re: [gentoo-hardened] full system encryption

[Boyd Waters]

Joshua Brindle wrote:

 > read this
 > http://loop-aes.sourceforge.net/loop-AES.README
 >
 > and these
 > 
http://forums.gentoo.org/viewtopic.php?t=31363&start=0&postdays=0&postorder=asc&highlight=
 >
 > I'd really like something like this, particularly the example
 > in the aes readme about using a passphrase, and gpg
 > key on a usb dongle to mount the filesystem at boot time
 >
 > so basically i'm asking for volunteers to set up something
 > like this, an ebuild that would create the initrd, and docs
 > about encrypting the filesystems, etc.



I have a just such a system with cryptoAPI, initrd, and a USB memory 
stick holding a GPG key working for 2.4.[19-21] kernels no problem. I 
can document this and post to this list for others to test.


I have been working on this for months now... trying to get the initrd 
to work well with kernel 2.6, with varying degrees of success, but no joy...

I have not had too much success with loop-AES initrd, as it makes many 
assumptions regarding the util-linux version, patches to the kernel, 
etc... since crytpoAPI is now standard for loopback encryption in the 
2.6 kernel (and was included in the old crypto-sources kernel for 
Gentoo), and is supported by mainline util-linux 2.12, I have been using 
that.

At the moment, I cannot get a kernel 2.6 to pay attention to pivot_root. 
Indeed I have never had a pivot_root call succeed on any version of any 
kernel, so it is probably my stupidity. But I suspect that there is an 
interaction with devfs that I don't fully apprehend. The loop-AES 
maintainer does not quite understand devfs. I will continue to peruse 
the Gentoo forum regarding this matter.

-- boyd


--
gentoo-hardened@g.o mailing list