特殊:Badtitle/NS100:GPGKeyOnUSBDrive
文章出处: |
{{#if: | {{{2}}} | https://help.ubuntu.com/community/GPGKeyOnUSBDrive }} |
点击翻译: |
English {{#ifexist: {{#if: php5 | php5 | {{#if: | :}}GPGKeyOnUSBDrive}}/af | • {{#if: php5|Afrikaans| [[::GPGKeyOnUSBDrive/af|Afrikaans]]}}|}} {{#ifexist: {{#if: php5 | php5 | {{#if: | :}}GPGKeyOnUSBDrive}}/ar | • {{#if: php5|العربية| [[::GPGKeyOnUSBDrive/ar|العربية]]}}|}} {{#ifexist: {{#if: php5 | php5 | {{#if: | :}}GPGKeyOnUSBDrive}}/az | • {{#if: php5|azərbaycanca| [[::GPGKeyOnUSBDrive/az|azərbaycanca]]}}|}} {{#ifexist: {{#if: php5 | php5 | {{#if: | :}}GPGKeyOnUSBDrive}}/bcc | • {{#if: php5|جهلسری بلوچی| [[::GPGKeyOnUSBDrive/bcc|جهلسری بلوچی]]}}|}} {{#ifexist: {{#if: php5 | php5 | {{#if: | :}}GPGKeyOnUSBDrive}}/bg | • {{#if: php5|български| [[::GPGKeyOnUSBDrive/bg|български]]}}|}} {{#ifexist: {{#if: php5 | php5 | {{#if: | :}}GPGKeyOnUSBDrive}}/br | • {{#if: php5|brezhoneg| [[::GPGKeyOnUSBDrive/br|brezhoneg]]}}|}} {{#ifexist: {{#if: php5 | php5 | {{#if: | :}}GPGKeyOnUSBDrive}}/ca | • {{#if: php5|català| [[::GPGKeyOnUSBDrive/ca|català]]}}|}} {{#ifexist: {{#if: php5 | php5 | {{#if: | :}}GPGKeyOnUSBDrive}}/cs | • {{#if: php5|čeština| [[::GPGKeyOnUSBDrive/cs|čeština]]}}|}} {{#ifexist: {{#if: php5 | php5 | {{#if: | :}}GPGKeyOnUSBDrive}}/de | • {{#if: php5|Deutsch| [[::GPGKeyOnUSBDrive/de|Deutsch]]}}|}} {{#ifexist: {{#if: php5 | php5 | {{#if: | :}}GPGKeyOnUSBDrive}}/el | • {{#if: php5|Ελληνικά| [[::GPGKeyOnUSBDrive/el|Ελληνικά]]}}|}} {{#ifexist: {{#if: php5 | php5 | {{#if: | :}}GPGKeyOnUSBDrive}}/es | • {{#if: php5|español| [[::GPGKeyOnUSBDrive/es|español]]}}|}} {{#ifexist: {{#if: php5 | php5 | {{#if: | :}}GPGKeyOnUSBDrive}}/fa | • {{#if: php5|فارسی| [[::GPGKeyOnUSBDrive/fa|فارسی]]}}|}} {{#ifexist: {{#if: php5 | php5 | {{#if: | :}}GPGKeyOnUSBDrive}}/fi | • {{#if: php5|suomi| [[::GPGKeyOnUSBDrive/fi|suomi]]}}|}} {{#ifexist: {{#if: php5 | php5 | {{#if: | :}}GPGKeyOnUSBDrive}}/fr | • {{#if: php5|français| [[::GPGKeyOnUSBDrive/fr|français]]}}|}} {{#ifexist: {{#if: php5 | php5 | {{#if: | :}}GPGKeyOnUSBDrive}}/gu | • {{#if: php5|ગુજરાતી| [[::GPGKeyOnUSBDrive/gu|ગુજરાતી]]}}|}} {{#ifexist: {{#if: php5 | php5 | {{#if: | :}}GPGKeyOnUSBDrive}}/he | • {{#if: php5|עברית| [[::GPGKeyOnUSBDrive/he|עברית]]}}|}} {{#ifexist: {{#if: php5 | php5 | {{#if: | :}}GPGKeyOnUSBDrive}}/hu | • {{#if: php5|magyar| [[::GPGKeyOnUSBDrive/hu|magyar]]}}|}} {{#ifexist: {{#if: php5 | php5 | {{#if: | :}}GPGKeyOnUSBDrive}}/id | • {{#if: php5|Bahasa Indonesia| [[::GPGKeyOnUSBDrive/id|Bahasa Indonesia]]}}|}} {{#ifexist: {{#if: php5 | php5 | {{#if: | :}}GPGKeyOnUSBDrive}}/it | • {{#if: php5|italiano| [[::GPGKeyOnUSBDrive/it|italiano]]}}|}} {{#ifexist: {{#if: php5 | php5 | {{#if: | :}}GPGKeyOnUSBDrive}}/ja | • {{#if: php5|日本語| [[::GPGKeyOnUSBDrive/ja|日本語]]}}|}} {{#ifexist: {{#if: php5 | php5 | {{#if: | :}}GPGKeyOnUSBDrive}}/ko | • {{#if: php5|한국어| [[::GPGKeyOnUSBDrive/ko|한국어]]}}|}} {{#ifexist: {{#if: php5 | php5 | {{#if: | :}}GPGKeyOnUSBDrive}}/ksh | • {{#if: php5|Ripoarisch| [[::GPGKeyOnUSBDrive/ksh|Ripoarisch]]}}|}} {{#ifexist: {{#if: php5 | php5 | {{#if: | :}}GPGKeyOnUSBDrive}}/mr | • {{#if: php5|मराठी| [[::GPGKeyOnUSBDrive/mr|मराठी]]}}|}} {{#ifexist: {{#if: php5 | php5 | {{#if: | :}}GPGKeyOnUSBDrive}}/ms | • {{#if: php5|Bahasa Melayu| [[::GPGKeyOnUSBDrive/ms|Bahasa Melayu]]}}|}} {{#ifexist: {{#if: php5 | php5 | {{#if: | :}}GPGKeyOnUSBDrive}}/nl | • {{#if: php5|Nederlands| [[::GPGKeyOnUSBDrive/nl|Nederlands]]}}|}} {{#ifexist: {{#if: php5 | php5 | {{#if: | :}}GPGKeyOnUSBDrive}}/no | • {{#if: php5|norsk| [[::GPGKeyOnUSBDrive/no|norsk]]}}|}} {{#ifexist: {{#if: php5 | php5 | {{#if: | :}}GPGKeyOnUSBDrive}}/oc | • {{#if: php5|occitan| [[::GPGKeyOnUSBDrive/oc|occitan]]}}|}} {{#ifexist: {{#if: php5 | php5 | {{#if: | :}}GPGKeyOnUSBDrive}}/pl | • {{#if: php5|polski| [[::GPGKeyOnUSBDrive/pl|polski]]}}|}} {{#ifexist: {{#if: php5 | php5 | {{#if: | :}}GPGKeyOnUSBDrive}}/pt | • {{#if: php5|português| [[::GPGKeyOnUSBDrive/pt|português]]}}|}} {{#ifexist: {{#if: php5 | php5 | {{#if: | :}}GPGKeyOnUSBDrive}}/ro | • {{#if: php5|română| [[::GPGKeyOnUSBDrive/ro|română]]}}|}} {{#ifexist: {{#if: php5 | php5 | {{#if: | :}}GPGKeyOnUSBDrive}}/ru | • {{#if: php5|русский| [[::GPGKeyOnUSBDrive/ru|русский]]}}|}} {{#ifexist: {{#if: php5 | php5 | {{#if: | :}}GPGKeyOnUSBDrive}}/si | • {{#if: php5|සිංහල| [[::GPGKeyOnUSBDrive/si|සිංහල]]}}|}} {{#ifexist: {{#if: php5 | php5 | {{#if: | :}}GPGKeyOnUSBDrive}}/sq | • {{#if: php5|shqip| [[::GPGKeyOnUSBDrive/sq|shqip]]}}|}} {{#ifexist: {{#if: php5 | php5 | {{#if: | :}}GPGKeyOnUSBDrive}}/sr | • {{#if: php5|српски / srpski| [[::GPGKeyOnUSBDrive/sr|српски / srpski]]}}|}} {{#ifexist: {{#if: php5 | php5 | {{#if: | :}}GPGKeyOnUSBDrive}}/sv | • {{#if: php5|svenska| [[::GPGKeyOnUSBDrive/sv|svenska]]}}|}} {{#ifexist: {{#if: php5 | php5 | {{#if: | :}}GPGKeyOnUSBDrive}}/th | • {{#if: php5|ไทย| [[::GPGKeyOnUSBDrive/th|ไทย]]}}|}} {{#ifexist: {{#if: php5 | php5 | {{#if: | :}}GPGKeyOnUSBDrive}}/tr | • {{#if: php5|Türkçe| [[::GPGKeyOnUSBDrive/tr|Türkçe]]}}|}} {{#ifexist: {{#if: php5 | php5 | {{#if: | :}}GPGKeyOnUSBDrive}}/vi | • {{#if: php5|Tiếng Việt| [[::GPGKeyOnUSBDrive/vi|Tiếng Việt]]}}|}} {{#ifexist: {{#if: php5 | php5 | {{#if: | :}}GPGKeyOnUSBDrive}}/yue | • {{#if: php5|粵語| [[::GPGKeyOnUSBDrive/yue|粵語]]}}|}} {{#ifexist: {{#if: php5 | php5 | {{#if: | :}}GPGKeyOnUSBDrive}}/zh | • {{#if: php5|中文| [[::GPGKeyOnUSBDrive/zh|中文]]}}|}} {{#ifexist: {{#if: php5 | php5 | {{#if: | :}}GPGKeyOnUSBDrive}}/zh-hans | • {{#if: php5|中文(简体)| [[::GPGKeyOnUSBDrive/zh-hans|中文(简体)]]}}|}} {{#ifexist: {{#if: php5 | php5 | {{#if: | :}}GPGKeyOnUSBDrive}}/zh-hant | • {{#if: php5|中文(繁體)| [[::GPGKeyOnUSBDrive/zh-hant|中文(繁體)]]}}|}} |
{{#ifeq:php5|:GPGKeyOnUSBDrive|请不要直接编辑翻译本页,本页将定期与来源同步。}} |
{{#ifexist: :GPGKeyOnUSBDrive/zh | | {{#ifexist: GPGKeyOnUSBDrive/zh | | {{#ifeq: {{#titleparts:GPGKeyOnUSBDrive|1|-1|}} | zh | | }} }} }} {{#ifeq: {{#titleparts:GPGKeyOnUSBDrive|1|-1|}} | zh | | }}
Storing GPG Keys on an Encrypted USB Flash Drive
It is often desirable to be able to use a GPG key on more than one computer, for instance at home and at work, or on a desktop and a laptop. Unfortunately, storing encryption keys where you don't have physical control is generally a bad idea. Even storing keys on a laptop can be troublesome--if the laptop gets stolen, so does your GPG key. Luckily, you can probably revoke the key before anybody is able to decrypt it, but that's a hassle. What if you could securely store the key on a device that you always have on your person?
attachment:IconsPage/IconWarning3.png IMPORTANT: Make sure you make a backup copy of your ~/.gnupg directory before you do this. The last thing you want to happen is to lose your keyring because something went wrong.
dm-crypt
From the dm-crypt website: " Device-mapper is a new infrastructure in the Linux 2.6 kernel that provides a generic way to create virtual layers of block devices that can do different things on top of real block devices like striping, concatenation, mirroring, snapshotting, etc... The device-mapper is used by the LVM2 and EVMS 2.x tools. dm-crypt is such a device-mapper target that provides transparent encryption of block devices using the new Linux 2.6 cryptoapi. The user can basically specify one of the symmetric ciphers, a key (of any allowed size), an iv generation mode and then he can create a new block device in /dev. Writes to this device will be encrypted and reads decrypted. You can mount your filesystem on it as usual. But without the key you can't access your data."
This is perfect for our needs. We will create an encrypted filesystem inside of a regular file on the USB flash drive, where we will store sensitive data like GnuPG keys.
Installing the Software
First, you will need to install cryptsetup
:
sudo apt-get install cryptsetup This will also pull in some other necessary dependencies.Setting Up the Encrypted Filesystem
I store my GPG keys on a cheap, tiny USB flash drive that fits comfortably on my keyring. When I plug it in, it is automatically mounted as/media/usbdisk
. The following sections will assume a similar setup. I decided to make my encrypted filesystem live in a regular file rather than its own partition. This requires less tweaking of the disk, and makes mounting and unmounting the encrypted filesystem easier, as you will see later. However, many of the steps in this tutorial can be adapted to use a real partition instead of a regular file.Creating the File
Before we can make a filesystem, we need a file that is large enough to hold it. This can be accomplished withdd
:dd if=/dev/zero of=/media/usbdisk/disk.img bs=1M count=16 The above command will make a 16 MB file containing only zeros. Modify thecount
option to get your desired encrypted filesystem size.Setting up the Encrypted Loop Device
Before we can actually create the filesystem on our new file, we need to attach it to a loop device and set up a device-mapper target with encryption.losetup -f
will find the first free loop device, so we will set its output to a variable calledloopdev
and use it for several commands:sudo modprobe loop sudo modprobe dm-crypt sudo modprobe aes export loopdev=$(sudo losetup -f) sudo losetup $loopdev /media/usbdisk/disk.img sudo cryptsetup -c aes -s 256 -h sha256 -y create usbkey $loopdev This will set up the file with 256-bit AES encryption, hashing the passphrase you issue through SHA-256. After it's set up, it's a good idea to remove the usbkey device-mapper device and re-run cryptsetup to make sure that you didn't mistype the initial password (I say this from experience...):sudo cryptsetup remove usbkey sudo cryptsetup -c aes -s 256 -h sha256 create usbkey $loopdev If all goes well, we're ready for the next step!Creating the Actual Filesystem
This is the easiest step of all. I chose theext3
filesystem for its journaling capability, just in case the USB drive gets removed before the filesystem is unmounted. Thecryptsetup
command above created the device/dev/mapper/usbkey
, which is a map through dm-crypt to the encrypted filesystem. So, this device appears to the system as a regular old block device, like a hard disk or partition. The following command will create anext3
filesystem on the encrypted file:sudo mkfs.ext3 /dev/mapper/usbkey Now, try mounting the filesystem:sudo mkdir -p /mnt/encrypted sudo mount -t ext3 /dev/mapper/usbkey /mnt/encryptedSetting up GnuPG on the Encrypted Filesystem
Now, make a.gnupg
directory in/mnt/encrypted
, make it owned by your user, and link it to your own~/.gnupg
(if you already have a.gnupg
directory, move it out of the way first):sudo mkdir /mnt/encrypted/.gnupg sudo chown $UID.$UID /mnt/encrypted/.gnupg chmod 0700 /mnt/encrypted/.gnupg ln -s /mnt/encrypted/.gnupg ~/.gnupg Now, create a GnuPG key as described in UbuntuHelp:GPGKey or, if you already have a key, move the files in your old.gnupg
directory into the new one, possibly usingshred
orwipe
to securely remove the old files.Making Things Easier
Simplifying the Mount Process
It's not really fun to type three or four commands each time you want to mount your encrypted filesystem. So, I wrote two really simple scripts for mounting and unmounting. Before using these, you should unmount your filesystem and detach the loop device:sudo umount /mnt/encrypted sudo cryptsetup remove usbkey sudo losetup -d $loopdev Now, save the following asmount.sh
in the root of your USB drive (not in the encrypted filesystem!): inline:mount.sh Then, save the following asumount.sh
in the same place: inline:umount.sh You may not be able to execute these scripts directly, since the default auto-mounting options prohibit running executables. But, since they are shell scripts, you can simply pass them on tosh
. So, once the USB drive has been mounted, you can simply typesh /media/usbdisk/mount.sh and all the work will be done for you! (Of course, you will need the encryption password, and you may be asked for a password forsudo
.)Verifying PGP Signatures Without the Encrypted Filesystem
You might want to be able to verify a signed message without needing to mount the encrypted filesystem. To facilitate this, simply copy the public keyring and the trust database file to the "real".gnupg
directory:cp /mnt/encrypted/.gnupg/{pubring,trustdb}.gpg /tmp sh /media/usbdisk/umount.sh sudo mv /tmp/{pubring,trustdb}.gpg /mnt/encrypted/.gnupg Now, when the encrypted filesystem is not mounted, you will see those files in your.gnupg
directory, so thatgpg --verify
will work. But when it is mounted, you will see the files that are actually in the encrypted filesystem.
CategorySecurity