特殊:Badtitle/NS100:FullDiskEncryptionHowto：修订间差异

2007年12月6日 (四) 10:33的版本

文章出处:

{{#if: | {{{2}}} | https://help.ubuntu.com/community/FullDiskEncryptionHowto }}

点击翻译:

English {{#ifexist: {{#if: UbuntuHelp:FullDiskEncryptionHowto | UbuntuHelp:FullDiskEncryptionHowto | {{#if: | :}}FullDiskEncryptionHowto}}/af | • {{#if: UbuntuHelp:FullDiskEncryptionHowto|Afrikaans| [[::FullDiskEncryptionHowto/af|Afrikaans]]}}|}} {{#ifexist: {{#if: UbuntuHelp:FullDiskEncryptionHowto | UbuntuHelp:FullDiskEncryptionHowto | {{#if: | :}}FullDiskEncryptionHowto}}/ar | • {{#if: UbuntuHelp:FullDiskEncryptionHowto|العربية| [[::FullDiskEncryptionHowto/ar|العربية]]}}|}} {{#ifexist: {{#if: UbuntuHelp:FullDiskEncryptionHowto | UbuntuHelp:FullDiskEncryptionHowto | {{#if: | :}}FullDiskEncryptionHowto}}/az | • {{#if: UbuntuHelp:FullDiskEncryptionHowto|azərbaycanca| [[::FullDiskEncryptionHowto/az|azərbaycanca]]}}|}} {{#ifexist: {{#if: UbuntuHelp:FullDiskEncryptionHowto | UbuntuHelp:FullDiskEncryptionHowto | {{#if: | :}}FullDiskEncryptionHowto}}/bcc | • {{#if: UbuntuHelp:FullDiskEncryptionHowto|جهلسری بلوچی| [[::FullDiskEncryptionHowto/bcc|جهلسری بلوچی]]}}|}} {{#ifexist: {{#if: UbuntuHelp:FullDiskEncryptionHowto | UbuntuHelp:FullDiskEncryptionHowto | {{#if: | :}}FullDiskEncryptionHowto}}/bg | • {{#if: UbuntuHelp:FullDiskEncryptionHowto|български| [[::FullDiskEncryptionHowto/bg|български]]}}|}} {{#ifexist: {{#if: UbuntuHelp:FullDiskEncryptionHowto | UbuntuHelp:FullDiskEncryptionHowto | {{#if: | :}}FullDiskEncryptionHowto}}/br | • {{#if: UbuntuHelp:FullDiskEncryptionHowto|brezhoneg| [[::FullDiskEncryptionHowto/br|brezhoneg]]}}|}} {{#ifexist: {{#if: UbuntuHelp:FullDiskEncryptionHowto | UbuntuHelp:FullDiskEncryptionHowto | {{#if: | :}}FullDiskEncryptionHowto}}/ca | • {{#if: UbuntuHelp:FullDiskEncryptionHowto|català| [[::FullDiskEncryptionHowto/ca|català]]}}|}} {{#ifexist: {{#if: UbuntuHelp:FullDiskEncryptionHowto | UbuntuHelp:FullDiskEncryptionHowto | {{#if: | :}}FullDiskEncryptionHowto}}/cs | • {{#if: UbuntuHelp:FullDiskEncryptionHowto|čeština| [[::FullDiskEncryptionHowto/cs|čeština]]}}|}} {{#ifexist: {{#if: UbuntuHelp:FullDiskEncryptionHowto | UbuntuHelp:FullDiskEncryptionHowto | {{#if: | :}}FullDiskEncryptionHowto}}/de | • {{#if: UbuntuHelp:FullDiskEncryptionHowto|Deutsch| [[::FullDiskEncryptionHowto/de|Deutsch]]}}|}} {{#ifexist: {{#if: UbuntuHelp:FullDiskEncryptionHowto | UbuntuHelp:FullDiskEncryptionHowto | {{#if: | :}}FullDiskEncryptionHowto}}/el | • {{#if: UbuntuHelp:FullDiskEncryptionHowto|Ελληνικά| [[::FullDiskEncryptionHowto/el|Ελληνικά]]}}|}} {{#ifexist: {{#if: UbuntuHelp:FullDiskEncryptionHowto | UbuntuHelp:FullDiskEncryptionHowto | {{#if: | :}}FullDiskEncryptionHowto}}/es | • {{#if: UbuntuHelp:FullDiskEncryptionHowto|español| [[::FullDiskEncryptionHowto/es|español]]}}|}} {{#ifexist: {{#if: UbuntuHelp:FullDiskEncryptionHowto | UbuntuHelp:FullDiskEncryptionHowto | {{#if: | :}}FullDiskEncryptionHowto}}/fa | • {{#if: UbuntuHelp:FullDiskEncryptionHowto|فارسی| [[::FullDiskEncryptionHowto/fa|فارسی]]}}|}} {{#ifexist: {{#if: UbuntuHelp:FullDiskEncryptionHowto | UbuntuHelp:FullDiskEncryptionHowto | {{#if: | :}}FullDiskEncryptionHowto}}/fi | • {{#if: UbuntuHelp:FullDiskEncryptionHowto|suomi| [[::FullDiskEncryptionHowto/fi|suomi]]}}|}} {{#ifexist: {{#if: UbuntuHelp:FullDiskEncryptionHowto | UbuntuHelp:FullDiskEncryptionHowto | {{#if: | :}}FullDiskEncryptionHowto}}/fr | • {{#if: UbuntuHelp:FullDiskEncryptionHowto|français| [[::FullDiskEncryptionHowto/fr|français]]}}|}} {{#ifexist: {{#if: UbuntuHelp:FullDiskEncryptionHowto | UbuntuHelp:FullDiskEncryptionHowto | {{#if: | :}}FullDiskEncryptionHowto}}/gu | • {{#if: UbuntuHelp:FullDiskEncryptionHowto|ગુજરાતી| [[::FullDiskEncryptionHowto/gu|ગુજરાતી]]}}|}} {{#ifexist: {{#if: UbuntuHelp:FullDiskEncryptionHowto | UbuntuHelp:FullDiskEncryptionHowto | {{#if: | :}}FullDiskEncryptionHowto}}/he | • {{#if: UbuntuHelp:FullDiskEncryptionHowto|עברית| [[::FullDiskEncryptionHowto/he|עברית]]}}|}} {{#ifexist: {{#if: UbuntuHelp:FullDiskEncryptionHowto | UbuntuHelp:FullDiskEncryptionHowto | {{#if: | :}}FullDiskEncryptionHowto}}/hu | • {{#if: UbuntuHelp:FullDiskEncryptionHowto|magyar| [[::FullDiskEncryptionHowto/hu|magyar]]}}|}} {{#ifexist: {{#if: UbuntuHelp:FullDiskEncryptionHowto | UbuntuHelp:FullDiskEncryptionHowto | {{#if: | :}}FullDiskEncryptionHowto}}/id | • {{#if: UbuntuHelp:FullDiskEncryptionHowto|Bahasa Indonesia| [[::FullDiskEncryptionHowto/id|Bahasa Indonesia]]}}|}} {{#ifexist: {{#if: UbuntuHelp:FullDiskEncryptionHowto | UbuntuHelp:FullDiskEncryptionHowto | {{#if: | :}}FullDiskEncryptionHowto}}/it | • {{#if: UbuntuHelp:FullDiskEncryptionHowto|italiano| [[::FullDiskEncryptionHowto/it|italiano]]}}|}} {{#ifexist: {{#if: UbuntuHelp:FullDiskEncryptionHowto | UbuntuHelp:FullDiskEncryptionHowto | {{#if: | :}}FullDiskEncryptionHowto}}/ja | • {{#if: UbuntuHelp:FullDiskEncryptionHowto|日本語| [[::FullDiskEncryptionHowto/ja|日本語]]}}|}} {{#ifexist: {{#if: UbuntuHelp:FullDiskEncryptionHowto | UbuntuHelp:FullDiskEncryptionHowto | {{#if: | :}}FullDiskEncryptionHowto}}/ko | • {{#if: UbuntuHelp:FullDiskEncryptionHowto|한국어| [[::FullDiskEncryptionHowto/ko|한국어]]}}|}} {{#ifexist: {{#if: UbuntuHelp:FullDiskEncryptionHowto | UbuntuHelp:FullDiskEncryptionHowto | {{#if: | :}}FullDiskEncryptionHowto}}/ksh | • {{#if: UbuntuHelp:FullDiskEncryptionHowto|Ripoarisch| [[::FullDiskEncryptionHowto/ksh|Ripoarisch]]}}|}} {{#ifexist: {{#if: UbuntuHelp:FullDiskEncryptionHowto | UbuntuHelp:FullDiskEncryptionHowto | {{#if: | :}}FullDiskEncryptionHowto}}/mr | • {{#if: UbuntuHelp:FullDiskEncryptionHowto|मराठी| [[::FullDiskEncryptionHowto/mr|मराठी]]}}|}} {{#ifexist: {{#if: UbuntuHelp:FullDiskEncryptionHowto | UbuntuHelp:FullDiskEncryptionHowto | {{#if: | :}}FullDiskEncryptionHowto}}/ms | • {{#if: UbuntuHelp:FullDiskEncryptionHowto|Bahasa Melayu| [[::FullDiskEncryptionHowto/ms|Bahasa Melayu]]}}|}} {{#ifexist: {{#if: UbuntuHelp:FullDiskEncryptionHowto | UbuntuHelp:FullDiskEncryptionHowto | {{#if: | :}}FullDiskEncryptionHowto}}/nl | • {{#if: UbuntuHelp:FullDiskEncryptionHowto|Nederlands| [[::FullDiskEncryptionHowto/nl|Nederlands]]}}|}} {{#ifexist: {{#if: UbuntuHelp:FullDiskEncryptionHowto | UbuntuHelp:FullDiskEncryptionHowto | {{#if: | :}}FullDiskEncryptionHowto}}/no | • {{#if: UbuntuHelp:FullDiskEncryptionHowto|norsk| [[::FullDiskEncryptionHowto/no|norsk]]}}|}} {{#ifexist: {{#if: UbuntuHelp:FullDiskEncryptionHowto | UbuntuHelp:FullDiskEncryptionHowto | {{#if: | :}}FullDiskEncryptionHowto}}/oc | • {{#if: UbuntuHelp:FullDiskEncryptionHowto|occitan| [[::FullDiskEncryptionHowto/oc|occitan]]}}|}} {{#ifexist: {{#if: UbuntuHelp:FullDiskEncryptionHowto | UbuntuHelp:FullDiskEncryptionHowto | {{#if: | :}}FullDiskEncryptionHowto}}/pl | • {{#if: UbuntuHelp:FullDiskEncryptionHowto|polski| [[::FullDiskEncryptionHowto/pl|polski]]}}|}} {{#ifexist: {{#if: UbuntuHelp:FullDiskEncryptionHowto | UbuntuHelp:FullDiskEncryptionHowto | {{#if: | :}}FullDiskEncryptionHowto}}/pt | • {{#if: UbuntuHelp:FullDiskEncryptionHowto|português| [[::FullDiskEncryptionHowto/pt|português]]}}|}} {{#ifexist: {{#if: UbuntuHelp:FullDiskEncryptionHowto | UbuntuHelp:FullDiskEncryptionHowto | {{#if: | :}}FullDiskEncryptionHowto}}/ro | • {{#if: UbuntuHelp:FullDiskEncryptionHowto|română| [[::FullDiskEncryptionHowto/ro|română]]}}|}} {{#ifexist: {{#if: UbuntuHelp:FullDiskEncryptionHowto | UbuntuHelp:FullDiskEncryptionHowto | {{#if: | :}}FullDiskEncryptionHowto}}/ru | • {{#if: UbuntuHelp:FullDiskEncryptionHowto|русский| [[::FullDiskEncryptionHowto/ru|русский]]}}|}} {{#ifexist: {{#if: UbuntuHelp:FullDiskEncryptionHowto | UbuntuHelp:FullDiskEncryptionHowto | {{#if: | :}}FullDiskEncryptionHowto}}/si | • {{#if: UbuntuHelp:FullDiskEncryptionHowto|සිංහල| [[::FullDiskEncryptionHowto/si|සිංහල]]}}|}} {{#ifexist: {{#if: UbuntuHelp:FullDiskEncryptionHowto | UbuntuHelp:FullDiskEncryptionHowto | {{#if: | :}}FullDiskEncryptionHowto}}/sq | • {{#if: UbuntuHelp:FullDiskEncryptionHowto|shqip| [[::FullDiskEncryptionHowto/sq|shqip]]}}|}} {{#ifexist: {{#if: UbuntuHelp:FullDiskEncryptionHowto | UbuntuHelp:FullDiskEncryptionHowto | {{#if: | :}}FullDiskEncryptionHowto}}/sr | • {{#if: UbuntuHelp:FullDiskEncryptionHowto|српски / srpski| [[::FullDiskEncryptionHowto/sr|српски / srpski]]}}|}} {{#ifexist: {{#if: UbuntuHelp:FullDiskEncryptionHowto | UbuntuHelp:FullDiskEncryptionHowto | {{#if: | :}}FullDiskEncryptionHowto}}/sv | • {{#if: UbuntuHelp:FullDiskEncryptionHowto|svenska| [[::FullDiskEncryptionHowto/sv|svenska]]}}|}} {{#ifexist: {{#if: UbuntuHelp:FullDiskEncryptionHowto | UbuntuHelp:FullDiskEncryptionHowto | {{#if: | :}}FullDiskEncryptionHowto}}/th | • {{#if: UbuntuHelp:FullDiskEncryptionHowto|ไทย| [[::FullDiskEncryptionHowto/th|ไทย]]}}|}} {{#ifexist: {{#if: UbuntuHelp:FullDiskEncryptionHowto | UbuntuHelp:FullDiskEncryptionHowto | {{#if: | :}}FullDiskEncryptionHowto}}/tr | • {{#if: UbuntuHelp:FullDiskEncryptionHowto|Türkçe| [[::FullDiskEncryptionHowto/tr|Türkçe]]}}|}} {{#ifexist: {{#if: UbuntuHelp:FullDiskEncryptionHowto | UbuntuHelp:FullDiskEncryptionHowto | {{#if: | :}}FullDiskEncryptionHowto}}/vi | • {{#if: UbuntuHelp:FullDiskEncryptionHowto|Tiếng Việt| [[::FullDiskEncryptionHowto/vi|Tiếng Việt]]}}|}} {{#ifexist: {{#if: UbuntuHelp:FullDiskEncryptionHowto | UbuntuHelp:FullDiskEncryptionHowto | {{#if: | :}}FullDiskEncryptionHowto}}/yue | • {{#if: UbuntuHelp:FullDiskEncryptionHowto|粵語| [[::FullDiskEncryptionHowto/yue|粵語]]}}|}} {{#ifexist: {{#if: UbuntuHelp:FullDiskEncryptionHowto | UbuntuHelp:FullDiskEncryptionHowto | {{#if: | :}}FullDiskEncryptionHowto}}/zh | • {{#if: UbuntuHelp:FullDiskEncryptionHowto|中文| [[::FullDiskEncryptionHowto/zh|中文]]}}|}} {{#ifexist: {{#if: UbuntuHelp:FullDiskEncryptionHowto | UbuntuHelp:FullDiskEncryptionHowto | {{#if: | :}}FullDiskEncryptionHowto}}/zh-hans | • {{#if: UbuntuHelp:FullDiskEncryptionHowto|中文（简体）| [[::FullDiskEncryptionHowto/zh-hans|中文（简体）]]}}|}} {{#ifexist: {{#if: UbuntuHelp:FullDiskEncryptionHowto | UbuntuHelp:FullDiskEncryptionHowto | {{#if: | :}}FullDiskEncryptionHowto}}/zh-hant | • {{#if: UbuntuHelp:FullDiskEncryptionHowto|中文（繁體）| [[::FullDiskEncryptionHowto/zh-hant|中文（繁體）]]}}|}}

{{#ifeq:UbuntuHelp:FullDiskEncryptionHowto|:FullDiskEncryptionHowto|请不要直接编辑翻译本页，本页将定期与来源同步。}}

{{#ifexist: :FullDiskEncryptionHowto/zh | | {{#ifexist: FullDiskEncryptionHowto/zh | | {{#ifeq: {{#titleparts:FullDiskEncryptionHowto|1|-1|}} | zh | | }} }} }} {{#ifeq: {{#titleparts:FullDiskEncryptionHowto|1|-1|}} | zh | | }}

How to set up a fully encrypted disk with Ubuntu

This page describes a way to setup an Ubuntu installation with a encrypted root partition and encrypted Swap.

WARNING! We use the cryptoloop module in this howto. This module has well-known weaknesses. This howto should be adopted to use dm_crypt. If someone tries to implement this howto with dm_crypt, it would be cool if they would change it accordingly.

Encryption with dm_crypt

If you'd like to use the newer and stronger dm_crypt method you should:

sudo apt-get install cryptsetup
sudo modprobe dm_crypt

For each method of encryption, follow the listed howto:

CryptoRoot - `/usr/share/doc/cryptsetup/CryptoRoot.HowTo`
CryptoSwap - `/usr/share/doc/cryptsetup/CryptoSwap.HowTo`
Encrypted non-root HD partition - [1]

Other possibilities are listed at the dm_crypt wiki, including encryption across RAID devices, encrypting only a home directory (slightly harder), and encryption using LUKS: [2]

Encryption with Cryptoloop

Prearrangement

To set up Ubuntu the described way, you will need

a KNOPPIX CD
internet access

Insert the KNOPPIX CD into your computer and boot. Set up KNOPPIX so that it is able to connect to the internet.

Setting up the harddisk

We need three partitions:

Size	Mountpoint	Encrypted?	Purpose
10M	/osloader	NO	Holds the initrd and kernel image needed to mount and load the rest of the system. GRUB will boot from this partition.
*	/	YES	Root partition. Holds a normal Ubuntu installation that will be launched by initrd. The partition size depends on the available harddisk space but shouldn't be smaller than 2G.
*	swap	YES	Swap. The partition size depends on the used RAM.

You can use fdisk to set up the partition table. The results should look similiar to

Disk /dev/hda: 20.0 GB, 20003880960 bytes
255 heads, 63 sectors/track, 2432 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes

   Device Boot      Start         End      Blocks   Id  System
/dev/hda1   *           1           2       16033+  83  Linux
/dev/hda2               3        2312    18555075   83  Linux
/dev/hda3            2313        2432      963900   82  Linux swap / Solaris

Now we check the partition for badblocks while filling it with random garbage, set up the encryption with losetup and format the encrypted partition. We will then mount it to install Ubuntu.

sudo badblocks -c 10240 -s -w -t random -v /dev/hda2
losetup -T -e aes128 /dev/loop0 /dev/hda2
mkreiserfs /dev/loop0
mkdir /mnt/ubuntu
mount /dev/loop0 /mnt/ubuntu

Installing Ubuntu

The installation procedure from KNOPPIX is described in Installation/FromKnoppix. You need a different fstab. Instead of a normal partition, the device for the / mountpoint is /dev/loop0. The swap entry needs more arguments to provide encrypted swap.

/proc           /proc           proc            defaults                0 0
/sys            /sys            sysfs           defaults                0 0

/dev/hda1       /osloader       ext3            defaults,noauto         0 0
/dev/loop0      /               reiserfs        defaults                0 1
/dev/hda3       none            swap            sw,loop=/dev/loop1,encryption=aes128    0 0

/dev/cdrom      /mnt/cdrom      auto            user,noauto,exec,ro     0 0

After setting up the base system, install loop-aes-utils.

apt-get install loop-aes-utils

When installing the kernel and GRUB, quit the GRUB configuration assistent.

Setting up the OS loader

After installing the base system, we set up a small partition that mounts the encrypted root and kicks off init.

mke2fs -j /dev/hda1
mkdir /osloader
mount /dev/hda1 /osloader

Copy the kernel image there.

cp /vmlinuz /osloader/vmlinuz

We need to edit the mkinitrd configuration so that it supports loading the encrypted root partition. First edit /etc/mkinitrd/mkinitrd.conf, set ROOT=probe to ROOT= since it would complain about our /dev/loop0 root. Add some required modules to /etc/mkinitrd/modules:

ide-generic
loop
cryptoloop
aes
sha256
reiserfs

Then we add a script that handles the losetup stuff while booting. Create a file /etc/mkinitrd/scripts/losetup that has the following content:

#!/bin/sh

mknod -m 600 $INITRDDIR/dev/loop0 b 7 0
mknod -m 600 $INITRDDIR/dev/hda2  b 3 2

mkdir $INITRDDIR/loopcheck

cat > $INITRDDIR/scripts/losetup.sh << EOF
#!/bin/sh

mount -nt proc proc proc

losetup -e aes128 /dev/loop0 /dev/hda2
mount -nr /dev/loop0 /loopcheck >/dev/null 2>/dev/null

while [ \$? -ne 0 ]
do
        echo "Try again."
        losetup -d /dev/loop0 2>/dev/null
        losetup -e aes128 /dev/loop0 /dev/hda2
        mount -nr /dev/loop0 /loopcheck >/dev/null 2>/dev/null
done

umount -n /loopcheck

# loop0 = 7, 0
echo 1792 > /proc/sys/kernel/real-root-dev
umount -n proc
EOF

chmod a+x $INITRDDIR/scripts/losetup.sh

chmod a+x /etc/mkinitrd/scripts/losetup

Now generate the initial ram disk with mkinitrd -o /osloader/initrd 2.6.10-5-386. Configure GRUB:

mkdir /osloader/boot
mkdir /osloader/boot/grub

Add /osloader/boot/grub/menu.lst

default 0
timeout 0
title Ubuntu
        root (hd0,0)
        kernel /vmlinuz ro quiet splash root=/dev/loop0 acpi=off nolapic
        initrd /initrd
        boot

Install the MBR by running grub-install --root-directory=/osloader /dev/hda. To make sure the osloader partition is clean, add a little check script to /etc/rcS.d/S00checkosloader.

#!/bin/sh

if [ "`md5sum /dev/hda1`" != "`cat /etc/osloader_checksum`" ]
then

    echo "** FATAL SECURITY ERROR ************************************"
    echo "*                                                          *"
    echo "* The OS loader was modified!                              *"
    echo "* This could have leaked your encryption password. You are *"
    echo "* advised to install a new encryption setup.               *"
    echo "*                                                          *"
    echo "* Press Enter to boot up the system.                       *"
    echo "************************************************************"

    read junk
fi

chmod a+x /etc/rcS.d/S00checkosloader
md5sum /dev/hda1 > /etc/osloader_checksum

Now exit the chroot, reboot and you should have a fully encrypted environment.