特殊:Badtitle/NS100:FullDiskEncryptionHowto:修订间差异
小无编辑摘要 |
小无编辑摘要 |
||
(未显示同一用户的3个中间版本) | |||
第1行: | 第1行: | ||
{{From|https://help.ubuntu.com/community/FullDiskEncryptionHowto}} | {{From|https://help.ubuntu.com/community/FullDiskEncryptionHowto}} | ||
{{Languages|UbuntuHelp:FullDiskEncryptionHowto}} | {{Languages|UbuntuHelp:FullDiskEncryptionHowto}} | ||
<<Include(Tag/NeedsExpansion)>> | |||
<<Include(Tag/StyleCleanup)>> | |||
== How to set up a fully encrypted disk with Ubuntu == | == How to set up a fully encrypted disk with Ubuntu == | ||
This page describes a way to setup an Ubuntu installation with a encrypted root partition and encrypted Swap. | This page describes a way to setup an Ubuntu installation with a encrypted root partition and encrypted Swap. | ||
=== Encryption with the alternate install CD === | |||
There is an option during the ubuntu installation to encrypt the disk you install to. This is probably the easiest way to use this as it's completely integrated and transparent. | |||
=== Encryption with dm_crypt === | === Encryption with dm_crypt === | ||
If you'd like to use the newer and stronger dm_crypt method you should: | If you'd like to use the newer and stronger dm_crypt method you should: | ||
第18行: | 第19行: | ||
Other possibilities are listed at the dm_crypt wiki, including encryption across RAID devices, encrypting only a home directory (slightly harder), and encryption using LUKS: [http://www.saout.de/tikiwiki/tiki-index.php] | Other possibilities are listed at the dm_crypt wiki, including encryption across RAID devices, encrypting only a home directory (slightly harder), and encryption using LUKS: [http://www.saout.de/tikiwiki/tiki-index.php] | ||
=== Encryption with Cryptoloop === | === Encryption with Cryptoloop === | ||
=== Prearrangement === | {|border="1" cellspacing="0" | ||
| WARNING! We use the cryptoloop module in this howto. This module has well-known weaknesses. | |||
|} | |||
==== Prearrangement ==== | |||
To set up Ubuntu the described way, you will need | To set up Ubuntu the described way, you will need | ||
* a KNOPPIX CD | * a KNOPPIX CD | ||
* internet access | * internet access | ||
Insert the KNOPPIX CD into your computer and boot. Set up KNOPPIX so that it is able to connect to the internet. | Insert the KNOPPIX CD into your computer and boot. Set up KNOPPIX so that it is able to connect to the internet. | ||
=== Setting up the harddisk === | ==== Setting up the harddisk ==== | ||
We need three partitions: | We need three partitions: | ||
{|border="1" cellspacing="0" | {|border="1" cellspacing="0" | ||
第38行: | 第42行: | ||
Disk /dev/hda: 20.0 GB, 20003880960 bytes | Disk /dev/hda: 20.0 GB, 20003880960 bytes | ||
255 heads, 63 sectors/track, 2432 cylinders | 255 heads, 63 sectors/track, 2432 cylinders | ||
Units | Units = cylinders of 16065 * 512 = 8225280 bytes | ||
Device Boot Start End Blocks Id System | |||
Device Boot Start End Blocks Id System | |||
/dev/hda1 * 1 2 16033+ 83 Linux | /dev/hda1 * 1 2 16033+ 83 Linux | ||
/dev/hda2 3 2312 18555075 83 Linux | /dev/hda2 3 2312 18555075 83 Linux | ||
第52行: | 第57行: | ||
mount /dev/loop0 /mnt/ubuntu | mount /dev/loop0 /mnt/ubuntu | ||
</nowiki></pre> | </nowiki></pre> | ||
=== Installing Ubuntu === | ==== Installing Ubuntu ==== | ||
The installation procedure from KNOPPIX is described in [[UbuntuHelp:Installation/FromKnoppix#head-d373af719615b01a8733cbea9d477dc493df420c|Installation/FromKnoppix]]. | The installation procedure from KNOPPIX is described in [[UbuntuHelp:Installation/FromKnoppix#head-d373af719615b01a8733cbea9d477dc493df420c|Installation/FromKnoppix]]. | ||
You need a different <code><nowiki>fstab</nowiki></code>. Instead of a normal partition, the device for the <code><nowiki>/</nowiki></code> mountpoint is <code><nowiki>/dev/loop0</nowiki></code>. The swap entry needs more arguments to provide encrypted swap. | You need a different <code><nowiki>fstab</nowiki></code>. Instead of a normal partition, the device for the <code><nowiki>/</nowiki></code> mountpoint is <code><nowiki>/dev/loop0</nowiki></code>. The swap entry needs more arguments to provide encrypted swap. | ||
第58行: | 第63行: | ||
/proc /proc proc defaults 0 0 | /proc /proc proc defaults 0 0 | ||
/sys /sys sysfs defaults 0 0 | /sys /sys sysfs defaults 0 0 | ||
/dev/hda1 /osloader ext3 defaults,noauto 0 0 | /dev/hda1 /osloader ext3 defaults,noauto 0 0 | ||
/dev/loop0 / reiserfs defaults 0 1 | /dev/loop0 / reiserfs defaults 0 1 | ||
/dev/hda3 none swap sw,loop=/dev/loop1,encryption=aes128 0 0 | /dev/hda3 none swap sw,loop=/dev/loop1,encryption=aes128 0 0 | ||
/dev/cdrom /mnt/cdrom auto user,noauto,exec,ro 0 0 | /dev/cdrom /mnt/cdrom auto user,noauto,exec,ro 0 0 | ||
</nowiki></pre> | </nowiki></pre> | ||
第68行: | 第75行: | ||
</nowiki></pre> | </nowiki></pre> | ||
When installing the kernel and GRUB, quit the GRUB configuration assistent. | When installing the kernel and GRUB, quit the GRUB configuration assistent. | ||
=== Setting up the OS loader === | ==== Setting up the OS loader ==== | ||
After installing the base system, we set up a small partition that mounts the encrypted root and kicks off <code><nowiki>init</nowiki></code>. | After installing the base system, we set up a small partition that mounts the encrypted root and kicks off <code><nowiki>init</nowiki></code>. | ||
<pre><nowiki> | <pre><nowiki> | ||
第93行: | 第100行: | ||
<pre><nowiki> | <pre><nowiki> | ||
#!/bin/sh | #!/bin/sh | ||
mknod -m 600 $INITRDDIR/dev/loop0 b 7 0 | mknod -m 600 $INITRDDIR/dev/loop0 b 7 0 | ||
mknod -m 600 $INITRDDIR/dev/hda2 b 3 2 | mknod -m 600 $INITRDDIR/dev/hda2 b 3 2 | ||
mkdir $INITRDDIR/loopcheck | mkdir $INITRDDIR/loopcheck | ||
cat > $INITRDDIR/scripts/losetup.sh << EOF | cat > $INITRDDIR/scripts/losetup.sh << EOF | ||
#!/bin/sh | #!/bin/sh | ||
mount -nt proc proc proc | mount -nt proc proc proc | ||
losetup -e aes128 /dev/loop0 /dev/hda2 | losetup -e aes128 /dev/loop0 /dev/hda2 | ||
mount -nr /dev/loop0 /loopcheck >/dev/null 2>/dev/null | mount -nr /dev/loop0 /loopcheck >/dev/null 2>/dev/null | ||
while [ \$? -ne 0 ] | while [ \$? -ne 0 ] | ||
do | do | ||
echo "Try again." | echo "Try again." | ||
losetup -d /dev/loop0 2>/dev/null | losetup -d /dev/loop0 2>/dev/null | ||
losetup -e aes128 /dev/loop0 /dev/hda2 | losetup -e aes128 /dev/loop0 /dev/hda2 | ||
mount -nr /dev/loop0 /loopcheck >/dev/null 2>/dev/null | mount -nr /dev/loop0 /loopcheck >/dev/null 2>/dev/null | ||
done | done | ||
umount -n /loopcheck | umount -n /loopcheck | ||
# loop0 = 7, 0 | # loop0 = 7, 0 | ||
echo 1792 > /proc/sys/kernel/real-root-dev | echo 1792 > /proc/sys/kernel/real-root-dev | ||
umount -n proc | umount -n proc | ||
EOF | EOF | ||
chmod a+x $INITRDDIR/scripts/losetup.sh | chmod a+x $INITRDDIR/scripts/losetup.sh | ||
</nowiki></pre> | </nowiki></pre> | ||
第129行: | 第145行: | ||
timeout 0 | timeout 0 | ||
title Ubuntu | title Ubuntu | ||
root (hd0,0) | root (hd0,0) | ||
kernel /vmlinuz ro quiet splash root=/dev/loop0 acpi=off nolapic | kernel /vmlinuz ro quiet splash root=/dev/loop0 acpi=off nolapic | ||
initrd /initrd | initrd /initrd | ||
boot | boot | ||
</nowiki></pre> | </nowiki></pre> | ||
Install the MBR by running <code><nowiki>grub-install --root-directory=/osloader /dev/hda</nowiki></code>. | Install the MBR by running <code><nowiki>grub-install --root-directory=/osloader /dev/hda</nowiki></code>. | ||
第138行: | 第154行: | ||
<pre><nowiki> | <pre><nowiki> | ||
#!/bin/sh | #!/bin/sh | ||
if [ "`md5sum /dev/hda1`" != "`cat /etc/osloader_checksum`" ] | if [ "`md5sum /dev/hda1`" != "`cat /etc/osloader_checksum`" ] | ||
then | then | ||
echo "** FATAL SECURITY ERROR ************************************" | |||
echo "* *" | echo "** FATAL SECURITY ERROR ************************************" | ||
echo "* The OS loader was modified! *" | echo "* *" | ||
echo "* This could have leaked your encryption password. You are *" | echo "* The OS loader was modified! *" | ||
echo "* advised to install a new encryption setup. *" | echo "* This could have leaked your encryption password. You are *" | ||
echo "* *" | echo "* advised to install a new encryption setup. *" | ||
echo "* Press Enter to boot up the system. *" | echo "* *" | ||
echo "************************************************************" | echo "* Press Enter to boot up the system. *" | ||
read junk | echo "************************************************************" | ||
read junk | |||
fi | fi | ||
</nowiki></pre> | </nowiki></pre> | ||
第157行: | 第176行: | ||
Now exit the chroot, reboot and you should have a fully encrypted environment. | Now exit the chroot, reboot and you should have a fully encrypted environment. | ||
---- | ---- | ||
[[category:UbuntuHelp]] | [[category:UbuntuHelp]] |
2008年10月19日 (日) 22:58的最新版本
文章出处: |
{{#if: | {{{2}}} | https://help.ubuntu.com/community/FullDiskEncryptionHowto }} |
点击翻译: |
English {{#ifexist: {{#if: UbuntuHelp:FullDiskEncryptionHowto | UbuntuHelp:FullDiskEncryptionHowto | {{#if: | :}}FullDiskEncryptionHowto}}/af | • {{#if: UbuntuHelp:FullDiskEncryptionHowto|Afrikaans| [[::FullDiskEncryptionHowto/af|Afrikaans]]}}|}} {{#ifexist: {{#if: UbuntuHelp:FullDiskEncryptionHowto | UbuntuHelp:FullDiskEncryptionHowto | {{#if: | :}}FullDiskEncryptionHowto}}/ar | • {{#if: UbuntuHelp:FullDiskEncryptionHowto|العربية| [[::FullDiskEncryptionHowto/ar|العربية]]}}|}} {{#ifexist: {{#if: UbuntuHelp:FullDiskEncryptionHowto | UbuntuHelp:FullDiskEncryptionHowto | {{#if: | :}}FullDiskEncryptionHowto}}/az | • {{#if: UbuntuHelp:FullDiskEncryptionHowto|azərbaycanca| [[::FullDiskEncryptionHowto/az|azərbaycanca]]}}|}} {{#ifexist: {{#if: UbuntuHelp:FullDiskEncryptionHowto | UbuntuHelp:FullDiskEncryptionHowto | {{#if: | :}}FullDiskEncryptionHowto}}/bcc | • {{#if: UbuntuHelp:FullDiskEncryptionHowto|جهلسری بلوچی| [[::FullDiskEncryptionHowto/bcc|جهلسری بلوچی]]}}|}} {{#ifexist: {{#if: UbuntuHelp:FullDiskEncryptionHowto | UbuntuHelp:FullDiskEncryptionHowto | {{#if: | :}}FullDiskEncryptionHowto}}/bg | • {{#if: UbuntuHelp:FullDiskEncryptionHowto|български| [[::FullDiskEncryptionHowto/bg|български]]}}|}} {{#ifexist: {{#if: UbuntuHelp:FullDiskEncryptionHowto | UbuntuHelp:FullDiskEncryptionHowto | {{#if: | :}}FullDiskEncryptionHowto}}/br | • {{#if: UbuntuHelp:FullDiskEncryptionHowto|brezhoneg| [[::FullDiskEncryptionHowto/br|brezhoneg]]}}|}} {{#ifexist: {{#if: UbuntuHelp:FullDiskEncryptionHowto | UbuntuHelp:FullDiskEncryptionHowto | {{#if: | :}}FullDiskEncryptionHowto}}/ca | • {{#if: UbuntuHelp:FullDiskEncryptionHowto|català| [[::FullDiskEncryptionHowto/ca|català]]}}|}} {{#ifexist: {{#if: UbuntuHelp:FullDiskEncryptionHowto | UbuntuHelp:FullDiskEncryptionHowto | {{#if: | :}}FullDiskEncryptionHowto}}/cs | • {{#if: UbuntuHelp:FullDiskEncryptionHowto|čeština| [[::FullDiskEncryptionHowto/cs|čeština]]}}|}} {{#ifexist: {{#if: UbuntuHelp:FullDiskEncryptionHowto | UbuntuHelp:FullDiskEncryptionHowto | {{#if: | :}}FullDiskEncryptionHowto}}/de | • {{#if: UbuntuHelp:FullDiskEncryptionHowto|Deutsch| [[::FullDiskEncryptionHowto/de|Deutsch]]}}|}} {{#ifexist: {{#if: UbuntuHelp:FullDiskEncryptionHowto | UbuntuHelp:FullDiskEncryptionHowto | {{#if: | :}}FullDiskEncryptionHowto}}/el | • {{#if: UbuntuHelp:FullDiskEncryptionHowto|Ελληνικά| [[::FullDiskEncryptionHowto/el|Ελληνικά]]}}|}} {{#ifexist: {{#if: UbuntuHelp:FullDiskEncryptionHowto | UbuntuHelp:FullDiskEncryptionHowto | {{#if: | :}}FullDiskEncryptionHowto}}/es | • {{#if: UbuntuHelp:FullDiskEncryptionHowto|español| [[::FullDiskEncryptionHowto/es|español]]}}|}} {{#ifexist: {{#if: UbuntuHelp:FullDiskEncryptionHowto | UbuntuHelp:FullDiskEncryptionHowto | {{#if: | :}}FullDiskEncryptionHowto}}/fa | • {{#if: UbuntuHelp:FullDiskEncryptionHowto|فارسی| [[::FullDiskEncryptionHowto/fa|فارسی]]}}|}} {{#ifexist: {{#if: UbuntuHelp:FullDiskEncryptionHowto | UbuntuHelp:FullDiskEncryptionHowto | {{#if: | :}}FullDiskEncryptionHowto}}/fi | • {{#if: UbuntuHelp:FullDiskEncryptionHowto|suomi| [[::FullDiskEncryptionHowto/fi|suomi]]}}|}} {{#ifexist: {{#if: UbuntuHelp:FullDiskEncryptionHowto | UbuntuHelp:FullDiskEncryptionHowto | {{#if: | :}}FullDiskEncryptionHowto}}/fr | • {{#if: UbuntuHelp:FullDiskEncryptionHowto|français| [[::FullDiskEncryptionHowto/fr|français]]}}|}} {{#ifexist: {{#if: UbuntuHelp:FullDiskEncryptionHowto | UbuntuHelp:FullDiskEncryptionHowto | {{#if: | :}}FullDiskEncryptionHowto}}/gu | • {{#if: UbuntuHelp:FullDiskEncryptionHowto|ગુજરાતી| [[::FullDiskEncryptionHowto/gu|ગુજરાતી]]}}|}} {{#ifexist: {{#if: UbuntuHelp:FullDiskEncryptionHowto | UbuntuHelp:FullDiskEncryptionHowto | {{#if: | :}}FullDiskEncryptionHowto}}/he | • {{#if: UbuntuHelp:FullDiskEncryptionHowto|עברית| [[::FullDiskEncryptionHowto/he|עברית]]}}|}} {{#ifexist: {{#if: UbuntuHelp:FullDiskEncryptionHowto | UbuntuHelp:FullDiskEncryptionHowto | {{#if: | :}}FullDiskEncryptionHowto}}/hu | • {{#if: UbuntuHelp:FullDiskEncryptionHowto|magyar| [[::FullDiskEncryptionHowto/hu|magyar]]}}|}} {{#ifexist: {{#if: UbuntuHelp:FullDiskEncryptionHowto | UbuntuHelp:FullDiskEncryptionHowto | {{#if: | :}}FullDiskEncryptionHowto}}/id | • {{#if: UbuntuHelp:FullDiskEncryptionHowto|Bahasa Indonesia| [[::FullDiskEncryptionHowto/id|Bahasa Indonesia]]}}|}} {{#ifexist: {{#if: UbuntuHelp:FullDiskEncryptionHowto | UbuntuHelp:FullDiskEncryptionHowto | {{#if: | :}}FullDiskEncryptionHowto}}/it | • {{#if: UbuntuHelp:FullDiskEncryptionHowto|italiano| [[::FullDiskEncryptionHowto/it|italiano]]}}|}} {{#ifexist: {{#if: UbuntuHelp:FullDiskEncryptionHowto | UbuntuHelp:FullDiskEncryptionHowto | {{#if: | :}}FullDiskEncryptionHowto}}/ja | • {{#if: UbuntuHelp:FullDiskEncryptionHowto|日本語| [[::FullDiskEncryptionHowto/ja|日本語]]}}|}} {{#ifexist: {{#if: UbuntuHelp:FullDiskEncryptionHowto | UbuntuHelp:FullDiskEncryptionHowto | {{#if: | :}}FullDiskEncryptionHowto}}/ko | • {{#if: UbuntuHelp:FullDiskEncryptionHowto|한국어| [[::FullDiskEncryptionHowto/ko|한국어]]}}|}} {{#ifexist: {{#if: UbuntuHelp:FullDiskEncryptionHowto | UbuntuHelp:FullDiskEncryptionHowto | {{#if: | :}}FullDiskEncryptionHowto}}/ksh | • {{#if: UbuntuHelp:FullDiskEncryptionHowto|Ripoarisch| [[::FullDiskEncryptionHowto/ksh|Ripoarisch]]}}|}} {{#ifexist: {{#if: UbuntuHelp:FullDiskEncryptionHowto | UbuntuHelp:FullDiskEncryptionHowto | {{#if: | :}}FullDiskEncryptionHowto}}/mr | • {{#if: UbuntuHelp:FullDiskEncryptionHowto|मराठी| [[::FullDiskEncryptionHowto/mr|मराठी]]}}|}} {{#ifexist: {{#if: UbuntuHelp:FullDiskEncryptionHowto | UbuntuHelp:FullDiskEncryptionHowto | {{#if: | :}}FullDiskEncryptionHowto}}/ms | • {{#if: UbuntuHelp:FullDiskEncryptionHowto|Bahasa Melayu| [[::FullDiskEncryptionHowto/ms|Bahasa Melayu]]}}|}} {{#ifexist: {{#if: UbuntuHelp:FullDiskEncryptionHowto | UbuntuHelp:FullDiskEncryptionHowto | {{#if: | :}}FullDiskEncryptionHowto}}/nl | • {{#if: UbuntuHelp:FullDiskEncryptionHowto|Nederlands| [[::FullDiskEncryptionHowto/nl|Nederlands]]}}|}} {{#ifexist: {{#if: UbuntuHelp:FullDiskEncryptionHowto | UbuntuHelp:FullDiskEncryptionHowto | {{#if: | :}}FullDiskEncryptionHowto}}/no | • {{#if: UbuntuHelp:FullDiskEncryptionHowto|norsk| [[::FullDiskEncryptionHowto/no|norsk]]}}|}} {{#ifexist: {{#if: UbuntuHelp:FullDiskEncryptionHowto | UbuntuHelp:FullDiskEncryptionHowto | {{#if: | :}}FullDiskEncryptionHowto}}/oc | • {{#if: UbuntuHelp:FullDiskEncryptionHowto|occitan| [[::FullDiskEncryptionHowto/oc|occitan]]}}|}} {{#ifexist: {{#if: UbuntuHelp:FullDiskEncryptionHowto | UbuntuHelp:FullDiskEncryptionHowto | {{#if: | :}}FullDiskEncryptionHowto}}/pl | • {{#if: UbuntuHelp:FullDiskEncryptionHowto|polski| [[::FullDiskEncryptionHowto/pl|polski]]}}|}} {{#ifexist: {{#if: UbuntuHelp:FullDiskEncryptionHowto | UbuntuHelp:FullDiskEncryptionHowto | {{#if: | :}}FullDiskEncryptionHowto}}/pt | • {{#if: UbuntuHelp:FullDiskEncryptionHowto|português| [[::FullDiskEncryptionHowto/pt|português]]}}|}} {{#ifexist: {{#if: UbuntuHelp:FullDiskEncryptionHowto | UbuntuHelp:FullDiskEncryptionHowto | {{#if: | :}}FullDiskEncryptionHowto}}/ro | • {{#if: UbuntuHelp:FullDiskEncryptionHowto|română| [[::FullDiskEncryptionHowto/ro|română]]}}|}} {{#ifexist: {{#if: UbuntuHelp:FullDiskEncryptionHowto | UbuntuHelp:FullDiskEncryptionHowto | {{#if: | :}}FullDiskEncryptionHowto}}/ru | • {{#if: UbuntuHelp:FullDiskEncryptionHowto|русский| [[::FullDiskEncryptionHowto/ru|русский]]}}|}} {{#ifexist: {{#if: UbuntuHelp:FullDiskEncryptionHowto | UbuntuHelp:FullDiskEncryptionHowto | {{#if: | :}}FullDiskEncryptionHowto}}/si | • {{#if: UbuntuHelp:FullDiskEncryptionHowto|සිංහල| [[::FullDiskEncryptionHowto/si|සිංහල]]}}|}} {{#ifexist: {{#if: UbuntuHelp:FullDiskEncryptionHowto | UbuntuHelp:FullDiskEncryptionHowto | {{#if: | :}}FullDiskEncryptionHowto}}/sq | • {{#if: UbuntuHelp:FullDiskEncryptionHowto|shqip| [[::FullDiskEncryptionHowto/sq|shqip]]}}|}} {{#ifexist: {{#if: UbuntuHelp:FullDiskEncryptionHowto | UbuntuHelp:FullDiskEncryptionHowto | {{#if: | :}}FullDiskEncryptionHowto}}/sr | • {{#if: UbuntuHelp:FullDiskEncryptionHowto|српски / srpski| [[::FullDiskEncryptionHowto/sr|српски / srpski]]}}|}} {{#ifexist: {{#if: UbuntuHelp:FullDiskEncryptionHowto | UbuntuHelp:FullDiskEncryptionHowto | {{#if: | :}}FullDiskEncryptionHowto}}/sv | • {{#if: UbuntuHelp:FullDiskEncryptionHowto|svenska| [[::FullDiskEncryptionHowto/sv|svenska]]}}|}} {{#ifexist: {{#if: UbuntuHelp:FullDiskEncryptionHowto | UbuntuHelp:FullDiskEncryptionHowto | {{#if: | :}}FullDiskEncryptionHowto}}/th | • {{#if: UbuntuHelp:FullDiskEncryptionHowto|ไทย| [[::FullDiskEncryptionHowto/th|ไทย]]}}|}} {{#ifexist: {{#if: UbuntuHelp:FullDiskEncryptionHowto | UbuntuHelp:FullDiskEncryptionHowto | {{#if: | :}}FullDiskEncryptionHowto}}/tr | • {{#if: UbuntuHelp:FullDiskEncryptionHowto|Türkçe| [[::FullDiskEncryptionHowto/tr|Türkçe]]}}|}} {{#ifexist: {{#if: UbuntuHelp:FullDiskEncryptionHowto | UbuntuHelp:FullDiskEncryptionHowto | {{#if: | :}}FullDiskEncryptionHowto}}/vi | • {{#if: UbuntuHelp:FullDiskEncryptionHowto|Tiếng Việt| [[::FullDiskEncryptionHowto/vi|Tiếng Việt]]}}|}} {{#ifexist: {{#if: UbuntuHelp:FullDiskEncryptionHowto | UbuntuHelp:FullDiskEncryptionHowto | {{#if: | :}}FullDiskEncryptionHowto}}/yue | • {{#if: UbuntuHelp:FullDiskEncryptionHowto|粵語| [[::FullDiskEncryptionHowto/yue|粵語]]}}|}} {{#ifexist: {{#if: UbuntuHelp:FullDiskEncryptionHowto | UbuntuHelp:FullDiskEncryptionHowto | {{#if: | :}}FullDiskEncryptionHowto}}/zh | • {{#if: UbuntuHelp:FullDiskEncryptionHowto|中文| [[::FullDiskEncryptionHowto/zh|中文]]}}|}} {{#ifexist: {{#if: UbuntuHelp:FullDiskEncryptionHowto | UbuntuHelp:FullDiskEncryptionHowto | {{#if: | :}}FullDiskEncryptionHowto}}/zh-hans | • {{#if: UbuntuHelp:FullDiskEncryptionHowto|中文(简体)| [[::FullDiskEncryptionHowto/zh-hans|中文(简体)]]}}|}} {{#ifexist: {{#if: UbuntuHelp:FullDiskEncryptionHowto | UbuntuHelp:FullDiskEncryptionHowto | {{#if: | :}}FullDiskEncryptionHowto}}/zh-hant | • {{#if: UbuntuHelp:FullDiskEncryptionHowto|中文(繁體)| [[::FullDiskEncryptionHowto/zh-hant|中文(繁體)]]}}|}} |
{{#ifeq:UbuntuHelp:FullDiskEncryptionHowto|:FullDiskEncryptionHowto|请不要直接编辑翻译本页,本页将定期与来源同步。}} |
{{#ifexist: :FullDiskEncryptionHowto/zh | | {{#ifexist: FullDiskEncryptionHowto/zh | | {{#ifeq: {{#titleparts:FullDiskEncryptionHowto|1|-1|}} | zh | | }} }} }} {{#ifeq: {{#titleparts:FullDiskEncryptionHowto|1|-1|}} | zh | | }}
<<Include(Tag/NeedsExpansion)>> <<Include(Tag/StyleCleanup)>>
How to set up a fully encrypted disk with Ubuntu
This page describes a way to setup an Ubuntu installation with a encrypted root partition and encrypted Swap.
Encryption with the alternate install CD
There is an option during the ubuntu installation to encrypt the disk you install to. This is probably the easiest way to use this as it's completely integrated and transparent.
Encryption with dm_crypt
If you'd like to use the newer and stronger dm_crypt method you should:
sudo apt-get install cryptsetup sudo modprobe dm_crypt
For each method of encryption, follow the listed howto:
- CryptoRoot - `/usr/share/doc/cryptsetup/CryptoRoot.HowTo`
- CryptoSwap - `/usr/share/doc/cryptsetup/CryptoSwap.HowTo`
- Encrypted non-root HD partition - [1]
Other possibilities are listed at the dm_crypt wiki, including encryption across RAID devices, encrypting only a home directory (slightly harder), and encryption using LUKS: [2]
Encryption with Cryptoloop
WARNING! We use the cryptoloop module in this howto. This module has well-known weaknesses. |
Prearrangement
To set up Ubuntu the described way, you will need
- a KNOPPIX CD
- internet access
Insert the KNOPPIX CD into your computer and boot. Set up KNOPPIX so that it is able to connect to the internet.
Setting up the harddisk
We need three partitions:
Size | Mountpoint | Encrypted? | Purpose |
10M | /osloader | NO | Holds the initrd and kernel image needed to mount and load the rest of the system. GRUB will boot from this partition. |
* | / | YES | Root partition. Holds a normal Ubuntu installation that will be launched by initrd. The partition size depends on the available harddisk space but shouldn't be smaller than 2G. |
* | swap | YES | Swap. The partition size depends on the used RAM. |
You can use fdisk
to set up the partition table. The results should look similiar to
Disk /dev/hda: 20.0 GB, 20003880960 bytes 255 heads, 63 sectors/track, 2432 cylinders Units = cylinders of 16065 * 512 = 8225280 bytes Device Boot Start End Blocks Id System /dev/hda1 * 1 2 16033+ 83 Linux /dev/hda2 3 2312 18555075 83 Linux /dev/hda3 2313 2432 963900 82 Linux swap / Solaris
Now we check the partition for badblocks while filling it with random garbage, set up the encryption with losetup
and format the encrypted partition. We will then mount it to install Ubuntu.
sudo badblocks -c 10240 -s -w -t random -v /dev/hda2 losetup -T -e aes128 /dev/loop0 /dev/hda2 mkreiserfs /dev/loop0 mkdir /mnt/ubuntu mount /dev/loop0 /mnt/ubuntu
Installing Ubuntu
The installation procedure from KNOPPIX is described in Installation/FromKnoppix.
You need a different fstab
. Instead of a normal partition, the device for the /
mountpoint is /dev/loop0
. The swap entry needs more arguments to provide encrypted swap.
/proc /proc proc defaults 0 0 /sys /sys sysfs defaults 0 0 /dev/hda1 /osloader ext3 defaults,noauto 0 0 /dev/loop0 / reiserfs defaults 0 1 /dev/hda3 none swap sw,loop=/dev/loop1,encryption=aes128 0 0 /dev/cdrom /mnt/cdrom auto user,noauto,exec,ro 0 0
After setting up the base system, install loop-aes-utils
.
apt-get install loop-aes-utils
When installing the kernel and GRUB, quit the GRUB configuration assistent.
Setting up the OS loader
After installing the base system, we set up a small partition that mounts the encrypted root and kicks off init
.
mke2fs -j /dev/hda1 mkdir /osloader mount /dev/hda1 /osloader
Copy the kernel image there.
cp /vmlinuz /osloader/vmlinuz
We need to edit the mkinitrd
configuration so that it supports loading the encrypted root partition.
First edit /etc/mkinitrd/mkinitrd.conf
, set ROOT=probe
to ROOT=
since it would complain about our /dev/loop0
root.
Add some required modules to /etc/mkinitrd/modules
:
ide-generic loop cryptoloop aes sha256 reiserfs
Then we add a script that handles the losetup
stuff while booting. Create a file /etc/mkinitrd/scripts/losetup
that has the following content:
#!/bin/sh mknod -m 600 $INITRDDIR/dev/loop0 b 7 0 mknod -m 600 $INITRDDIR/dev/hda2 b 3 2 mkdir $INITRDDIR/loopcheck cat > $INITRDDIR/scripts/losetup.sh << EOF #!/bin/sh mount -nt proc proc proc losetup -e aes128 /dev/loop0 /dev/hda2 mount -nr /dev/loop0 /loopcheck >/dev/null 2>/dev/null while [ \$? -ne 0 ] do echo "Try again." losetup -d /dev/loop0 2>/dev/null losetup -e aes128 /dev/loop0 /dev/hda2 mount -nr /dev/loop0 /loopcheck >/dev/null 2>/dev/null done umount -n /loopcheck # loop0 = 7, 0 echo 1792 > /proc/sys/kernel/real-root-dev umount -n proc EOF chmod a+x $INITRDDIR/scripts/losetup.sh
chmod a+x /etc/mkinitrd/scripts/losetup
Now generate the initial ram disk with mkinitrd -o /osloader/initrd 2.6.10-5-386
.
Configure GRUB:
mkdir /osloader/boot mkdir /osloader/boot/grub
Add /osloader/boot/grub/menu.lst
default 0 timeout 0 title Ubuntu root (hd0,0) kernel /vmlinuz ro quiet splash root=/dev/loop0 acpi=off nolapic initrd /initrd boot
Install the MBR by running grub-install --root-directory=/osloader /dev/hda
.
To make sure the osloader partition is clean, add a little check script to /etc/rcS.d/S00checkosloader
.
#!/bin/sh if [ "`md5sum /dev/hda1`" != "`cat /etc/osloader_checksum`" ] then echo "** FATAL SECURITY ERROR ************************************" echo "* *" echo "* The OS loader was modified! *" echo "* This could have leaked your encryption password. You are *" echo "* advised to install a new encryption setup. *" echo "* *" echo "* Press Enter to boot up the system. *" echo "************************************************************" read junk fi
chmod a+x /etc/rcS.d/S00checkosloader md5sum /dev/hda1 > /etc/osloader_checksum
Now exit the chroot, reboot and you should have a fully encrypted environment.