Encrypted Filesystems - Revision history

Sidetone at 08:40, 1 November 2015

2015-11-01T08:40:41Z

Sidetone: /* Swap encryption through /etc/fstab */

2015-11-01T08:35:15Z

Swap encryption through /etc/fstab

Sidetone: /* Swap encryption through /etc/fstab */

2015-10-30T20:33:58Z

Swap encryption through /etc/fstab

Sidetone: /* Swap encryption through /etc/fstab */

2015-10-30T13:31:36Z

Swap encryption through /etc/fstab

Sidetone: /* Swap encryption through /etc/fstab */

2015-10-30T13:30:31Z

Swap encryption through /etc/fstab

Sidetone: /* Swap encryption through /etc/fstab */

2015-10-30T13:29:39Z

Swap encryption through /etc/fstab

Sidetone at 19:59, 17 December 2014

2014-12-17T19:59:35Z

Sidetone: swap encryption. There are a few styles to encrypt, perhaps the information can be combined, but I haven't gone through it.

2014-12-17T19:57:09Z

swap encryption. There are a few styles to encrypt, perhaps the information can be combined, but I haven't gone through it.

Jimbo: Reverted edits by 93.74.109.164 (Talk); changed back to last version by Jimbo

2009-10-24T14:30:06Z

Reverted edits by 93.74.109.164 (Talk); changed back to last version by Jimbo

93.74.109.164 at 03:19, 24 October 2009

2009-10-24T03:19:08Z

@@ Line 11: / Line 11: @@
 ==Swap encryption through /etc/fstab==
 Swap encryption is useful to keep passwords and other confidential information out of view.
-To encrypt swap partitions the {{man|geli|8}} program is useful. Open the file {{file|/etc/fstab}} and add {{code|.eli}} at the end of the swap device, under the colum #Device. For example:
+To encrypt swap partitions the {{man|geli|8}} program is useful. Open the file {{file|/etc/fstab}} and add {{code|.eli}} at the end of the swap device, under the column #Device. For example:
   #Device			Mountpoint		Fstype		Options		Dump		Pass#
   /dev/ada0p1.eli		none			swap		sw		0		0
@@ Line 69: / Line 69: @@
   # '''df -h'''
 You can automount encrypted partitions with 2 rc.conf variables:
@@ Line 77: / Line 75: @@
   gbde_devices="encrypteddrivedeveicename"
 [[Category:Common Tasks]]
 [[Category: Securing FreeBSD]]

@@ Line 11: / Line 11: @@
 ==Swap encryption through /etc/fstab==
 Swap encryption is useful to keep passwords and other confidential information out of view.
-To encrypt swap partitions the {{man|geli(8)}} program is useful. Open the file {{file|/etc/fstab}} and add {{code|.eli}} at the end of the swap device, under the colum #Device. For example:
+To encrypt swap partitions the {{man|geli|8}} program is useful. Open the file {{file|/etc/fstab}} and add {{code|.eli}} at the end of the swap device, under the colum #Device. For example:
   #Device			Mountpoint		Fstype		Options		Dump		Pass#
   /dev/ada0p1.eli		none			swap		sw		0		0

@@ Line 11: / Line 11: @@
 ==Swap encryption through /etc/fstab==
 Swap encryption is useful to keep passwords and other confidential information out of view.
-To encrypt swap partitions the {{cmd|geli}} program is useful. Open the file {{file|/etc/fstab}} and add {{code|.eli}} at the end of the swap device, under the colum #Device. For example:
+To encrypt swap partitions the {{man|geli(8)}} program is useful. Open the file {{file|/etc/fstab}} and add {{code|.eli}} at the end of the swap device, under the colum #Device. For example:
   #Device			Mountpoint		Fstype		Options		Dump		Pass#
   /dev/ada0p1.eli		none			swap		sw		0		0

@@ Line 14: / Line 14: @@
   #Device			Mountpoint		Fstype		Options		Dump		Pass#
   /dev/ada0p1.eli		none			swap		sw		0		0
-The above alone is sufficient to encrypt swap.
+The above and a reboot are sufficient to encrypt swap.
 The gbde program can also be used to encrypt swap space. It uses the {{code|.bde}} suffix in the {{file|/etc/fstab}} file. Please read it's manpage for details, and read below.

@@ Line 11: / Line 11: @@
 ==Swap encryption through /etc/fstab==
 Swap encryption is useful to keep passwords and other confidential information out of view.
-To encrypt swap partitions the geli program is useful. Open the file {{file|/etc/fstab}} and add {{code|.eli}} at the end of the swap device, under the colum #Device. For example:
+To encrypt swap partitions the {{cmd|geli}} program is useful. Open the file {{file|/etc/fstab}} and add {{code|.eli}} at the end of the swap device, under the colum #Device. For example:
   #Device			Mountpoint		Fstype		Options		Dump		Pass#
   /dev/ada0p1.eli		none			swap		sw		0		0

@@ Line 9: / Line 9: @@
 There are two programs used to encrypt file systems, which are gdbe and geli.
-==Swap encryption==
+==Swap encryption through /etc/fstab==
 Swap encryption is useful to keep passwords and other confidential information out of view.
 To encrypt swap partitions the geli program is useful. Open the file /etc/fstab and add '''.eli''' at the end of the swap device, under the colum #Device. For example:
   #Device			Mountpoint		Fstype		Options		Dump		Pass#
   /dev/ada0p1.eli		none			swap		sw		0		0
-The gbde program can also be used to encrypt swap space. It uses the .bde suffix in the ''/etc/fstab'' file.
+The gbde program can also be used to encrypt swap space. It uses the .bde suffix in the ''/etc/fstab'' file. Please read it's manpage for details, and read below.
 ==Configuration==

@@ Line 6: / Line 6: @@
 First thing is to man the above commands, and take a look at the "Encrypted Filesystem" example in the FreeBSD Handbook.  This is an extension of the example found in the handbook.
 ==Configuration==
@@ Line 11: / Line 21: @@
 Load GEOM_BDE support into the kernel.  (Note: if you wish, you may also add GEOM_BDE support to the kernel statically and recompile it - use ''options GEOM_BDE''.)
-  masta# '''kldload geom_bde'''
+  # '''kldload geom_bde'''
 If you chose to use dynamic GEOM kernel support instead of recompiling it into the kernel, you may also want to make sure it's autoloaded at boot time from here on out:
-  masta# '''echo geom_bde_load="YES" >> /boot/loader.conf'''
+  # '''echo geom_bde_load="YES" >> /boot/loader.conf'''
 Create a few directories. One for lock files, and the other for a mount point.
-  masta# '''mkdir /private'''
+  # '''mkdir /private'''
-  masta# '''mkdir /etc/gbde'''
+  # '''mkdir /etc/gbde'''
 Create an empty image file of 1000Mb.
@@ Line 29: / Line 39: @@
 Create a virtual device that points the empty file.
-  masta# '''mdconfig -a -t vnode -u 9 -f /usr/local/cryptfs.img'''
+  # '''mdconfig -a -t vnode -u 9 -f /usr/local/cryptfs.img'''
 Invoke the gbde program on the new virtual device.  This will ask for a passphrase twice, and open an editor.
-  masta# '''gbde init /dev/md9 -i -L /etc/gbde/md9'''
+  # '''gbde init /dev/md9 -i -L /etc/gbde/md9'''
 In the Editor, alter the "sector_size" line, and exit.
@@ Line 43: / Line 53: @@
 Invoke the gbde program to attach the image file to the kernel.
-  masta# '''gbde attach /dev/md9 -l /etc/gbde/md9'''
+  # '''gbde attach /dev/md9 -l /etc/gbde/md9'''
 NOTE: You will be prompted for the passphrase.
@@ Line 49: / Line 59: @@
 Format the attached image with UFS2:
-  masta# '''newfs -U -O2 /dev/md9.bde'''
+  # '''newfs -U -O2 /dev/md9.bde'''
 Now mount the md9.bde filesystem to the mount-point we created earlier.
-  masta# '''mount /dev/md9.bde /private'''
+  # '''mount /dev/md9.bde /private'''
 Check to make sure everthing worked.
-  masta# '''df -h'''
+  # '''df -h'''
-NOTE: this article was reproduced and minorly reformatted from http://www.ezunix.org/modules.php?op=modload&name=Sections&file=index&req=viewarticle&artid=67&page=1 and has not been tested for accuracy.
+NOTE: this article was reproduced and minorly reformatted from http://www.ezunix.org/modules.php?op=modload&name=Sections&file=index&req=viewarticle&artid=67&page=1 and has not been tested for accuracy. Information on updates to encrypt swap are based on Network Administration with FreeBSD7.
 You can automount encrypted partitions with 2 rc.conf variables:

← Older revision		Revision as of 14:30, 24 October 2009
Line 20:		Line 20:

	masta# '''mkdir /private'''		masta# '''mkdir /private'''
−	masta# '''mkdir /etc	+	masta# '''mkdir /etc/gbde'''
		+
		+	Create an empty image file of 1000Mb.
		+
		+	masta# '''touch /usr/local/cryptfs.img'''
		+	masta# '''dd if=/dev/zero of=/usr/local/cryptfs.img bs=1024k count=1000'''
		+
		+	Create a virtual device that points the empty file.
		+
		+	masta# '''mdconfig -a -t vnode -u 9 -f /usr/local/cryptfs.img'''
		+
		+	Invoke the gbde program on the new virtual device. This will ask for a passphrase twice, and open an editor.
		+
		+	masta# '''gbde init /dev/md9 -i -L /etc/gbde/md9'''
		+
		+	In the Editor, alter the "sector_size" line, and exit.
		+
		+	'''g/sector_size = 512/s//sector_size = 2048/g'''
		+
		+	NOTE: You should have a /dev/md9.bde device-node.
		+
		+	Invoke the gbde program to attach the image file to the kernel.
		+
		+	masta# '''gbde attach /dev/md9 -l /etc/gbde/md9'''
		+
		+	NOTE: You will be prompted for the passphrase.
		+
		+	Format the attached image with UFS2:
		+
		+	masta# '''newfs -U -O2 /dev/md9.bde'''
		+
		+	Now mount the md9.bde filesystem to the mount-point we created earlier.
		+
		+	masta# '''mount /dev/md9.bde /private'''
		+
		+	Check to make sure everthing worked.
		+
		+	masta# '''df -h'''
		+
		+	NOTE: this article was reproduced and minorly reformatted from http://www.ezunix.org/modules.php?op=modload&name=Sections&file=index&req=viewarticle&artid=67&page=1 and has not been tested for accuracy.
		+
		+	You can automount encrypted partitions with 2 rc.conf variables:
		+
		+	gbde_autoattach_all="YES"
		+	gbde_devices="encrypteddrivedeveicename"
		+
		+
		+	[[Category:Common Tasks]]
		+	[[Category: Securing FreeBSD]]