System encryption

netpumber · 2012-12-13 09:00:22

These days im trying to figure out a way to encrypt my system. To be true i prefer to encrypt the whole system. So i tried to find the ways.

Till now 2 ways found interested

1) LUKS and dm-crypt
and
2) to run my linux in a VM and encrypt that VM. Searched in google and found openVZ (runing in CentOS). But i don't know if it is working with arch linux. (does anyone know?)
I think that the second solution is more secure.

If anyone has an idea on this method (2nd) his idea is welcomed.

Thank you.

cfr · 2012-12-14 01:10:19

https://wiki.archlinux.org/index.php/Encryption

Just curious: why is the second method more secure? (Obviously it will be if you need to isolate multiple OSs on a single server b/c they will be isolated from each other. But if you need that, method 1 wouldn't help at all...)

Last edited by cfr (2012-12-14 01:17:27)

evr · 2012-12-14 21:01:49

I don't see any reason why the second method would be more secure than the first.

As a side note, it looks like there is a linux-openvz package in the AUR.

hunterthomson · 2012-12-16 10:25:20

What you want to do is this setup...
LVM on LUKS/dm-crypt
GRUB and /boot on a USB stick

https://bbs.archlinux.org/viewtopic.php?id=152117

Owe, and you do not need to parition the drive before you encrypt it. You can encrypt /dev/sda with no paritions. I am thinking of re-doing my setup.

You also do not need to use LVM.
You can encrypt all of /dev/sda and then create a MBR or GPT ontop of the /dev/mapper/crypt Then setup your paritions, but I would say use LVM.

Last edited by hunterthomson (2012-12-16 10:28:35)

Cygnet_Committee · 2012-12-19 09:51:07

hunterthomson wrote:

Owe, and you do not need to parition the drive before you encrypt it. You can encrypt /dev/sda with no paritions. I am thinking of re-doing my setup.
You also do not need to use LVM.
You can encrypt all of /dev/sda and then create a MBR or GPT ontop of the /dev/mapper/crypt Then setup your paritions, but I would say use LVM.

Not to hijack this thread or anything, but I just did a fresh install using LVM on LUKS like on the wiki and I did not encrypt my /dev/sdaX boot partition... should I have?

hunterthomson · 2012-12-19 10:42:13

Cygnet_Committee wrote:

Not to hijack this thread or anything, but I just did a fresh install using LVM on LUKS like on the wiki and I did not encrypt my /dev/sdaX boot partition... should I have?

No, you can not encrypt your /boot partition.

GRUB, nor any other Linux boot loader I know of can decrypt anything. So, everything in /boot can not be encrypted. That is why I put /boot on a USB stick. I also installed GRUB on the USB stick. Then I added the "noauto" mount flag to the /boot line in /etc/fstab This way you can pull out the USB stick after boot up and you are at the Log-In screen. The idea is that the USB stick can be on your keychain all the time, so you know it is secure.

The best way to go if you have an Optical drive is to create a GRUB boot CD :-D

https://bbs.archlinux.org/viewtopic.php?id=144100

NOTE: I never did get around to writing a wiki page for it....

Last edited by hunterthomson (2012-12-19 10:44:54)

Cygnet_Committee · 2012-12-19 10:46:03

hunterthomson wrote:

Cygnet_Committee wrote:
Not to hijack this thread or anything, but I just did a fresh install using LVM on LUKS like on the wiki and I did not encrypt my /dev/sdaX boot partition... should I have?
No, you can not encrypt your /boot partition.
GRUB, nor any other Linux boot loader I know of, can decrypt anything. So, everything in /boot can not be encrypted. That is why I put /boot on a USB stick. I also installed GRUB on the USB stick. Then I added the "noauto" mount flag to the /boot line in /etc/fstab This way you can pull out the USB stick after boot up and you are at the Log-In screen. The idea is that the USB stick can be on your keychain all the time, so you know it is secure.
The best way to go if you have an Optical drive is to create a GRUB boot CD :-D
https://bbs.archlinux.org/viewtopic.php?id=144100
NOTE: I never did get around to writing a wiki page for it....

Thanks, I'll give the usb boot a try one of these days.

Strike0 · 2012-12-19 21:48:35

If you go that far to put your /boot on an USB, you might also or still want to ensure its integrity stays the same.

One way to do that is to use the little chkboot script in the wiki. It takes a few seconds to complete because it checksums all inodes on the partition. Keeping /boot as small as possible helps for that a bit obviously.

But to the topic of the thread, I am also interested to learn about what is meant with the second method by netpumber. Can you explain that again with a bit more background? Why encrypt the VM?

hunterthomson · 2012-12-27 03:33:24

Strike0 wrote:

I
But to the topic of the thread, I am also interested to learn about what is meant with the second method by netpumber. Can you explain that again with a bit more background? Why encrypt the VM?

I am asuuming it was a logical error on his part.

When you encrypt the VM disk image ALL of it is encrypted, but on host encryption you can not encrypt the bootloader, kernel, or initramfs. So, he was thinking that the full encryption of the VM would be more secure.

However, the same problem is still there. While the bootloader, kernel, and initramfs are encrypted on the VM diskimage it is being decrypted by the Host OS which could be compromised just like the unencrypted bootloader, kernel, or initramfs on the Host. In other words, it is only shifting the vulnerability to a different place not solving it.

The only way to solve this vulnerability is to use a GRUB boot CD. That way the bootloader, kernel, and initramfs are on Read-only media.

Arch Linux

#1 2012-12-13 09:00:22

System encryption

#2 2012-12-14 01:10:19

Re: System encryption

#3 2012-12-14 21:01:49

Re: System encryption

#4 2012-12-16 10:25:20

Re: System encryption

#5 2012-12-19 09:51:07

Re: System encryption

#6 2012-12-19 10:42:13

Re: System encryption

#7 2012-12-19 10:46:03

Re: System encryption

#8 2012-12-19 21:48:35

Re: System encryption

#9 2012-12-27 03:33:24

Re: System encryption

Board footer