个人工具

“UbuntuHelp:EncryptedFilesystemHowto3”的版本间的差异

来自Ubuntu中文

跳转至： 导航, 搜索
小
小
第1行： 第1行：
 
{{From|https://help.ubuntu.com/community/EncryptedFilesystemHowto3}}
 
{{From|https://help.ubuntu.com/community/EncryptedFilesystemHowto3}}
−
{{Languages|php5}}
+
{{Languages|UbuntuHelp:EncryptedFilesystemHowto3}}
 
== Encrypted Swap and Home with LUKS (on Ubuntu 6.06 and 5.10) ==
 
== Encrypted Swap and Home with LUKS (on Ubuntu 6.06 and 5.10) ==
  
第81行： 第81行：
 
install cryptsetup:
 
install cryptsetup:
 
<pre><nowiki>
 
<pre><nowiki>
−
# apt-get install cryptsetup
 
 
</nowiki></pre>
 
</nowiki></pre>
  
第95行： 第94行：
 
check the partition for errors (and wait several minutes...):
 
check the partition for errors (and wait several minutes...):
 
<pre><nowiki>
 
<pre><nowiki>
−
# sudo /sbin/badblocks -c 10240 -s -w -t random -v /dev/hda3
 
 
</nowiki></pre>
 
</nowiki></pre>
  
第102行： 第100行：
 
practical solution available:
 
practical solution available:
 
<pre><nowiki>
 
<pre><nowiki>
−
# sudo dd if=/dev/urandom of=/dev/hda3
 
 
</nowiki></pre>
 
</nowiki></pre>
  
 
create a LUKS partition:
 
create a LUKS partition:
 
<pre><nowiki>
 
<pre><nowiki>
−
# sudo cryptsetup --verify-passphrase --verbose --hash=sha256 --cipher=aes-cbc-essiv:sha256 --key-size=256 luksFormat /dev/hda3
 
 
</nowiki></pre>
 
</nowiki></pre>
  
第114行： 第110行：
 
set up the device mapper:
 
set up the device mapper:
 
<pre><nowiki>
 
<pre><nowiki>
−
# sudo cryptsetup luksOpen /dev/hda3 home
 
 
</nowiki></pre>
 
</nowiki></pre>
  
 
confirm it worked:
 
confirm it worked:
 
<pre><nowiki>
 
<pre><nowiki>
−
# sudo cryptsetup status home
 
 
/dev/mapper/home is active:
 
/dev/mapper/home is active:
 
   cipher:  aes-cbc-essiv:sha256
 
   cipher:  aes-cbc-essiv:sha256
第131行： 第125行：
 
create the filesystem (e.g. ext3):
 
create the filesystem (e.g. ext3):
 
<pre><nowiki>
 
<pre><nowiki>
−
# sudo mke2fs -j -O dir_index,filetype,sparse_super /dev/mapper/home
 
 
</nowiki></pre>
 
</nowiki></pre>
  
 
temporary mount, to copy data from old home:
 
temporary mount, to copy data from old home:
 
<pre><nowiki>
 
<pre><nowiki>
−
# sudo mount -t ext3 /dev/mapper/home /mnt
 
 
</nowiki></pre>
 
</nowiki></pre>
  
 
copy data from old home:
 
copy data from old home:
 
<pre><nowiki>
 
<pre><nowiki>
−
# sudo cp -axv /home/* /mnt/
 
 
</nowiki></pre>
 
</nowiki></pre>
  
 
unmount the temporary mount:
 
unmount the temporary mount:
 
<pre><nowiki>
 
<pre><nowiki>
−
# sudo umount /mnt
 
 
</nowiki></pre>
 
</nowiki></pre>
  
第157行： 第147行：
 
insert in /etc/fstab :
 
insert in /etc/fstab :
 
<pre><nowiki>
 
<pre><nowiki>
−
# <file system>    <mount point>  <type>  <options>  <dump>  <pass>
 
 
/dev/mapper/home  /home          ext3    defaults    1      2
 
/dev/mapper/home  /home          ext3    defaults    1      2
 
</nowiki></pre>
 
</nowiki></pre>
第163行： 第152行：
 
after that, add an entry in /etc/crypttab:
 
after that, add an entry in /etc/crypttab:
 
<pre><nowiki>
 
<pre><nowiki>
−
# <target device>  <source device>  <key file>  <options>
 
 
home                /dev/hda3        none        luks
 
home                /dev/hda3        none        luks
 
</nowiki></pre>
 
</nowiki></pre>
第179行： 第167行：
 
create a file named 'cryptinit' in /etc/init.d/ with the following content:
 
create a file named 'cryptinit' in /etc/init.d/ with the following content:
 
<pre><nowiki>
 
<pre><nowiki>
−
#! /bin/sh
 
−
# if this script is executed when home is opened, tries to close it;
 
−
# otherwise, tries to open it, for three times, then continue without
 
−
# opening it
 
 
if [ -b /dev/mapper/home ]; then
 
if [ -b /dev/mapper/home ]; then
 
     /sbin/cryptsetup luksClose home
 
     /sbin/cryptsetup luksClose home
第201行： 第185行：
 
then, create a symlink to 'cryptinit' in /etc/rcS.d
 
then, create a symlink to 'cryptinit' in /etc/rcS.d
 
<pre><nowiki>
 
<pre><nowiki>
−
# cd /etc/rcS.d
 
−
# sudo ln -s ../init.d/cryptinit S28cryptinit
 
 
</nowiki></pre>
 
</nowiki></pre>
  
 
insert in /etc/fstab :
 
insert in /etc/fstab :
 
<pre><nowiki>
 
<pre><nowiki>
−
# <file system>    <mount point>  <type>  <options>  <dump>  <pass>
 
 
/dev/mapper/home  /home          ext3    defaults    1        2
 
/dev/mapper/home  /home          ext3    defaults    1        2
 
</nowiki></pre>
 
</nowiki></pre>
第250行： 第231行：
 
set up the device mapper:
 
set up the device mapper:
 
<pre><nowiki>
 
<pre><nowiki>
−
# cryptsetup luksOpen /dev/hda4 data
 
 
</nowiki></pre>
 
</nowiki></pre>
  
 
mounting:
 
mounting:
 
<pre><nowiki>
 
<pre><nowiki>
−
# mount /dev/mapper/data /media/data
 
 
</nowiki></pre>
 
</nowiki></pre>
  
第264行： 第243行：
 
umounting:
 
umounting:
 
<pre><nowiki>
 
<pre><nowiki>
−
# umount /media/data
 
 
</nowiki></pre>
 
</nowiki></pre>
  
 
delete the device mapper:
 
delete the device mapper:
 
<pre><nowiki>
 
<pre><nowiki>
−
# cryptsetup luksClose data
 
 
</nowiki></pre>
 
</nowiki></pre>
  
第279行： 第256行：
 
entry like this:
 
entry like this:
 
<pre><nowiki>
 
<pre><nowiki>
−
# <file system>  <mount point>  <type>  <options>  <dump>  <pass>
 
 
/dev/hda2        none            swap    sw          0      0
 
/dev/hda2        none            swap    sw          0      0
 
</nowiki></pre>
 
</nowiki></pre>
第286行： 第262行：
 
/dev/mapper/cswap:
 
/dev/mapper/cswap:
 
<pre><nowiki>
 
<pre><nowiki>
−
# <file system>    <mount point>  <type>  <options>  <dump>  <pass>
 
 
/dev/mapper/cswap  none            swap    sw          0      0
 
/dev/mapper/cswap  none            swap    sw          0      0
 
</nowiki></pre>
 
</nowiki></pre>
第292行： 第267行：
 
after that, add an entry in /etc/crypttab:
 
after that, add an entry in /etc/crypttab:
 
<pre><nowiki>
 
<pre><nowiki>
−
# <target device>  <source device>  <key file>    <options>
 
 
cswap              /dev/hda2        /dev/random  swap
 
cswap              /dev/hda2        /dev/random  swap
 
</nowiki></pre>
 
</nowiki></pre>
第298行： 第272行：
 
reboot, and that's it! the encrypted swap device is done; confirm it worked:
 
reboot, and that's it! the encrypted swap device is done; confirm it worked:
 
<pre><nowiki>
 
<pre><nowiki>
−
# cat /proc/swaps
 
 
Filename                                Type            Size    Used    Priority
 
Filename                                Type            Size    Used    Priority
 
/dev/mapper/cswap                      partition      3148700 0      -1
 
/dev/mapper/cswap                      partition      3148700 0      -1
  
−
# sudo cryptsetup status cswap
 
 
/dev/mapper/cswap is active:
 
/dev/mapper/cswap is active:
 
   cipher:  aes-cbc-plain
 
   cipher:  aes-cbc-plain
第334行： 第306行：
 
2048bit random key:
 
2048bit random key:
 
<pre><nowiki>
 
<pre><nowiki>
−
# dd if=/dev/random of=keyfile bs=1 count=256
 
 
</nowiki></pre>
 
</nowiki></pre>
  
第341行： 第312行：
 
the following command will require you to enter two times the passphrase
 
the following command will require you to enter two times the passphrase
 
stored on slot 0...
 
stored on slot 0...
−
# sudo cryptsetup luksAddKey /dev/hda4 keyfile
 
 
</nowiki></pre>
 
</nowiki></pre>
  
 
finally, to open the encrypted partition with the keyfile:
 
finally, to open the encrypted partition with the keyfile:
 
<pre><nowiki>
 
<pre><nowiki>
−
# sudo cryptsetup luksOpen /dev/hda4 data --key-file keyfile
 
 
</nowiki></pre>
 
</nowiki></pre>
  
 
if you like to disable (delete) the keyfile on slot 1:
 
if you like to disable (delete) the keyfile on slot 1:
 
<pre><nowiki>
 
<pre><nowiki>
−
# sudo cryptsetup luksDelKey /dev/hda4 1
 
 
</nowiki></pre>
 
</nowiki></pre>
  
第379行： 第347行：
  
 
----
 
----
−
CategoryCleanup CategorySecurity
+
[[category:CategoryCleanup]] [[category:CategorySecurity]]
  
 
[[category:UbuntuHelp]]
 
[[category:UbuntuHelp]]

2007年5月14日 (一) 11:15的版本

Geographylogo.png 文章出处: 

https://help.ubuntu.com/community/EncryptedFilesystemHowto3

Geographylogo.png 点击翻译: 

English

请不要直接编辑翻译本页，本页将定期与来源同步。

Encrypted Swap and Home with LUKS (on Ubuntu 6.06 and 5.10)

by Stefano Spinucci virgo977virgo at <googlemail> dot com


introduction

notes

NOTE#1 in this tutorial we assume that:

  • old (unencrypted) and the new (encrypted) swap is in the partition '/dev/hda2'
  • new home (encrypted) is in the partition '/dev/hda3'


replace '/dev/hda2' with your real swap partition and '/dev/hda3' with an empty partition that will become your new encrypted home partition.


NOTE#2 DM-Crypt works by transparently translating (in the kernel) between a physical on-disk partition (which is encrypted) and a logical partition which you can then mount and use as normal; then, for example, to operate on your home partition you must do so by using /dev/mapper/home instead of /dev/hda3.


warnings

encrypting a partition is a destructive operation; then, your new home partition (/dev/hda3) must be empty, because all data on it will be erased.

unencrypted data on the old home directory won’t be deleted and will be accessible, for example, with a live CD; then, you shouldn't put any sensitive data on home before encrypting.

otherwise, if you have sensitive data to delete securely from the old unencrypted home, you should shred the old home directory.

if the partition containing the old home directory is formatted with a journaled file system (JFS, ReiserFS, XFS, Ext3, etc.), you must boot with a live CD and shred the entire partition containing the old home directory.

if the shredded partition is the partition containing the OS, reinstall ubuntu, and finally mount the previously created encrypted home.

references for secure deletion:


strong passwords

remember that a chain is only as strong as its weakest link, and in the encryption chain the password is always the weakest link.

then, choose a strong password, or your data won't be more secure than without encryption.

references for strong passwords:


install cryptsetup

enable 'community maintained' (universe) repository from the Synaptic package manager or modifying the file /etc/apt/sources.list (apt sources list).

install cryptsetup: 








encrypted home


unmount (if mounted) /dev/hda3



sudo umount /dev/hda3



check the partition for errors (and wait several minutes...):





fill the disk with random data (and wait many more minutes...);
/dev/urandom won't be as random as /dev/random, but it is the best
practical solution available:





create a LUKS partition:





NOTE: if you get errors that the kernel may not use dm-crypt, try the command modprobe dm-crypt and retry to create the LUKS partition; if that helps, you may also want to add the module dm-crypt to the file /etc/modules.

set up the device mapper:





confirm it worked:



/dev/mapper/home is active:
  cipher:  aes-cbc-essiv:sha256
  keysize: 256 bits
  device:  /dev/.static/dev/hda3
  offset:  2056 sectors
  size:    20962706 sectors
  mode:    read/write



create the filesystem (e.g. ext3):





temporary mount, to copy data from old home:





copy data from old home:





unmount the temporary mount:










permanent mounting


Ubuntu 6.06


insert in /etc/fstab :



/dev/mapper/home   /home           ext3     defaults    1       2



after that, add an entry in /etc/crypttab:



home                /dev/hda3         none         luks



reboot, and the encrypted home is done.






Ubuntu 5.10


because 'crypttab' in Ubuntu 5.10 doesn't support LUKS encrypted
partitions, automatic mounting of home with Ubuntu 5.10 is a bit more
difficult.

create a file named 'cryptinit' in /etc/init.d/ with the following content:



if [ -b /dev/mapper/home ]; then
    /sbin/cryptsetup luksClose home
else
    i=3
    while [ $i -gt 0 ]; do
        let "i -= 1"
        /sbin/cryptsetup luksOpen /dev/hda3 home && i=0
    done
fi



make 'cryptinit' executable



sudo chmod 755 /etc/init.d/cryptinit



then, create a symlink to 'cryptinit' in /etc/rcS.d





insert in /etc/fstab :



/dev/mapper/home   /home           ext3     defaults    1        2



reboot, and the encrypted home is done.






notes


with the instructions above about encrypting home you can also encrypt
generic data partitions (other than home), and you can permanently mount
them in two ways.

the first technique is shown above for mounting home, and requests the
password during the loading of the kernel.

the second technique we explain here asks you for the password right at
the end of the booting process, at the gnome login:



  •  do not make any modifications to /etc/fstab or /etc/crypttab
    • 

  •  add the encrypted partition to /etc/pmount.allow (ie. /dev/hda3)


this will give you the convenience of entering the password at the end of
the boot process rather than in the middle. however, a
bug means that your
encrypted partition will always be called 'usbdisk' whether it is a usbdisk
or not.






manual mounting and unmounting


if you have encrypted other partitions than home and you don't want to
unlock those partitions on boot, then you need to manually mount and
unmount them.






mounting


set up the device mapper:





mounting:










unmounting


umounting:





delete the device mapper:










encrypted swap


before setting the encrypted swap, the file /etc/fstab should have a swap
entry like this:



/dev/hda2         none            swap     sw          0       0



now just replace in /etc/fstab /dev/hda2 with the new device name
/dev/mapper/cswap:



/dev/mapper/cswap   none            swap     sw          0       0



after that, add an entry in /etc/crypttab:



cswap               /dev/hda2         /dev/random   swap



reboot, and that's it! the encrypted swap device is done; confirm it worked:



Filename                                Type            Size    Used    Priority
/dev/mapper/cswap                       partition       3148700 0       -1

/dev/mapper/cswap is active:
  cipher:  aes-cbc-plain
  keysize: 256 bits
  device:  /dev/.static/dev/hda2
  offset:  0 sectors
  size:    6297417 sectors
  mode:    read/write



read the crypttab(5) manpage for more information






encrypting with keyfiles


with LUKS you can encrypt/decrypt with keyfiles instead of passphrases.

you can add a keyfile with the command luksFormat or with the command
luksAddKey.

for example, you can add with luksFormat a passphrase on slot 0 and with
luksAddKey a keyfile on slot 1; then, you can open your encrypted device
with the keyfile and, if you lose the keyfile, you can always use the
passphrase.

for better security you can store your keyfiles on a USB stick, maybe
encrypting the USB stick with a passphrase.

you can use every file you like as keyfile; for example, to generate a
2048bit random key:





then, to add the generated keyfile to an existing encrypted partition:



the following command will require you to enter two times the passphrase
stored on slot 0...



finally, to open the encrypted partition with the keyfile:





if you like to disable (delete) the keyfile on slot 1:










tools








references








取自“https://wiki.ubuntu.org.cn/index.php?title=UbuntuHelp:EncryptedFilesystemHowto3&oldid=7138”