“UbuntuHelp:EncryptedFilesystemUsingDm-CryptOnDapper”的版本间的差异
来自Ubuntu中文
小 (新页面: {{From|https://help.ubuntu.com/community/EncryptedFilesystemUsingDm-CryptOnDapper}} {{Languages|UbuntuHelp:EncryptedFilesystemUsingDm-CryptOnDapper}} #title Encrypted root and swap partit...) |
(没有差异)
|
2008年12月16日 (二) 18:27的最新版本
点击翻译: |
English |
请不要直接编辑翻译本页,本页将定期与来源同步。 |
- title Encrypted root and swap partition with dm-crypt on Ubuntu 6.06 LTS
{i} Please refer to EncryptedFilesystems for further documentation. |
Highlights of the following guide:
- Uses RSA keys and thus is ready for smartcards (although in this howto
the RSA private key is still stored on disk as encrypted file)
- Password changes are possible. With LUKS that would be possible too (but no smart card support), with cryptsetup it would not.
Encrypting valuable data is very important for many companies, and it feels a lot better if the whole filesystem is encrypted, not only some partitions (e.g. home - what if you start using some webserver, database etc.). Of course a full encryption of root and swap has significant impact on latency for reading/writing and increased cpu usage for that. But for normal desktop it is not a big deal, but if you copy hundereds of MB of data you will notice it. This howto is very long, because you need to do many steps yourself that are normaly done by the automatic installer.
目录
- 1 How to install Ubuntu encrypted
- 1.1 Boot from desktop CD
- 1.2 Start an xterm and get a root shell
- 1.3 Load dm-crypt
- 1.4 Partition the system
- 1.5 Create crypto keys in /tmp (tmpfs, never written anywhere)
- 1.6 Create filesystems
- 1.7 Mount filesystems
- 1.8 Download ar and debootstrap
- 1.9 Install dapper on the crypto root
- 1.10 Create an fstab in the chroot
- 1.11 Create an apt config file in the chroot
- 1.12 Update packages, install dselect and kubuntu-destkop
- 1.13 Configure initramfs-tools for crypt root and swap
- 1.14 Put the crypto keys in place and create a new initramfs
- 1.15 Install grub
- 1.16 Configure grub
- 1.17 Finish installation, reboot
- 2 Tools
- 3 Other changes
How to install Ubuntu encrypted
Boot from desktop CD
Download this text to the ubuntu system, so you can cut and paste. Open in vi (not less, with less you get cut&paste problems on long lines).
Start an xterm and get a root shell
sudo bash
Load dm-crypt
modprobe dm-crypt
Partition the system
cfdisk /dev/sda
# or /dev/hda
Create three partitions:
- first partition: linux, 100mb, bootable (/boot)
- second parition: linux, what you prefer (2GB?) (swap)
- third partition: root, rest of the disk (or leave space - however you prefer)
Do not set the second partition to swap, as ubuntu will automatically enable it and thus cause problems. In this document we will assume:
- /dev/sda1 /boot partition
- /dev/sda2 swap partition
- /dev/sda3 root partition
Create crypto keys in /tmp (tmpfs, never written anywhere)
cd /tmp openssl genrsa -aes256 -out privkey.pem 2048 dd if=/dev/urandom of=swapkey bs=32 count=1 dd if=/dev/urandom of=rootkey bs=32 count=1 openssl rsautl -in swapkey -out swapkey.enc -inkey privkey.pem -encrypt openssl rsautl -in rootkey -out rootkey.enc -inkey privkey.pem -encrypt rm swapkey rootkey SWAPKEY=`openssl rsautl -in swapkey.enc -decrypt -inkey privkey.pem \ | hexdump -e '"" 32/1 "%02x" "\n"'` ROOTKEY=`openssl rsautl -in rootkey.enc -decrypt -inkey privkey.pem \ | hexdump -e '"" 32/1 "%02x" "\n"'` echo 0 `blockdev --getsize /dev/sda2` crypt aes-cbc-essiv:sha256 \ $SWAPKEY 0 /dev/sda2 0 |dmsetup create swap echo 0 `blockdev --getsize /dev/sda3` crypt aes-cbc-essiv:sha256 \ $ROOTKEY 0 /dev/sda3 0 |dmsetup create root
Create filesystems
mkfs.ext3 /dev/sda1 # /boot mkswap /dev/mapper/swap # swap mkfs.ext3 /dev/mapper/root # root
Mount filesystems
mount /dev/mapper/root /mnt mkdir /mnt/boot mount /dev/sda1 /mnt/boot
Download ar and debootstrap
cd /tmp mkdir download cd download wget http://security.ubuntu.com/ubuntu/pool/main/b/binutils/binutils_2.16.1cvs20060117-1ubuntu2.1_i386.deb wget http://de.archive.ubuntu.com/ubuntu/pool/main/d/debootstrap/debootstrap_0.3.3.0ubuntu2_all.deb dpkg -x binutils*deb x dpkg -x debootstrap*deb x
Install dapper on the crypto root
export LD_LIBRARY_PATH=/tmp/download/x/usr/lib export PATH=/tmp/download/x/usr/bin:$PATH export DEBOOTSTRAP_DIR=/tmp/download/x/usr/lib/debootstrap /tmp/download/x/usr/sbin/debootstrap dapper /mnt http://de.archive.ubuntu.com/ubuntu/
Create an fstab in the chroot
chroot /mnt vi /etc/fstab /dev/sda1 /boot ext3 defaults 0 0 /dev/mapper/root / ext3 defaults 0 0 /dev/mapper/swap swap swap defaults 0 0 none /proc proc defaults 0 0 none /proc/bus/usb usbfs defaults 0 0 none /sys sysfs defaults 0 0 none /dev/shm tmpfs defaults 0 0 none /dev/pts devpts defaults 0 0
Create an apt config file in the chroot
chroot /mnt vi /etc/apt/sources.list deb http://de.archive.ubuntu.com/ubuntu/ dapper main restricted deb http://de.archive.ubuntu.com/ubuntu/ dapper-updates main restricted deb http://de.archive.ubuntu.com/ubuntu/ dapper-security main restricted deb-src http://de.archive.ubuntu.com/ubuntu/ dapper main restricted deb-src http://de.archive.ubuntu.com/ubuntu/ dapper-updates main restricted deb-src http://de.archive.ubuntu.com/ubuntu/ dapper-security main restricted
Update packages, install dselect and kubuntu-destkop
chroot /mnt apt-get update apt-get upgrade apt-get install grub linux-image-686 dmsetup bsdmainutils wipe apt-get install kubuntu-desktop
Configure initramfs-tools for crypt root and swap
chroot /mnt cd /etc/mkinitramfs echo dm-crypt >> modules echo aes >> modules echo sha256 >> modules vi hooks/cryptroot (copy till EOF)
hooks/cryptroot
# !/bin/sh . /usr/share/initramfs-tools/hook-functions mkdir -p ${DESTDIR}/boot mkdir -p ${DESTDIR}/sbin mkdir -p ${DESTDIR}/usr/bin cp -p /boot/privkey.pem /boot/rootkey.enc /boot/swapkey.enc ${DESTDIR}/boot copy_exec /sbin/blockdev /sbin copy_exec /sbin/dmsetup /sbin copy_exec /usr/bin/openssl /usr/bin copy_exec /usr/bin/hexdump /usr/bin EOF
chmod +x hooks/cryptroot vi scripts/local-top/cryptroot (copy till EOF)
scripts/local-top/cryptroot
# !/bin/sh PREREQ="udev" # Output pre-requisites prereqs() { echo "$PREREQ" } case "$1" in prereqs) prereqs exit 0 ;; esac modprobe aes modprobe sha256 modprobe dm-crypt echo "Waiting for crypted root device..." slumber=1800 while [ ${slumber} -gt 0 -a ! -e "/dev/sda3" ]; do /bin/sleep 0.1 slumber=$(( ${slumber} - 1 )) done while test -z "$ROOTKEY" do ROOTKEY=`openssl rsautl -in /boot/rootkey.enc -decrypt -inkey /boot/privkey.pem < /dev/tty0 2>/dev/tty0 |hexdump -e '"" 32/1 "%02x" "\n"' ` done SECTORS=`blockdev --getsize /dev/sda3` echo 0 $SECTORS crypt aes-cbc-essiv:sha256 $ROOTKEY 0 /dev/sda3 0 \ |dmsetup create root echo "Waiting for crypted swap device..." slumber=1800 while [ ${slumber} -gt 0 -a ! -e "/dev/sda2" ]; do /bin/sleep 0.1 slumber=$(( ${slumber} - 1 )) done while test -z "$SWAPKEY" do SWAPKEY=`openssl rsautl -in /boot/swapkey.enc -decrypt -inkey /boot/privkey.pem < /dev/tty0 2>/dev/tty0 |hexdump -e '"" 32/1 "%02x" "\n"' ` done SECTORS=`blockdev --getsize /dev/sda2` echo 0 $SECTORS crypt aes-cbc-essiv:sha256 $SWAPKEY 0 /dev/sda2 0 \ |dmsetup create swap EOF
chmod +x scripts/local-top/cryptroot
Put the crypto keys in place and create a new initramfs
mv /tmp/privkey.pem /tmp/swapkey.enc /tmp/rootkey.enc /mnt/boot/ chroot /mnt update-initramfs -u
Install grub
chroot /mnt update-grub apt-get install kubuntu-grub-splashimages cd /boot/grub cp /lib/grub/i386-pc/* . grub root (hd0,0) setup (hd0) quit
Configure grub
- vi /boot/grub/menu.lst
- add "acpi=off"
- change "root=/dev/mapper/root"
- splash (hd0,0)/grub/splashimages/kubuntugood.xpm.gz
- timeout 15
- default 0
- remove all the unwanted settings
- remove all "savedefault" lines
- remove splash as you want a console to enter your password
Finish installation, reboot
umount /mnt/boot fuser -k /mnt umount /mnt sync
press ctrl-alt-del and select reboot
Tools
Change password on rsa key
su root cd /boot openssl rsa -in privkey.pem -out privkey.new.pem -aes256 wipe privkey.pem mv privkey.new.pem privkey.pem update-initramfs -u
Replace rsa key
su root cd /tmp openssl rsautl -in /boot/rootkey.enc -inkey /boot/privkey.pem \ -decrypt -out rootkey openssl rsautl -in /boot/swapkey.enc -inkey /boot/privkey.pem \ -decrypt -out swapkey openssl genrsa -aes256 -out privkey.pem 2048 openssl rsautl -in swapkey -out swapkey.enc -inkey privkey.pem -encrypt openssl rsautl -in rootkey -out rootkey.enc -inkey privkey.pem -encrypt rm swapkey rootkey mv swapkey.enc rootkey.enc privkey.pem boot update-initramfs -u
Recover with bootcd
- boot kubuntu cd
- start xterm
sudo bash mount /dev/sda1 /mnt echo 0 `blockdev --getsize /dev/sda3` crypt aes-cbc-essiv:sha256 \ `openssl rsautl -in /mnt/rootkey.enc -decrypt -inkey \ /mnt/privkey.pem |hexdump -e '"" 32/1 "%02x" "\n"'` \ 0 /dev/sda3 0 | dmsetup create root umount mnt mount /dev/mapper/root /mnt mount /dev/sda1 /mnt/boot chroot /mnt ... update-initramfs -u umount /mnt/boot umount /mnt sync
- press ctrl-alt-del and select reboot
Other changes
Set root password
- boot
- switch to text console
- login as "root" (no password)
- shadowconfig on
- passwd root
Create User
adduser user vigr # add user to dialout, fax, voice, cdrom, floppy, sudo, audio, video, scanner, scard