1. Preparing the system

1.1. Setting up the partition layout

Your hard disk (hda) should contain at least three partitions:

• hda1: this small unencrypted partition will ask for a password in order to mount the encrypted root filesystem.
• hda2: this partition will contain your encrypted root filesystem; make sure it is large enough.
• hda3: this partition holds the current GNU/Linux system.

At this point, both hda1 and hda2 are unused. hda3 is where your Linux distribution is currently installed; /usr and /boot must not be separated from this partition.

Here’s an example of what your partition layout might look like:

1.2. Required packages

If you use Debian, the following packages are mandatory:

To make copy & paste easier, you should also install:

1.3. Installing Linux-2.4.29

There are two main projects which add loopback encryption support in the kernel: cryptoloop and loop-AES. This howto is based on loop-AES, since it features an extremely fast and highly optimized implementation of Rijndael in assembly language, and therefore provides maximum performance if you have an IA-32 (x86) CPU. Besides, there are some security concerns about cryptoloop.

First of all, download and unpack the loop-AES package:

Then you must download and patch the kernel source:

Setup the keyboard map:

Next, configure your kernel; make sure the following options are set:

Compile the kernel and install it:

If grub is your bootloader, update /boot/grub/menu.lst or /boot/grub/grub.conf:

Otherwise, update /etc/lilo.conf and run lilo:

You may now restart the system.

1.4. Installing Linux-2.6.10

Proceed as described in the previous section, using loop-aes’ kernel-2.6.10.diff patch instead, and make sure cryptoloop support is not activated. Note that modules support require that you have the module-init-tools package installed.

1.5. Installing util-linux-2.12p

The losetup program, which is part of the util-linux package, must be patched and recompiled in order to add strong cryptography support. Download, unpack and patch util-linux:

To use passwords that are less than 20 characters, enter:

Security is certainly your major concern. For this reason, please do not enable passwords shorter than 20 characters. Data privacy is not free, one has to ‘pay’ in form of long passwords.

Compile losetup and install it as root:

2. Creating the encrypted root filesystem

Fill the target partition with random data:

Setup the encrypted loopback device:

To prevent optimized dictionary attacks, it is recommended to add the -S xxxxxx option, where “xxxxxx” is your randomly chosen seed (for example, you might choose “gPk4lA”). Write down your seed on a piece of paper so that you don’t loose it afterwards. Also, in order to avoid boot-time problems with the keyboard map, do not use non-ASCII characters (accents, etc.) in your password. The Diceware site offers a simple way to create strong, yet easy to remember, passphrases.

Now create the ext3 filesystem:

Check that the password you entered is correct:

You can compare the encrypted and unencrypted data:

It’s time to install your encrypted Linux system. If you use a GNU/Linux distribution (such as Debian, Slackware, Gentoo, Mandrake, RedHat/Fedora, SuSE, etc.), run the following command:

If you use the Linux From Scratch book, proceed as described in the manual, with the modifications below:

• Chapter 6 – Installing util-linux:Apply the loop-AES patch after unpacking the sources.
• Chapter 8 – Making the LFS system bootable:Refer to the next section (Setting up the boot device).

3. Setting up the boot device

3.1. Creating the ramdisk

To begin with, chroot inside the encrypted partition and create the boot device mount point:

Then, create the initial ramdisk (initrd), which will be needed afterwards:

If you’re using grsecurity, you may get a “Permission denied” error message; in this case you’ll have to run the mount command outside chroot.

Create the filesystem hierarchy and copy the required files in it:

It’s ok if you see a message like “/lib/libncurses.so.5: No such file or directory”, or “/lib/libtermcap.so.2: No such file or directory”; bash only requires one of these two libraries. You can check which one is actually required with:

Compile the sleep program, which will prevent the password prompt being flooded by kernel messages (such as usb devices being registered).

Create the init script:

Umount the loopback device and compress the initrd:

3.2. Booting from a CD-ROM

I strongly advise you to start your system with a read-only media, such as a bootable CD-ROM.

Download and unpack syslinux:

Configure isolinux:

Create and burn the bootable cd-rom iso image:

3.3. Booting from a HD partition

The boot partition can come in handy if you happen to lose your bootable CD. Remember that hda1 is a writable media and is thus insecure; use it only in case of emergency!

Create and mount the ext2 filesystem:

Copy the kernel and the initial ramdisk:

If you use grub:

If you use lilo:

4. Final steps

Still inside chroot, modify /etc/fstab so that it contains:

Delete /etc/mtab and exit from chroot. Finally, run “umount -d /mnt/efs” and reboot. If something goes wrong, you can still boot your unencrypted partition by entering “Linux root=/dev/hda3” at the LILO: prompt.

If everything went well, you can now re-partition your disk and encrypt hda3 as well as hda4. In the following scripts, we assume that hda3 will hold the swap device and hda4 will contain /home; you should initialize both partitions first:

Then create a script in the system startup directory and update fstab:

Refference -> http://www.tldp.org/HOWTO/Encrypted-Root-Filesystem-HOWTO/preparing-system.html

Visits: 0