I'm trying to install a luks enabled grub for full system encryption. What modules are required by grub to load a normal ubuntu linux system and what is the type to use?
View 2 RepliesI would like to configure my Debian Jessie system in this way.
Two partitions:
1) /boot on /dev/sda1
2) everything else on /dev/sda2
I want to encrypt the second partition with LUKS. And then install over it a LVM volume. Inside the LVM volume i will create the / (root), /var, /opt and /home virtual partitions. In this way, i'll get asked only once for the password to decrypt all partitions. Because if i don't use LVM, then i'll get asked for the password for each encrypted partition.
I can follow and understand almost everything of this HOW-TO for Archlinux: [URL] ....
Only two passages are unclear to me:
1) Configuring mkinitcpio
I don't understand what i should do here in order to complete this. What should i do in Debian to configure "mkinitcpio"? what is the equivalent thing to do here?
I thought that the kernel would automatically recompile itself with all installed modules on the Debian system, once cryptosetup/LUKS or LVM2 get installed.
2) Configuring the boot loader
I don't understand what should i write in /etc/default/grub. Will GRUB automatically load the LUKS and LVM2 modules? Also, I don't think that i could boot the system in this way:
cryptdevice=/dev/sda2:LVM root=/dev/mapper/LVM-????
Actually the "root=" volume is the whole volume to mount as LVM. It isn't the final root partition.
Is LUKS the best data/system encryption? Or is there one that is even better and stronger?
View 1 Replies View RelatedI'm moving over to Linux when the new SSD arrives. SSD gives increased performance, so I thought that I could encrypt everything.
But then I came to think about TRIM, and garbage collection on the drive. Will a LUKS encrypted drive affect the garbage collection system? (TRIM).
I've got some old drives using pre-LUKS loopback encryption, and I'm having problems mounting them on OpenSUSE 11.3. What I expected to work, based on past experiences with other distributions, is something along the lines of:
mount -t ext3 /dev/sdc11 tmp -o loop=/dev/loop1,encryption=AES256. When I try this I'm asked for the password, but then get the message "ioctl: LOOP_SET_STATUS: Invalid argument". Anyone have a clue what could be going wrong, or how I can best access these drives from OpenSUSE?
this isn't really a security question, per se, so feel free to move. It is related to full disk LVM encryption though. Full disk didn't work for me with grub2 after running dd to a remote server, so I downgraded to grub1. No biggie. However, I have neither grub or grub2 as selected in Synaptic.Let's say I forget which I have installed. How would I determine what version of grub is installed at the moment. I'm assuming it's somehow installed on in the mbr but not on the OS. I didn't mean to do anything funky. Is that the normal setup? I'm deploying these systems to users and want to be able to troubleshoot issues in the future (hopefully that will not be needed!) grub --version does not work because it is not installed.
View 2 Replies View RelatedI'm running Karmic Server with GRUB2 on a Dell XPS 420. Everything was running fine until I changed 2 BIOS settings in an attempt to make my Virtual Box guests run faster. I turned on SpeedStep and Virtualization, rebooted, and I was slapped in the face with a grub error 15. I can't, in my wildest dreams, imagine how these two settings could cause a problem for GRUB, but they have. To make matters worse, I've set my server up to use Luks encrypted LVMs on soft-RAID. From what I can gather, it seems my only hope is to reinstall GRUB. So, I've tried to follow the Live CD instructions outlined in the following article (adding the necessary steps to mount my RAID volumes and LVMs). [URL]
If I try mounting the root lvm as 'dev/vg-root' on /mnt and the boot partition as 'dev/md0' on /mnt/boot, when I try to run the command $sudo grub-install --root-directory=/mnt/ /dev/md0, I get an errors: grub-setup: warn: Attempting to install GRUB to a partition instead of the MBR. This is a BAD idea. grub-setup: error: Embedding is not possible, but this is required when the root device is on a RAID array or LVM volume.
Somewhere in my troubleshooting, I also tried mounting the root lvm as 'dev/mapper/vg-root'. This results in the grub-install error: $sudo grub-install --root-directory=/mnt/ /dev/md0 Invalid device 'dev/md0'
Obviously, neither case fixes the problem. I've been searching and troubleshooting for several hours this evening, and I must have my system operational by Monday morning. That means if I don't have a solution by pretty early tomorrow morning...I'm screwed. A full rebuild will by my only option.
Is there a way to install ubuntu 10.04 or 10.10 with full disk encryption? I read how to do it in the 8.0 version, was wondering if it is still possible?
View 4 Replies View RelatedWhen 10.04 is released I'll encrypt my /home partition using luks. I've read that xts is good for hard drive encryption and aes is good for cipher encryption. I'm looking for something that is fairly secure without sacrificing a lot of speed.
View 2 Replies View Relatedfirst i make one partiton ten format it add mount point and fire luksopen command and create secert file and enter this in crypttab but when i rebbot it showes scert file not found and partion remain unlocked
View 1 Replies View Related1.) I am wondering how to enable the lock to an encrypted partition which has been unlocked, using luks? On boot, I am been asked automatically for the pass phrase to unlock my partitions. After doing a back up, I want lock the encrypted partition again, but I don't know the command?! I umounted the partition but after mounting it again, I was not asked for the pass phrase but had access to my data.
2.) How secure is the default fedora version of luks? Is truecrypt better?
I'm planning a fresh F13 install, with separate partitions for /boot, /home, /tmp, /, and swap. All but /boot will be logical volumes, and I'd like to encrypt all but boot. If I encrypt the underlying partitions, is there any reason to also encrypt the logical volumes themselves?
my system will be:
HP dv6-3040us Pavillion laptop
AMD Phenon II
4GB DDR3
I have set up a Linux software RAID5 on three hard drives and want to encrypt it with cryptsetup/LUKS. My tests showed that the encryption leads to a massive performance decrease that I cannot explain. The RAID5 is able to write 187 MB/s [1] without encryption. With encryption on top of it, write speed is down to about 40 MB/s.
The RAID has a chunk size of 512K and a write intent bitmap. I used -c aes-xts-plain -s 512 --align-payload=2048 as the parameters for cryptsetup luksFormat, so the payload should be aligned to 2048 blocks of 512 bytes (i.e., 1MB). cryptsetup luksDump shows a payload offset of 4096. So I think the alignment is correct and fits to the RAID chunk size.
The CPU is not the bottleneck, as it has hardware support for AES (aesni_intel). If I write on another drive (an SSD with LVM) that is also encrypted, I do have a write speed of 150 MB/s. top shows that the CPU usage is indeed very low, only the RAID5 xor takes 14%.
I also tried putting a filesystem (ext4) directly on the unencrypted RAID so see if the layering is problem. The filesystem decreases the performance a little bit as expected, but by far not that much (write speed varying, but > 100 MB/s).
Summary:
Disks + RAID5: good
Disks + RAID5 + ext4: good
Disks + RAID5 + encryption: bad
SSD + encryption + LVM + ext4: good
The read performance is not affected by the encryption, it is 207 MB/s without and 205 MB/s with encryption (also showing that CPU power is not the problem). What can I do to improve the write performance of the encrypted RAID?
[1] All speed measurements were done with several runs of dd if=/dev/zero of=DEV bs=100M count=100 (i.e., writing 10G in blocks of 100M).
Edit: If this helps: I'm using Ubuntu 11.04 64bit with Linux 2.6.38. Edit2: The performance stays approximately the same if I pass a block size of 4KB, 1MB or 10MB to dd.
I'd like to know if there's a simple way to create a LUKS encryption drive with different passwords? A real one that leads to one set of data, and another that leads to a whole different set of data. Is this even possible with LUKS?
View 1 Replies View RelatedI had installed ubuntu, then windows xp, surprise surprise I lost the boot loader for ubuntu. I have 2 different live boot cd's one for 9.10 and another for 10.04. My PC would be running 10.04, if I could install grub. When I go to help on the live boot disk menu, it tells me that rescuing a broken system is not enabled on either disk, though I downloaded a full copy of the disk when I downloaded it. What can I do to get grub back onto my computer? I deleted the XP partition hoping that would help. It didn't now the pc will only boot when I have the live boot cd.
View 3 Replies View RelatedWhen I run the following GET commad:
./snmpget -m ALL -M /data/net/naamab/snmp/snmp_mib/ -v 3 -a MD5 -l authPriv -u test1 -A welcome1 -x DES -X privpass 127.0.0.1 NOVELSAT-MODULATOR-MIB::nsModLineCMMode.0 -d
I get the error:
Encryption support not enabled.
snmpget: USM encryption error
I have defined a user (and user, view and access) that should work with encryption:
snmpd.conf:
createUser test1 MD5 welcome1 DES privpass
group debugGroup usm test1
view debugView included .1
access debugGroup "" usm priv exact debugView debugView none
General details:
I am using net-snmp on linux embedded
version 5.5
Configuration (part of it):
./configure --target=mips64-octeon-linux-gnu
--build=mips64-octeon-linux-gnu
--host=i686-pc-linux-gnu
message dump:
Sending 64 bytes to UDP: [127.0.0.1]:161->[0.0.0.0]
0000: 30 3E 02 01 03 30 11 02 04 1D 23 6A FA 02 03 00 0>...0....#j....
0016: FF E3 04 01 04 02 01 03 04 10 30 0E 04 00 02 01 ..........0.....
0032: 00 02 01 00 04 00 04 00 04 00 30 14 04 00 04 00 ..........0.....
0048: A0 0E 02 04 4C 08 7B B5 02 01 00 02 01 00 30 00 ....L.{.......0.
Received 118 bytes from UDP: [127.0.0.1]:161->[0.0.0.0]
0000: 30 74 02 01 03 30 11 02 04 1D 23 6A FA 02 03 00 0t...0....#j....
0016: FF E3 04 01 00 02 01 03 04 24 30 22 04 11 80 00 .........$0"....
0032: 1F 88 80 2D 53 AF 7D 00 00 00 00 00 00 00 08 02 ...-S.}.........
0048: 02 02 CF 02 03 01 11 C5 04 00 04 00 04 00 30 36 ..............06
0064: 04 11 80 00 1F 88 80 2D 53 AF 7D 00 00 00 00 00 .......-S.}.....
0080: 00 00 08 04 00 A8 1F 02 04 4C 08 7B B5 02 01 00 .........L.{....
0096: 02 01 00 30 11 30 0F 06 0A 2B 06 01 06 03 0F 01 ...0.0...+......
0112: 01 04 00 41 01 09 ...A..
I know how to mount it manually. I've seen a howto on how to mount it automatically by loging in with the user, you type your username and password and it mounts your encrypted partition. But that's not what I want. My idea is to call cryptsetup and mount on boot, AND ask me for passphrase like when its loading the system, then if I don't type the right password it shouldn't mount /home, even though i type the correct USER password later when the system is loaded(and then I'd have an empty /home since my home partition wasn't mounted due to wrong passphrase).
This is what I tried: I added the commands to rc.local and I don't even feel like it was executed, no passphrase was asked. As a test if commands there were being executed, I tried simple commands lile mkdir /test and it worked. So commands there are executed, yet, no passphrase was asked to me, I looked on dmesg for crypt and found nothing, I pressed alt+ctrl+F1 desiring to find a passprhase-ask and again, nothing.
Is it possible to encrypt the entire drive and not be prompted for the passphrase?
I have a request for a demo of our application and I am looking to create a virtual for VMware's player but need to make sure that the vmdk file cannot be mounted and files pulled from it to protect us from reverse engineering of the application.
For some reason I can't find any documentation re: the algorithm(s) used by Ubuntu to encrypt the filesystem... Anyone know what it is?? AES?
View 2 Replies View RelatedI have a bunch of pictures that I thought I had backed up but as it turns out I didn't, the problem is I formatted the drive they were on.
It is a 1TB hard drive, and it was running Ubuntu 10.10 using full disk encryption from the alternate install CD. After formatting, I installed Ubuntu Server 10.10, also using full disk encryption.
I know the encryption key for both installs (and the keys in fact are the same).
I have turned off the machine, and have stopped writing to the disk. I am hoping because it is a 1TB drive, and I have only written over it with 2GB of data, that there is a chance I can recover the data.
I managed to get a cheap refurbed netbook recently (Samsung N150) and I'm wanting to put Ubuntu on it. As it's also likely to be used when travelling and have things like chat logs, photos, and other such things I'd like to do full disk encryption. Also I've been pointed towards 10.4 as apparently the 10.10 netbook desktop isn't to everyone's taste.
So I tried using unetbootin to make a bootable 10.4.1 i386 Alternate usb stick, which hit the problem of no cd drive. I found an item to add to the boot (cdrom-detect/try-usb=true) which got it a little further, but at a copying stage it threw an error saying it couldn't copy off the disc.
Finally I tried making a unetbootin of the mini iso (does mini even support full disk encryption?) but that seems to hang after selecting a mirror.
EDIT: Well it seems I was just impatient on the mini ISO and after a few minutes it's gone onto time-zone, though of course this could get rather tiresome without a local mirror, especially given this may go through more than one iteration.
i have hd encryption activated on my swap and home disks. now every 20 min or so (not really periodic but definetly reproduceable) my system hangs completely for about 4 - 10 sec while the hd led is on. i have a dual core cpu which makes this even more odd. could this be a side effect of hd encryption especially on the swap partition?
View 3 Replies View RelatedThe only reason why I don't use Linux (even though I prefer Linux over Windows, and can do everything faster and more efficiently) is because each time I try to learn about dm-crypt I give up.
Can someone point me in the right direction for full OTFE on Linux (like TrueCrypt)?
I do know about cold boot attacks. But I ran across a couple of posts/websites that had me wonder if it is possible, without the passphrase, to just remove the encryption?
View 4 Replies View RelatedWith all the talk about disk encryption for Apple devices, I wanted to ask about how full disk encryption compares between debian linux and mac OS X. Is the code for debian linux fully available for people to inspect for flaws or backdoors? Apparently although part of the encryption code is available for OS X the full code for Filevault 2 is not public. What are the advantages and disadvantages of each method of encryption for each operating system?
View 8 Replies View RelatedI've been using full disk encryption with luks on two Dell laptops for about 2.5 years. One is 64 bit Fedora (upgraded to 12), another is 32 bit Ubuntu (upgraded to 9.10), both were ext3, until recently.Over time, performance degraded substantially, especially on Fedora, which was put to a heavier use. That laptop has 4 Gb RAM, two 2.5 GHz T9300 CPUs, and 56 Gb of free space.
It was especially unbearable after a reboot. Programs like firefox and thunderbird would take close to a minute to start when ran for the first time after a boot. The login process was painfully slow, and some Gnome applets (e.g. Tomboy notes, keyboard layout switcher) would fail to load on the first login, with an error. I experienced this problem on both laptops with full encryption. I had to log out and relogin to make the applets appear. I tried various boot and mount options and was thinking about switching to ecryptfs (encrypted home).
I also use 3 desktops with no encryption and a netbook with ecryptfs on /home, which all work fine. All are Dell, 2 Ubuntu and 2 Fedora. The Gnome applets problem seems to be due to slowness of the installs with the full disk encryption. The last thing I tried is to migrate ext3 to ext4. I also converted /home, /usr, /opt to extents, following[URL].. That seemed to do the trick. Gnome applets now load fine on both laptops, and startup time is back to tolerable.
Is this a typical experience: ext3 performance degradation with time and a much better performance with full disk encryption once ext3 is migrated to ext4?
I've been wanting to do this for a while and after upgrading some of my pc components I decided I would finally try to dual boot with full disk encryption on both windows 7 and Ubuntu 9.10. I managed to encrypt the windows drive with truecrypt and that worked. I installed Ubuntu 9.10 using the alternate cd and everything but /boot is in an encrypted LVM. Each OS is on a separate SATA drive the windows is on sda1 and ubuntu /boot is sdb1.
To setup the dual boot I started out following the tutorial [url] but its for XP and versions of ubuntu that use grub not grub 2. I ran dd as posted and saved the files it produced from truecrypt. I then ran into some problems with grub reinstallation so I simply reinstalled Ubuntu 9.10 from scratch again. This put grub 2 on the computer. I've managed to get it to add a Windows 7 option.
However, when the option is selected truecrypt comes up and says that the bootloader is corrupted and that I need to use the repair CD I burned before I encrypted the drive. My question is does anyone have any experience dual booting using Truecrypt on Windows 7 and LUKS/dm-crypt on Ubuntu 9.10 with grub 2? And how would I get the boot menu to work? I'd rather not reinstall but if I have to I have images from right before I encrypted so it wouldn't be the end of the world.
To structure the layout of my partitions. I'm installing Windows 7, Backtrack 4 R2 and Ubuntu 10.10 Desktop on my laptop. I've got a 500 GB HDD named sda.
I've already installed Windows 7. It's my opinion that it's easiest to begin with Windows.
The partitions look like this right now:
The Windows installation is unencrypted and I want it to stay that way. It's only there in case my laptop gets stolen, I've installed various nasty things there.
The Backtrack 4 installation will also be given 100 GB space, I want it to be encrypted. The Ubuntu installation should get the rest of all the remaining space and preferably be encrypted but it's not 100% necessary.
How I should partition this? There's a limit on 4 primary partitions? How do I circumvent this? There should be one dedicated GRUB partition which will point to each of the installations own boot loaders?
I am investigating full disk encryption and have made a DD copy of the hard drive which has been encrypted, this DD file is stored on my computer for analysis.
First question is - Anyone know how i can access data in this DD file even though its been encrypted?
Second question - Is there a DD command where i can image the systems memory? I ask this because when a system is turned on, to get past the pre-boot authentication stage you need a password. From what i understand, this password will be passed in to ram when power is applied to the system. Making a copy of the memory will also copy the password?
I'm trying to migrate my LVs over to a Luks volume (prompt on password at boot). Unfortunately, as soon as I add my luks-encrypted physical volume to my volume group, I'm no longer able to update my grub configuration. I've detailed my steps below:
I've created and unlocked my encrypted partition with the following:
Code:
sudo cryptsetup -c aes-cbc-essiv:sha256 -y -s 256 luksFormat /dev/sdb1
sudo cryptsetup luksOpen /dev/sdb1 crypto_agilityssd
My /etc/crypttab looks like this:
[Code].....