General :: Encrypted Remote Filesystem With Concurrent Access - Is It Possible?
Jul 26, 2011
I'm looking for a way to store an encrypted filesystem on rsync.net which can be mounted and used by multiple clients concurrently - I've considered and experimented with many different ideas, including code...
but all of them are leading me to what looks like a fundamental theoretical problem: a filesystem with concurrent access needs someone to manage it, and who's going to manage it if I can't trust the server? Or refuse on principle to trust the server? There would need to be some trusted entity communicating with every client and making decisions to keep the filesystem and/or block device consistent, right?
Is my understanding correct, or is there any way of achieving what I'm trying to do?
I currently have a RHEL 5.4 software development server. A lot of my developers are using windows desktops and they need to run interactive sessions on the server. I need to support between 4-6 concurrent users on the server. I tried doing this with VNC but I was never able to set that up for more than one user at a time.
Is it somehow possible to boot a Linux operating system from an encrypted filesystem/disk without having uesr interaction? Background: I am preparing a VmWare Image for shipment to a customer. This image contains sensible data. The only access granted shall be via an apache server running from inside in the image.
have a Debian server which I use to hold my home directory for my user account. I used to use Windows 7 and connect to my /home/username directory via Samba which worked great. I could access all of my files as if they were sitting on my local PC, but they were actually sitting on my Debian server.
Now I have decided to give Ubuntu 10.10 a try (looks promising so far!).One thing I'm not sure how to do is to mount my home directory from my server! I am able to open an sftp connection to my server, but not able to access them natively as they were /home/username on my local machine.I'm assuming I need to mount my home directory somewhere in my fstab before it starts up, but which protocol should I use? I'm used to using windows networking, but am trying to get more into linux.Should I use NFS?
I used the standard disk utility on another 2.6.x Ubuntu desktop to encrypt a USB device. Can I access this through a similar VM on a Mac OS X host?
I don't have any problems accessing normal USB devices on the VM, but when I insert the encrypted one, I get an error message saying that it can't be mounted.
I no longer can log into my ubuntu mail server as a normal user after installing dtc. I have been trying to resolve the issue but to no avail so I am now going to re-install ubuntu and re-configure the mail server. The problem is that I may have some files in the normal user's profile that I want to backup before I do the re-installation. At least I want to see what folders and files are in there. The other issue is that my hard drive is encrypted. How do I access the files and folders using root?
I have an encrypted filesystem that I've decided I don't want encrypted anymore. Seems the easiest way to do this is simply reformat the filesystem, but I can't. If I try to do it in YaST2 I get either system error code -3005 (unknown) or -3008 (apparently in use). When I try to do it from the command line I get:
Code: frylock:/home/joel # umount /dev/sdb5 umount: /dev/sdb5: not mounted frylock:/home/joel # mkfs -t ext4 /dev/sdb5 mke2fs 1.41.9 (22-Aug-2009) /dev/sdb5 is apparently in use by the system; will not make a filesystem here! frylock:/home/joel #
It's unmounted, I don't know how to make it any less in use than that.I can't delete the partition because it's not the last logical partition in the extended partition.
Is this irrelevant if you are using the kde install disc? I want to use a encrypted filesystem. I would think since I am using kde that I would have a graphical interface.
I have a external HDD with eSATA and USB connectors available. I want to use this HDD to store my backups. The HDD should be encrypted (my main system is as well).
So here is what I did so far: 1) I used the following code to create the encrypted LUKS partition with EXT3 Filesystem: Code: cryptsetup -c aes-xts-plain -s 512 luksFormat /dev/sdb1 cryptsetup luksOpen /dev/sdb1 luks mkfs.ext3 /dev/mapper/luks The system always hang when I executed the "mkfs.ext3..." command, so I switched the HDD from eSATA to USB and then it worked fine.
2) When I switched on the ext. HDD the first time, the drive was recognized automatically and Nautilus asked for the password. I typed it in as checked the checkbox to remember the password in the future. For the backup I use a nice script that I found in another forum, where I can define a mountpoint and then the script will check for previous backups and only make a incremental backup based of the latest version. The script also mounts the drive automatically. In order to always have the same mountpoint, I want to make an entry in the /etc/fstab using the UUID of the ext. HDD.
Whatever I tried, it doesn't work. What am I doing wrong? Here is my current /etc/fstab Code: # <file system> <mount point> <type> <options> <dump> <pass> proc /proc proc defaults 0 0 # / was on /dev/mapper/ubuntu-root during installation UUID=2ea47421-73ce-4c66-9606-8a1db81ae640 / ext3 relatime,errors=remount-ro 0 1 # /boot was on /dev/sda1 during installation UUID=dbdeb793-1d4e-43ea-8986-7b37fdbc9674 /boot ext3 relatime 0 2 # /home was on /dev/mapper/ubuntu-home during installation UUID=42702091-83e6-43eb-aad1-108f43eedf9d /home ext3 relatime 0 2 # swap was on /dev/mapper/ubuntu-swap during installation UUID=e225bcf9-908b-4226-a963-6b02ee658df1 none swap sw 0 0 /dev/scd0 /media/cdrom0 udf,iso9660 user,noauto,exec,utf8 0 0 # Eintrag wegen iPhone none /proc/bus/usb usbfs devgid=125,devmode=666,nodev,nosuid,noexec 0 0 # external HDD UUID=913977f7-8fa6-416f-af79-b5f913b68f53 /media/backup-hdd ext3 noauto,users 0 0 I made the "none /proc/bus/usb..." entry because it was recommended to ensure correct behaviour of the iPhone. Not sure if I need it though.
I created the mountpoint with this command: Code: sudo mkdir /media/backup-hdd Now it seems the mountpoints owner is not root - strange right? Code: 2 4 drwxr-xr-x 3 michael michael 4096 2010-01-15 02:45 backup-hdd How should I mount this drive correctly? It will be automounted as every USB device, but that should not be the case. I want the script to mount and unmount the drive.
Recently I was forced to hard reset my computer a couple of times (mostly out of frustration) and due to my idiocy i was confronted with the standard Kernel Panic message at bootup. I tried running an fsck from live cd which corrected a bunch of errors but to no avail (as far as getting rid of the Kernel Panic msg). I then tried to mount the filesystem by accessing it from live cd (and later even installed ubuntu on a small leftover partition to get rid of the annoying live cd lag) but it says that I don't have access to my home or root folder. Mounting from command line gave the same issue.
So now to the question. Is there a general procedure to access data in my corrupt filesystem if it is encrypted?
The luksOpen command asks me for my passphrase, but always rejects it. I have retried this several times and written down the passphrase - and even tried with a very simple one just to check. And I never can make it work.
how can I set the keyboard layout used by Debian to enter the password of my encrypted filesystem?
After my recent "aptitude upgrade", I have not been able to mount my encrypted filesystem anymore. I have discovered that the keyboard layout used to enter the password has changed. Problem is that with such layout I can't enter some of the characters composing the password. The encrypted filesystem looks intact, since I have been able to mount it and backup my files by means of a live CD. That means that I can edit any system file, if needed.
Every technique I have found to change layout cannot be employed in this case, since they rely on the system being up and running. I've tried editing /etc/default/keyboard, but that does not work.
I have two ext3 partitions within an encrypted lvm2 volume. when i start up my system it says that there are 0.3% non contiguous blocks.
This is my steup:
When i want to repair with repair system from dvd it tells me that the repair and check operation for encrypted LVM devices is not supported. so how can i fix my filesystem?
I've created encryption systems on servers, but nearly always I have stored the password somewhere on the machine itself. The file is always 0600 to the relevant user, but a systematic analysis of my system could easily find the scripts that invoke decryption and discover the password. (The most blatant example of this is mounting SMB shares with the "-o credential_file" option where both the username and password are plain-text. In the cases where I've used this, the security of the share hasn't particularly mattered.)
Soon I might be faced with storing "patient health information" (PHI in the healthcare world) whose privacy is heavily regulated by the provisions of the US law called HIPAA. I've been thinking about creating an encrypted partition to hold the PHI, but I need a highly fault-tolerant method for obtaining the key from a different machine than tha server itself. At first, I thought about running a script using scp and shared keys to copy the key from the remote, use it to decrypt the partition, then erase it. I'd like to be able to do this with a pipe; otherwise I'll write the key in a non-persistent location like /dev/shm.
I need more than one machine to make this work to ensure I can obtain the key when needed (like at boot). One solution is to place copies of the key on multiple servers and try each of them until I find it. A more elegant solution would place the key in a DNS TXT record. I suspect I could use LDAP for this as well, but OpenLDAP and I have never really been on speaking terms. So does this make sense? I presume I can write a bash script to do all this at boot. Most of what will be stored in this partition is the PostgreSQL database in /var/lib/pgsql and perhaps some other files.
My understanding of encrypted file systems is that they are only encrypted when unmounted. When mounted they must be as visible to the operating system as an unencrypted partition. I suppose you could apply encryption to every single disk transaction, but that would require knowing the key all the time, and would seem to add a lot of overhead.
When I try to mount a linux file system that was encrypted using cryptsetup I get the following error: debian:/# mount /dev/sdb3 Command sukey slot 0 mount: u moet een bestandssysteemsoort aangeven mount failed with run_sync status 32 Command failed: Device busy mount.crypto_LUKS(crypto-dmc.c:168): Could not unload dm-crypt device "/dev/mapper/_dev_sdb3", cryptsetup returned HXproc status 240 "mount: u moet een bestandssysteemsoort aangeven" is dutch for "you must specify filesystem type"
When i installed ubuntu. I made a seperate partition so that i could copy an ISO image onto it of an up-to-date version of ubuntu. I wanted to then boot the ISO up so i could install the new version that way. I've already tried doing it through the update manager but it'll download, almost be done with installing and it freezes on me. so i figured this would be easier. However i do not know how to gain access to the other partition to copy the ISO image. Please help.
I have implemented a web application on Linux that I want to deploy and sell to customers. I want to sell ready systems including the hardware. The application is written in PHP/MySQL. What I am searching to achieve is :
1) Find a way so that filesystem and partitions to be encrypted but without the need to insert some code when rebooting. So that if someone gets out the hard disks and attach to another system, cannot have any access to my files or settings. And of course when rebooting (e.g. after a power failure) encryption to be applied automatically.
2) I know that there are ways to bypass root password on a Linux system. Can all these ways be unassigned ? I want the only way to have access to system, to be by using the root password and nothing else.
I have thought of using a virtual server instead of a physical one (like deploying a virtualbox server) but still would like this to be the most secure possible including not only remote but also local access to system.
I'm running Windows 7 in VMPlayer under Linux. I made some changes to Windows 7 to allow it to have two people logged in at the same time. However when I do this the sound lags behind on the host machine.
Is there a different version of Windows where I am less likely to have this problem?
FTP servers I use frequently have imposed a simultaneous connections limit, usually 5-10 at the time. It was no problem under Windows, since Windows artificially limits allowed FTP connections to ~10 as far as I know. But it is a problem under Linux very much since I cannot find how to limit them :/ So far I used these clients: Native FTP client (Places -> Connect to FTP server). No apparent way to limit connections.
FileZilla. Under particular server settings you can limit number of simultaneous connections. Also you can do that globally in Edit -> Preferences -> Transfers. Problem is, it doesn't work, I still keep getting the 530 Sorry the maximum number of clients (10) for this user are already connected. And netstat shows quite a few simultaneous FileZilla connections no matter that I limited them to 1 both in global and local settings.
NCFTPPUT. 10 successful uploads and hi 530. Total Commander under Wine. Same. NetBeans IDE integrated ftp. Same. Some other crapy FTP clients which names I already forgot. Same. OS is Ubuntu 10.04 So, is there any way to force any of these FTP clients to use less than 10 concurrent connections?
I have a very simple question .I need to tune Kernel paramaters in RHEL 5 server to increase the number of concurrent connections what is the command to do this .How do i know the defaults and the maximum value i can raise this to.
This is not a regular backup. I only want to backup selective directories so personal files (photographs, documents, sourcecode) will be kept safe in case of a total system meltdown. This'll be 15GB max. Basically the digital variant of a fire resistant safe. I looked into duplicity but that requires me to install gpg keys on the target machine, which I can not do. I rather have a solution that just relies on just a working shell account and diskspace on the target server.
I thought of writing a simple script to do the following: 1. Mount remote server with sshfs 2. Mount encrypted container at remote server (LUKS, TrueCrypt?) 3. Loop over predefined directories on local machine and copy to encrypted container (rdiff-backup?)
Based on these requirements: - Target server is "dumb": only ssh access + diskspace (i.e. no installing of gpg keys) - Encrypted container should grow/shrink to fit contents - Encrypted container should be easily decryptable on any OS if you have the password - Once data leaves client server it should be encrypted: sysadmin on target server should never be able to see unencrypted data.
I am trying to access my Red Hat server (home server) from my an external location. I followed the step on how to port forward but I'm having no success. I was wondering if there is something I should be doing on my linux server to all the remote access.
I use a hosted machine for work which has vnc and apache servers running. To work on a shell, I connect to the VNC server, and to access files I host them using apache and open them from my browser. It would be great if I can access my shells via my browser itself instead of using VNC or command prompt.
I am looking for an end result like this: [URL].. What are my options? PS: I already tried [URL]..but this uses a java applet to run and does not do it in browser itself.
me using opensuse. when i wnat to access it from a remote system using ssh.the following error occur. permition denied (publickey,keyboard interactive)
The tutorial (UNIX Tutorial) does not say anything about the license from a remote computer, I want to be able to save files in these folders of mine, but can not access from a remote computer. Normally the command would win R (Windows key and R) give me a sign up picture, it comes up but I can not access. The message that comes up is that the network path is not available.
I have a Filer Server running Ubuntu Server 9.04 located at my office. I would like to access these files from my home. How would I accomplish this as simply as possible?
