How to make a linux's user just reasonabily hidden?

kozaki · 2012-01-26 18:54:18

Here's a case I didn't find a clue in the Wiki or the forum (something that barely happen before!)

Take a casual netbook that should look casual, even when opened (by a non geek).
Bob needs a hidden HOME with a few GB of private data and a few apps, that he'll use everyday. Note that by "hidden" he just means not easily visible unless Bob wants it (and of course unless someone has both the required time and technical knowledge).

Few points so far to achieve this:

1) an additional HOME for Bob, that won't stand in /home
A working user's HOME directory do not have to be in /home (as quoted by /dev/zero in this thread). Fine

The netbook comes with both Windows and Linux, so makes it boot straight into M$ when u don't touch it.
I haven't considered the boot process any further. Maybe there's something smarter than a GRUB wich boots straight into Windows, says, using the Windows bootloader? Never used that software so I dunno. Idea: Add a windo-ish background to the bootloader (at least I know how to to with GRUB if it's still able to boot into Arch?). See what the Tail smart guys do with the desktop bg: Booting Tails with Windows camouflage

2) Encrypt that user's HOME
Goals:
- Primarily, will assure that his data won't be indexed nor easily searchable (without the user being logged in).
- Secondarily, should allow for deniable data (Deniable Encryption).
- Thirdly, the fact that there's encrypted stuff on this laptop should not be easily visible,

So far this step comes with its own issues.
Can't encrypt the whole filesystem or even a plain partition, which I believe makes LUKS encryption a no-go
According to anrxc's eCryptfs and $HOME howto, it creates bob's directory in /home/.ecryptfs --even with his actual HOME is somewhere else:

Adrian C. wrote:

Directory /home/.ecryptfs is owned by root and it is a central place for everything related to eCryptfs and user accounts. Everything under /home/.ecryptfs/user...

As for Creating a hidden volume with TrueCrypt, I've never used it. Look like doesn't fit to encrypt a full user's HOME.

Also and since Bob needs no more than a few GB of space, I can put his home on a separate encrypted SD Card as quoted by Stebalien. And decrypt/mount the SD Card over your actual home when you want to login to your "special" home.
But AFAIK (maybe i'm dumb) this leaves his actual home folder in /home/bob (or in /home/.ecryptfs/bob which is better but a bit short for the purpose `:-).

Would you know any other options?

PS It is interesting how hard it looks at least to me, to address both the situations on one computer:
A) the computer should be as usable and connected as possible --for Bob,
B) it shoud look as "casual" as possible, and protect Bob's private stuff in an efficient way.
And it should pass from A to B, and B to A in a breeze!

EDIT:
[+] Tail's "Windows camouflage" exemple

Last edited by kozaki (2012-01-26 20:12:38)

eldragon · 2012-01-26 21:25:07

boot off an external usb drive, where its primary partition is just a NTFS partition (to the look of a casual eye).
have the linux partition encrypted with your favorite tool.

Last edited by eldragon (2012-01-26 21:36:52)

Leonid.I · 2012-01-26 22:09:45

And what's wrong with ecryptfs container diguised as "My Music"?

Stebalien · 2012-01-27 05:49:53

kozaki wrote:

But AFAIK (maybe i'm dumb) this leaves his actual home folder in /home/bob (or in /home/.ecryptfs/bob which is better but a bit short for the purpose `:-).

This leaves his actual home folder on an encrypted SD card and a fake decoy home folder in /home/bob. When bob wants to login to his real account, he mounts the SD card over /home/bob. When he wants to be "innocent", he doesn't mount the SD card. However, this does reveal the existence of a user named bob (but I can't see how that could be a problem).

If you don't mind leaving traces, you can setup pam_mount to automount/decrypt the SD card on login if it is plugged in.

/dev/zero · 2012-01-27 06:20:27

I guess what worries me about making less careful recommendations in that other thread, is this: you're making it sound like a big spy-drama thingy, which could get people killed.

If you're just trying to hide a bit of porn, then sure, I'm sure we can all jump in with our relevant experiences.

Arch Linux

#1 2012-01-26 18:54:18

How to make a linux's user just reasonabily hidden?

#2 2012-01-26 21:25:07

Re: How to make a linux's user just reasonabily hidden?

#3 2012-01-26 22:09:45

Re: How to make a linux's user just reasonabily hidden?

#4 2012-01-27 05:49:53

Re: How to make a linux's user just reasonabily hidden?

#5 2012-01-27 06:20:27

Re: How to make a linux's user just reasonabily hidden?

Board footer