EncryptedVarWithUSBKey

I wanted to encrypt the /var of our servers and have a USB flash stick as the 'key'. This process requires two steps, first create the partitions and install the operating system and second do the proper modifications that will enable the partition to be mounted on boot.

I first created a root partition "/" in /dev/hda1, a var partition "/var" in /dev/hda2 and a swap partition in /dev/hda3.

I then installed Fedora Core 6 on the system, i performed all the disk partitioning via the Fedora's anaconda installer, but that shouldn't be any different from any other linux distribution. After the installation is complete, you may boot the system and start creating the encrypted partition.


Now, here comes the weird part. Since /var is an important path and linux requires it to boot and run (its not like we are encrypting the /home partition, since there we can just login as root and the entire /home won't be marked as 'in use').

In other words, we have to: 1) copy the entire /var structure in a temporary directory, unmount /var, encrypt the /var partition, re-create an ext3 filesystem in it, mount it, and move back the structure from our temp dir into our newly encrypted partition.

Here are the steps (comments are in parenthesis):


Before we mount the partition we need to use the mapper device we created with the 'luksOpen' command above. Thus, edit your /etc/fstab and change the "/dev/hda2" entry to "/dev/mapper/var" and dont let it be checked on boot for errors, for example:



change to:



Now we may continue:


End of part 1.



In part 2 we need to modify our system to be able to boot properly, mount the encrypted /var partition by loading the key file from a USB stick.

First, create the /etc/crypttab file with a line like this:



Then edit your /etc/rc.sysinit, find the line that says "Starting disk encryption:" and just before the call to init_crypto add the following lines:



Thats it, you may now reboot and the system will be fully working (as long as your USB flash stick is plugged in).

End of part 2.



Each step in the above process has some pitfalls. The first problem is usualy encountered when altering a usable partition or directory. For example in our case the /var partition. There won't be any issues if the process is done as single user mode (no services accessing /var, etc).

If you are installing on a new system you don't need to modify a live /var partition. Just install the entire operating system on / (root) and after the installation is complete you may create the partition which will hold /var and run cryptsetup on it without any worries. Ofcourse you still need to switch to single user mode to remove the original /var and replace it with our encrypted /dev/mapper/var.

In case you get a "Command failed" error when running cryptsetup, you probably didn't type the "YES" answer in all capitals.

If you get error messages about key failure, then you probably haven't got the right modules loaded. Execute "modprobe dm-crypt" and "modprobe aes", you may ofcourse load other crypto modules like "modprobe twofish".

Using /dev/scd1 or whatever to access your USB flash key is not a very portable solution. Instead, you may use the USB ID of the device to mount it, which is always going to be accessible no matter which USB port/hub you use.
PHP Project
Be careful when updating RPM packages. The /etc/rc.sysinit file will be replaced when you update the "initscripts" package and you won't be able to boot your system.

Helpful resources:
Custom term papers


-- Dimitrios Michelinakis (dimitris@michelinakis.gr)