Re: [gentoo-hardened] Hardened laptops

>> I am interested in working on a secure laptop meta-project.  Laptop
>> security is interesting because some amount of physical security must
>> be addressed.  Laptop theft is big buisiness, after all.
>>
>> A well designed laptop operating system would be centered around encrypted
>> filesystems and would have many applications:
>>
>> 1.  People who want to protect their personal data from theft.
>>
>> 2.  Buisinesses that want to protect secrets stored on their fleet
>> of laptops.
>>
>> 3.  Military applications -- laptops are all over today's battlefield
>> and a lucky ambush could easily reap classified information.
>>
>> 4.  Etc...
>>
>> A company named NAH6 (http://www.nah6.com) has a product like this.
>> They use Linux in order to boot Windows from an encrypted volume.
>> I would like to focus on a Linux environment as an end.  The idea is that a
>> lost or stolen laptop will not give up any sensitive information.
>>
>> Here are the components I envision including their current status:
>>
>> 1.  Encrypted root filesystem.  The 2.6 Linux kernel and util-linux 2.12
>> will provide this using an encrypted loopback interface.  A speedier
>> compromise is to use encrypted home directories only.  I maintain a PAM
>> module, pam_mount, that mounts encrypted home directories transparently.  [ I

>> you don't mind a shameless plug, there is an article about pam_mount in the
>> August Linux Journal. ]
>>
>> 2.  Encrypted swap partition (or no swap at all).  This is necessary because

>> otherwise programs could swap secrets to a plaintext disk.  The 2.6 Linux
>> kernel's encrypted loopback interface can do this.
>>
>> 3.  An inproved authentication system.  Encryption algorithms are useless
>> if a weak key is used.  Therefore it may be desireable to authenticate
>> when booting and mounting an encrypted root filesystem (or mounting an
>> encrypted home directory) using a physical token or other strong means.
>>
>> 4.  An intrusion detection system.
>>
>> 5.  Obviously, otherwise hardened software.
>>
>> Comments?  Has anyone else talked about this around here?

> I haven't seen anything directly like this on the gentoo-hardened list
> yet. I have seen the loopback encrypted filesystems and distro
> discussions (nothing that isn't in the archives).

> I haven't seen anything directly like this on the gentoo-hardened list
> yet. I have seen the loopback encrypted filesystems and distro
> discussions (nothing that isn't in the archives).

Norman, you brought up some great points.  I am familiar with TEMPEST, but am 
not far enough into this to start trying to mitigate its risk yet.  

I now have a few questions about the encrypted home directory scenario (most of 
root filesystem is plaintext).  Basically, is it worth it vs. an encrypted root 
filesystem?  Besides encrypting swap, one sticky point is encrypting /tmp.  Here 
are a few potential solutions:

1.  Make /tmp an encrypted filesystem, generated at boot time with a random key 
(much like encrypted swap space).

2.  If you have enough memory and/or encrypted swap, use Linux's tmpfs.

3.  Implement per-user temporary directories in each user's encrypted $HOME.  
Obviously all applications must know to use $HOME/tmp instead of /tmp.  This may 
be difficult to ensure.

Plain text /tmp is of course bad because, for example, vi may leak secrets by 
creating recovery files there.  So what is the best solution?  Or are there too 
many potential loopholes when using encrypted home directories vs. encrypted 
root filesystem?

--
Mike


--
gentoo-hardened@g.o mailing list