TUCoPS :: Linux :: Discontinued :: encryptd.txt

Linux CFS and encrypted swap HOWTO

Tuxtendo Security
HOWTO on Linux CFS & Encrypted swap

--> Intro

Well, first of all why would you have CFS & Encrytped swap ?
Imagine some day.. your box being cracked by Evil Hacker X..

He could read all your personal stuff just by a keyboard click.
Besides that why would u need encrypted swap  ?,
well just to enlighten some people,  strings /dev/hda* (your swap device)
Makes good reading for rainiy & stormy day... I even saw my SSH public keys flying by.

Also imagine one day, you're Evil Hacker X, and the feds come to your house and put that AK47 up ya ass, thats not nice.
They take all your computers with them and then they research them for exploits, rootlists and so on.. and they find that stuff right there, unecrypted in your swap and/or harddrive.

So thats why we want ENCRYPTED SWAP & Filesystems, OpenBSD has it even default ! ( you can control that function in OpenBSD with sysctl -w, correct me if im wrong )

--> Preparations
Linux kernel 2.4.18: 

Linux 2.4.18 Encryption patch: http://www.nl.kernel.org/pub/linux/kernel/crypto/v2.4/testing/patch-int-

Linux 2.4.18 loop-hvr patch:


util-linux2.11o patch:

First of all we extract each package in our own dir ( we use /root/crypt-inst )
and extract the Linux kernel etc /usr/src/

--> Kernel compile

root@blitzkrieg:/usr/src/linux# pwd
root@blitzkrieg:/usr/src/linux# wget http://www.nl.kernel.org/pub/linux/kernel/crypto/v2.4/testing/patch-int-
--14:18:20--  http://www.nl.kernel.org/pub/linux/kernel/crypto/v2.4/testing/patch-int-
           => `patch-int-'
Connecting to wwwproxy.xs4all.nl:8080... connected!
Proxy request sent, awaiting response... 200 OK
Length: 105,658 [text/plain]

    0K .......... .......... .......... .......... .......... 48% @  35.64 KB/s
   50K .......... .......... .......... .......... .......... 96% @  77.64 KB/s
  100K ...                                                   100% @  90.90 KB/s

14:18:22 (49.51 KB/s) - `patch-int-' saved [105658/105658]

root@blitzkrieg:/usr/src/linux# gunzip -d patch-int-
root@blitzkrieg:/usr/src/linux# patch -p1 < patch-int-
<bla bla> patching stuff>

root@blitzkrieg:/usr/src/linux# wget http://www.nl.kernel.org/pub/linux/kernel/crypto/v2.4/testing/loop-hvr-
--14:19:13--  http://www.nl.kernel.org/pub/linux/kernel/crypto/v2.4/testing/loop-hvr-
           => `loop-hvr-'
Connecting to wwwproxy.xs4all.nl:8080... connected!
Proxy request sent, awaiting response... 200 OK
Length: 4,909 [text/plain]

    0K ....                                                  100% @  72.64 KB/s

14:19:13 (71.55 KB/s) - `loop-hvr-' saved [4909/4909]

root@blitzkrieg:/usr/src/linux# patch -p1 < loop-hvr-
patching file drivers/block/loop.c
patching file include/linux/loop.h

Ok thats all ! your kernel is now Crypto Enabled ! :)

-- err -NOT- First of all offcourse you need to configure it ;)

root@blitzkrieg:/usr/src/linux# make menuconfig
<bla bla>

Configure your kernel like u are used too.

When configuring look for:
          Block devices  --->       
            <*> Loopback device support       
     Cryptography support (CryptoAPI)  --->    
                       <*> CryptoAPI support (NEW)                       
			    -> Also * all sub
                       <*> Crypto Ciphers                                
			    -> Also * all sub
                       <*> Digest Algorithms                             
			    -> Also * all sub
                       <*> Crypto Devices                                
			    -> Also * all sub

e.g :

     <*> Crypto Devices                                                  
     <*>  Loop Crypto support                                            
     <*> Crypto Ciphers                                                  
     --- 128 bit blocksize                                               
     <*>  AES (aka Rijndael) cipher (NEW)                                

And so on...

Suggest that u put on all Crypto options..

after that
make dep; make bzImage; make modules and so on...

Reboot and ur all set !

root@blitzkrieg:/usr/src/linux# uname -a
Linux blitzkrieg 2.4.18-Crypto #1 Wed May 1 00:32:44 EDT 2002 i686 unknown

--> Util Linux

We extract the util-linux etc..
--14:31:03--  http://www.nl.kernel.org/pub/linux/utils/util-linux/util-linux-2.11o.tar.gz
           => `util-linux-2.11o.tar.gz'
Connecting to wwwproxy.xs4all.nl:8080... connected!
Proxy request sent, awaiting response... 200 OK
Length: 1,490,079 [application/x-tar]

root@blitzkrieg:~/crypt-in# tar -zxvf util-linux-2.11o.tar.gz
root@blitzkrieg:~/crypt-in/util-linux-2.11o# wget http://www.nl.kernel.org/pub/linux/kernel/people/hvr/util-linux-cryptoapi/util-linux-2.11o.patch.gz

root@blitzkrieg:~/crypt-in/util-linux-2.11o# gunzip -d util-linux-2.11o.patch.gz
root@blitzkrieg:~/crypt-in/util-linux-2.11o# patch -p0 < util-linux-2.11o.patch
< bla bla bla patching..)
root@blitzkrieg:~/crypt-in/util-linux-2.11o# ./configure; make; make install

Now everything is set! We first will create encrypted swap..

--> Encrypted swap partitions 
Ok this is tricky..

First off all disable your swap:
root@blitzkrieg:~# swapoff -a

Then you edit /etc/fstab:

/dev/hda2              swap                    swap    defaults        0 0

Change it to:
/dev/loop0              swap                    swap    defaults        0 0

after that: 
execute this command:

/bin/dd if=/dev/urandom bs=1 count=16 | \
    /sbin/losetup -e twofish -k 128 -p 0 /dev/loop0 /dev/hda2
/sbin/mkswap /dev/loop0
/sbin/swapon -a

And then your swap partition is encrypted !

But only for this runtime... put in /etc/rc.d/rc.sysinit like this:

-- CUT HERE --
# Now turn on swap in case we swap to files.
/bin/dd if=/dev/urandom bs=1 count=16 | \
    /sbin/losetup -e twofish -k 128 -p 0 /dev/loop0 /dev/hda6 1>/dev/null 2>/dev/null
/sbin/mkswap /dev/loop0 1>/dev/null 2>/dev/null
/sbin/swapon -a
action $"Enabling encryptedswap space: " /bin/true
-- CUT HERE --

After that reboot, and from now on, your swap paritions are encrypted..

--> Encrypted file systems

Encrypted folers / file systems is not very diferent..

First of all become a "simple" user..

then execute
Where BS = Bytes (1024k = 1 MB) And then how many times (count=10) so it would create a 10 MB disk...

rayden@blitzkrieg:~$ dd if=/dev/urandom of=~/.crypto bs=1024k count=10

after that become root and execute:

root@blitzkrieg:/home/rayden# losetup -e blowfish /dev/loop1 /home/rayden/.crypto
Available keysizes (bits): 128 160 192 256
Keysize: 256

ALWAYS use loop1 !! becuase loop0 is already in use.. when creating multiple swap / folders use it like /dev/loop0 /dev/loop1

After that we are going to encrypt our encrypted folder like:
root@blitzkrieg:/home/rayden# mke2fs /dev/loop1

Then we create the mount point for it.
rayden@blitzkrieg:~$ mkdir ~/crypto

After that we are going to mount it, ( notice the dot!)

oot@blitzkrieg:/home/rayden# mount -t ext2 /dev/loop1 /home/rayden//crypto

If all worked well, you now have a filesystem that encryptedly resides in the file ~/.crypto and is mounted on ~/crypto. 

root@blitzkrieg:/home/rayden# mount -t ext2 /dev/loop1 /home/rayden/crypto

When u are done, set permissions right (chmod etc) and unmount the filesystem:
root@blitzkrieg:/home/rayden# umount /dev/loop0
root@blitzkrieg:/home/rayden# losetup -d /dev/loop0

After that put in /etc/fstab
home/rayden/.crypto  /home/rayden/crypto  ext2  \
      defaults,noauto,loop,encryption=blowfish,user  0   0

So you always can mount the file system at command

If everything worked well u now can mount the file system

rayden@blitzkrieg:~$ mount /home/rayden/crypto
Available keysizes (bits): 128 160 192 256
Keysize: 256

--> Final 

Hey, so thats about it ! Now u have encrypted filesystems + swap which should it make more harder for the feds / or the hacker to find out about your data ;)

But it improves privacy in generally too..

Dont forget to umount and losetup -d /dev/loop* everytime when you finished working!

Well thats all for now, checkout http://www.tuxtendo.nl/ for latest updates etc

Flames / comments etc can be send to info@tuxtendo.nl

TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2024 AOH