

For the question of which is the better API, I would have to answer, "the one that works the most reliably". The CryptoAPI-loop developers have all wandered off in the past couple of months, at least they are not actively answering e-mail the way that Jaari does! I suspect that they have more-pressing kernel work to get done; AdamJ is also working on the re-work of devfs, which is more important. And so on.

I will be testing my CryptoAPI loopback for a while. Here's hoping...

If it works, the next step will be to work with Jaari to get the changes included into util-linux; Jarri's util-linux extensions are nice, providing GPG support and password "salt". But his extensions are rather loop-AES oriented. I think that it can converge without too much more work, though.

chadders · Post by **chadders** » Tue May 27, 2003 2:12 am

HI watersb! I didnt use anything special on my mkfs.xfs and used the defaults. Only problem I had is I can't make aespipe work and I don't know why. I only used xfs for my root because I wanted to check it out. My big encrypted partition where most of my stuff is at is reiserfs just because its been that way for a long time and I didnt want to reload everything yet.

I'm thinking about trying out crypto-api again because I want to use 2.5 kernels. I tried loop-AES on 2.5.something a while ago and it didnt work too good. Do you think crypto-API is stable enough now?

Chad

watersb · Post by **watersb** » Sat May 31, 2003 12:43 am

chadders wrote:HI watersb! I didnt use anything special on my mkfs.xfs and used the defaults.

OK, thanks, I get it... your XFS partition is NOT encrypted, right? I had horrible I/O errors with encrypted XFS under 2.5.69-bk18, with both loop-AES and cryptoAPI.

I'm thinking about trying out crypto-api again because I want to use 2.5 kernels. I tried loop-AES on 2.5.something a while ago and it didnt work too good. Do you think crypto-API is stable enough now?

Do I think it's stable enough now... um, no. It seems to work for me, and it seems like a relatively small layer on top of the CryptoAPI, but things could break in the next kernel release (which I will try Real Soon Now).

I'd like it to say it works, but I posted my patches for 2.5.69-bk18 to the cryptoapi-devel list on Monday and so far have received NO response. But Jari Ruusu, the loop-AES guy, has been exchanging emails with me all week.

If you would like to test this CryptoAPI, then you can get the patches here:

http://www.kerneli.org/pipermail/crypto ... 00562.html

If I understand correctly, you will NOT be able to use the same kernel for both loop-AES and CryptoAPI disk encryption. So make a new kernel with "loopback devices" enabled in BLOCK devices, and enable the CryptoAPI. You'll also want to enable the "Encryption for Loopback devices" option.

I build a kernel, rebooted with it, and then loaded modules for twofish, loop, and cryptoloop. Then I used a patched version of util-linux-2.11y (pulled from kerneli.org CVS, then patched with the patch that I refined and tested), compiled a new losetup and mount, and then used those to mount the loopback devices.

Jari is trying to help me get the initrd (initial RAM disk) to work with the recent 2.5 kernel, so stay tuned...

TinheadNed · Post by **TinheadNed** » Sat May 31, 2003 12:54 pm

Has anybody had problems getting the initial ramdisk to mount the boot partition?

I am really confused as to the problem, but it just tells me that mounting /dev/hda2 as /lib failed, and shuts down. The boot partition is (obviously) not encrypted, and on ext3. Ext3 and ext2 support are in the kernel. Grub can read off the boot partition to load the kernel and initrd so i'm very confused. I might unencrypt my HD again (it'll only take 20 minutes) but it just seems a bit of a waste.

viperlin · Post by **viperlin** » Sat May 31, 2003 2:33 pm

been folowing this fr a while but this is my forst post, so well done on this tutorial and i'm 15 myself and fixed the devfs problem pretty quickly after reading a little.

i was wondering if anybody has tryed this with a framebuffer image (tutorials on this forum http://forums.gentoo.org/viewtopic.php?t=49036 and on http://www.bootsplash.org, as the framebuffer requires:

Code: Select all

Code maturity level options  --->
    [*] Prompt for development and/or incomplete code/drivers
Processor type and features  --->
    [*] MTRR (Memory Type Range Register) support
Block Devices ->
    [*] Loopback device support
    [*] RAM disk support
    (4096)   Default RAM disk size
    [*] Initial RAM disk (initrd) support
Console Drivers ->
    [*] VGA text console
    [*] Video mode selection support
Frame-buffer support ->
    [*] Support for frame buffer devices
    [*] VESA VGA graphics console
    [*] Use splash screen instead of boot logo

it also requires a special initrd file which contains the framebuffer theme loaded at boot, so i assume you cannot have a framebuffer image and encrypted harddrive, unless 2 initrd's are allowed. i will experiment with this but i assume that since one requires loopback devices enabled and one requires it disabled.

hope that made sence.

Aonoa · Post by **Aonoa** » Sat May 31, 2003 8:02 pm

I already had a system using framebuffer and a bootsplash, then when encrypting i changed the initrd entry in grub with the one I made using the encrypt howto. (I still kept my original bootsplash initrd file)

So I have a system that boots from cd-rom with framebuffer support and when it finishes the boot process and awaits login, it inserts the background picture.

I would however like to be able to maybe merge the two initrd's to get the image displayed during boot, but maybe that will make the image too large? I've not investigated how to do this yet if it is possible, rather busy at school with a large project.

As I don't have the time, it would be awesome if someone figured it out.

TinheadNed · Post by **TinheadNed** » Sat May 31, 2003 10:44 pm

Right, I sovled my failed to mount /lib errors (missed the do not mount devfs at boot bit in there), but now I'm stuck on a second problem which recompiling the source and kernel has not helped. I've also tried compiling the encrypted loopback driver into the kernel with no difference.

Now it (presumably) correctly mounts the boot partition, but all it says is "could not open initial console" and halts again. I have absolutely no idea where this comes from in the source for build-initrd, it only appears to open /dev/console after mounting the root partition (which I never get asked the password for), so it seems to be doing it before trying to mount any other drives.

Any ideas? My laptop is only usable as a chrooted Knoppix install right now, which as you can imagine is a bit of a shame.

chadders · Post by **chadders** » Mon Jun 02, 2003 3:05 am

watersb wrote:
OK, thanks, I get it... your XFS partition is NOT encrypted, right? I had horrible I/O errors with encrypted XFS under 2.5.69-bk18, with both loop-AES and cryptoAPI.

My root is XFS and it IS encrypted. I havent had any troubles with it.

Thanks for patches im trying it out now.

Chad

Ian · Post by **Ian** » Mon Jun 02, 2003 6:48 pm

If I set this up on a home file/web server, would it automatically decrypt when sending files out over the network?

I'm basically doing this for the hell of it, and I heavily use samba with the machine i'll be testing it on (well, I will be, when ever i get some free time to set it up :p). I want to make sure that if a user logs in, they'll be able to read files like normal. i assume this is so, but i'd like confirmation. hell, i'll probably go do it anyways. i can always decrypt/reinstall :p.

barlad · Post by **barlad** » Mon Jun 02, 2003 7:40 pm

Sure you won't have any problem at all. Like it was previously said, it is totally transparent to any user.

Ian · Post by **Ian** » Mon Jun 02, 2003 8:16 pm

ok, i figured as much, and by now it's really too late, cause i've already started encrypting my system :p.

as i finish up this system though, i will be moving /dev/hda to /dev/hde, and adding /dev/hdg, and i'm not sure if this will pose any problems. the reason it starts at 'e', is because i have a ultra 100 controller, and it's currently in use in the first server that my dad is stealing in a week or so. i could leave hda as hda, and just add in the second harddrive as hde (on the controller), but i'd like it all at higher speeds, as it does help when transfering files over the network.

also, if i can't move the first hard drive, i'd still like to encrypt the second. can i use the instructions to encrypt /usr to encrypt the second hard drive?

watersb · Post by **watersb** » Thu Jun 05, 2003 5:04 pm

TinheadNed wrote: Now it (presumably) correctly mounts the boot partition, but all it says is "could not open initial console" and halts again. I have absolutely no idea where this comes from in the source for build-initrd, it only appears to open /dev/console after mounting the root partition (which I never get asked the password for), so it seems to be doing it before trying to mount any other drives.

This sounds like a /dev/vc/... issue to me.

Since you are not mounting devfs automatically, the initrd might be trying to look at device files that are not there; under 2.5.70 I ran into this, since it is best not to mount devfs upon boot... my /etc/inittab has lines in it like this:

Code: Select all

# TERMINALS
c1:12345:respawn:/sbin/agetty 38400 vc/1 liunx
c2:12345:respawn:/sbin/agetty 38400 vc/2 liunx

Note that the terminal devices are listed as "vc/1"... not "tty0" (or some other thing).

I don't know for certain that this is your problem, but I am running into problems with the initrd under 2.5.x and I think that this might be part of it.

I suspect that the build-initrd script needs some work before it is reliable with devfs. Not certain.

I hope this is not confusing the issue...

Spider · Post by **Spider** » Thu Jun 05, 2003 9:24 pm

those who had problems getting the initrd to load properly, heres a hint from the developers:

http://mail.nl.linux.org/linux-crypto/2 ... 00122.html

bryon · Post by **bryon** » Fri Jun 06, 2003 6:56 am

Has anyone figured out how to get /boot on a USB drive to work yet?

watersb · Post by **watersb** » Sat Jun 07, 2003 5:39 am

bryon wrote:Has anyone figured out how to get /boot on a USB drive to work yet?

Check this out...
http://forums.gentoo.org/viewtopic.php?t=57754

Your system needs to support bootable USB devices from the BIOS...

watersb · Post by **watersb** » Sat Jun 07, 2003 5:41 am

Spider wrote:those who had problems getting the initrd to load properly, heres a hint from the developers:

http://mail.nl.linux.org/linux-crypto/2 ... 00122.html

Thanks! That wasn't it... still trying...

Encrypted Root File System, Swap, etc...

CD Booting

CryptoAPI in 2.5.69

Mounting the boot partition

hints

usb dirve?

Re: usb dirve?

Re: hints