Encrypted Filesystems
m (Reverted edits by 93.74.109.164 (Talk); changed back to last version by Jimbo) |
(swap encryption. There are a few styles to encrypt, perhaps the information can be combined, but I haven't gone through it.) |
||
| Line 6: | Line 6: | ||
First thing is to man the above commands, and take a look at the "Encrypted Filesystem" example in the FreeBSD Handbook. This is an extension of the example found in the handbook. | First thing is to man the above commands, and take a look at the "Encrypted Filesystem" example in the FreeBSD Handbook. This is an extension of the example found in the handbook. | ||
| + | |||
| + | There are two programs used to encrypt file systems, which are gdbe and geli. | ||
| + | |||
| + | ==Swap encryption== | ||
| + | Swap encryption is useful to keep passwords and other confidential information out of view. | ||
| + | To encrypt swap partitions the geli program is useful. Open the file /etc/fstab and add '''.eli''' at the end of the swap device, under the colum #Device. For example: | ||
| + | #Device Mountpoint Fstype Options Dump Pass# | ||
| + | /dev/ada0p1.eli none swap sw 0 0 | ||
| + | |||
| + | The gbde program can also be used to encrypt swap space. It uses the .bde suffix in the ''/etc/fstab'' file. | ||
==Configuration== | ==Configuration== | ||
| Line 11: | Line 21: | ||
Load GEOM_BDE support into the kernel. (Note: if you wish, you may also add GEOM_BDE support to the kernel statically and recompile it - use ''options GEOM_BDE''.) | Load GEOM_BDE support into the kernel. (Note: if you wish, you may also add GEOM_BDE support to the kernel statically and recompile it - use ''options GEOM_BDE''.) | ||
| − | + | # '''kldload geom_bde''' | |
If you chose to use dynamic GEOM kernel support instead of recompiling it into the kernel, you may also want to make sure it's autoloaded at boot time from here on out: | If you chose to use dynamic GEOM kernel support instead of recompiling it into the kernel, you may also want to make sure it's autoloaded at boot time from here on out: | ||
| − | + | # '''echo geom_bde_load="YES" >> /boot/loader.conf''' | |
Create a few directories. One for lock files, and the other for a mount point. | Create a few directories. One for lock files, and the other for a mount point. | ||
| − | + | # '''mkdir /private''' | |
| − | + | # '''mkdir /etc/gbde''' | |
Create an empty image file of 1000Mb. | Create an empty image file of 1000Mb. | ||
| Line 29: | Line 39: | ||
Create a virtual device that points the empty file. | Create a virtual device that points the empty file. | ||
| − | + | # '''mdconfig -a -t vnode -u 9 -f /usr/local/cryptfs.img''' | |
Invoke the gbde program on the new virtual device. This will ask for a passphrase twice, and open an editor. | Invoke the gbde program on the new virtual device. This will ask for a passphrase twice, and open an editor. | ||
| − | + | # '''gbde init /dev/md9 -i -L /etc/gbde/md9''' | |
In the Editor, alter the "sector_size" line, and exit. | In the Editor, alter the "sector_size" line, and exit. | ||
| Line 43: | Line 53: | ||
Invoke the gbde program to attach the image file to the kernel. | Invoke the gbde program to attach the image file to the kernel. | ||
| − | + | # '''gbde attach /dev/md9 -l /etc/gbde/md9''' | |
NOTE: You will be prompted for the passphrase. | NOTE: You will be prompted for the passphrase. | ||
| Line 49: | Line 59: | ||
Format the attached image with UFS2: | Format the attached image with UFS2: | ||
| − | + | # '''newfs -U -O2 /dev/md9.bde''' | |
Now mount the md9.bde filesystem to the mount-point we created earlier. | Now mount the md9.bde filesystem to the mount-point we created earlier. | ||
| − | + | # '''mount /dev/md9.bde /private''' | |
Check to make sure everthing worked. | Check to make sure everthing worked. | ||
| − | + | # '''df -h''' | |
| − | NOTE: this article was reproduced and minorly reformatted from http://www.ezunix.org/modules.php?op=modload&name=Sections&file=index&req=viewarticle&artid=67&page=1 and has not been tested for accuracy. | + | NOTE: this article was reproduced and minorly reformatted from http://www.ezunix.org/modules.php?op=modload&name=Sections&file=index&req=viewarticle&artid=67&page=1 and has not been tested for accuracy. Information on updates to encrypt swap are based on Network Administration with FreeBSD7. |
You can automount encrypted partitions with 2 rc.conf variables: | You can automount encrypted partitions with 2 rc.conf variables: | ||
Revision as of 14:57, 17 December 2014
Introduction
You might be asking yourself what is an encrypted filesystem good for? There are many answers, and a few might be storage of: RSA private keys, password lists, tripwire checksums, Mafia book keeping, plans for world domination, or whatever you can think of! When the men in black suits come to get your private info, they will have a very difficult job. You will be using the following commands in this exercises: dd, df, gbde, mdconfig, and mount.
First thing is to man the above commands, and take a look at the "Encrypted Filesystem" example in the FreeBSD Handbook. This is an extension of the example found in the handbook.
There are two programs used to encrypt file systems, which are gdbe and geli.
Swap encryption
Swap encryption is useful to keep passwords and other confidential information out of view. To encrypt swap partitions the geli program is useful. Open the file /etc/fstab and add .eli at the end of the swap device, under the colum #Device. For example:
#Device Mountpoint Fstype Options Dump Pass# /dev/ada0p1.eli none swap sw 0 0
The gbde program can also be used to encrypt swap space. It uses the .bde suffix in the /etc/fstab file.
Configuration
Load GEOM_BDE support into the kernel. (Note: if you wish, you may also add GEOM_BDE support to the kernel statically and recompile it - use options GEOM_BDE.)
# kldload geom_bde
If you chose to use dynamic GEOM kernel support instead of recompiling it into the kernel, you may also want to make sure it's autoloaded at boot time from here on out:
# echo geom_bde_load="YES" >> /boot/loader.conf
Create a few directories. One for lock files, and the other for a mount point.
# mkdir /private # mkdir /etc/gbde
Create an empty image file of 1000Mb.
masta# touch /usr/local/cryptfs.img masta# dd if=/dev/zero of=/usr/local/cryptfs.img bs=1024k count=1000
Create a virtual device that points the empty file.
# mdconfig -a -t vnode -u 9 -f /usr/local/cryptfs.img
Invoke the gbde program on the new virtual device. This will ask for a passphrase twice, and open an editor.
# gbde init /dev/md9 -i -L /etc/gbde/md9
In the Editor, alter the "sector_size" line, and exit.
g/sector_size = 512/s//sector_size = 2048/g
NOTE: You should have a /dev/md9.bde device-node.
Invoke the gbde program to attach the image file to the kernel.
# gbde attach /dev/md9 -l /etc/gbde/md9
NOTE: You will be prompted for the passphrase.
Format the attached image with UFS2:
# newfs -U -O2 /dev/md9.bde
Now mount the md9.bde filesystem to the mount-point we created earlier.
# mount /dev/md9.bde /private
Check to make sure everthing worked.
# df -h
NOTE: this article was reproduced and minorly reformatted from http://www.ezunix.org/modules.php?op=modload&name=Sections&file=index&req=viewarticle&artid=67&page=1 and has not been tested for accuracy. Information on updates to encrypt swap are based on Network Administration with FreeBSD7.
You can automount encrypted partitions with 2 rc.conf variables:
gbde_autoattach_all="YES" gbde_devices="encrypteddrivedeveicename"
