[dm-crypt] Encrypt all partitions with dm-crypt
arno at wagner.name
Thu Sep 6 18:46:59 CEST 2012
On Thu, Sep 06, 2012 at 04:54:18PM +0400, Stayvoid wrote:
> > You solution will work though, although if you do it with
> >? dd_rescue /dev/urandom /dev/sda
> > you get a progess indicator.
> In that case it's also possible to check the progress like this:
> $ kill -USR1 $(pidof dd)
> (This should be typed in another terminal.)
> > No. You just map it like you stated and then create the filesystem
> > on the mapped device.
> How to map it? Will the following work?
> $ cryptsetup create /dev/sda2 boot
> $ cryptsetup create /dev/sda3 main
Yes, "create" is the mapping command for plain dm-crypt.
> > mkswap /dev/mapper/main
> Is this a typo? I guess that it should be changed to:
> mkswap /dev/mapper/swap
> > No idea. Suspend-to-disk is insecure unless done right and it
> > needs to be done right by your distro.
> What about this option ?
> Is it secure?
Well, it does not have the security problems of suspend-to-disk
at least ;-)
Whether it is ecyure depends on some factors. For example, you
need a high-entropy passphrase for plain dm-crypt to be secure.
See FAQ for more info.
> I know that some people don't use swap at all because of security issues.
> But I'd like to use it.
Encrypted swap is generally fine, as long as it gets a random
encryption key on system boot. I have been doing that for a
while now, no problems.
> By the way, are there any differences between a swap partition and a
> swap file (in terms of security)?
Depends. For example, if you use a journaling filesystem or a filesystem
where writes may not overwrite old data, stuff can survive far longer
than expected. The same can happen with SWAP on SSD, even if ut
goes to its own partition.
Usually, the secure option is to use swap on a magnetic disk
that is encrypted with a random key chosen at system boot. If
you are paranoid, change the key periodically (cron-job).
>  https://wiki.archlinux.org/index.php/Dm-crypt_with_LUKS#Without_suspend-to-disk_support
> dm-crypt mailing list
> dm-crypt at saout.de
Arno Wagner, Dr. sc. techn., Dipl. Inform., Email: arno at wagner.name
GnuPG: ID: 1E25338F FP: 0C30 5782 9D93 F785 E79C 0296 797F 6B50 1E25 338F
One of the painful things about our time is that those who feel certainty
are stupid, and those with any imagination and understanding are filled
with doubt and indecision. -- Bertrand Russell
More information about the dm-crypt