Gentoo Archives: gentoo-user

From: "J. Roeleveld" <joost@××××××××.org>
To: gentoo-user@l.g.o
Subject: Re: [gentoo-user] Encrypting a hard drive's data. Best method.
Date: Sat, 06 Jun 2020 19:02:45
Message-Id: 18C9FEC8-6F25-4D7C-9904-6F97F5EE15D9@antarean.org
In Reply to: Re: [gentoo-user] Encrypting a hard drive's data. Best method. by Dale
1 On 6 June 2020 17:07:37 CEST, Dale <rdalek1967@×××××.com> wrote:
2 >antlists wrote:
3 >> On 06/06/2020 08:49, Dale wrote:
4 >>> First drive seems to have died.  Got part way copying files and
5 >>> things got interesting.  When checking smartctrl, it even puked on
6 >my
7 >>> keyboard.  Drive only had a few hundred hours on it so maybe the
8 >>> drive was iffy from the start or that enclosure did damage somehow.
9 >>> Either way, drive two being tested.  Running smartctrl test first
10 >and
11 >>> then restart from scratch and fill it up with files or something.
12 >>
13 >> Take it out the enclosure and it might be fine. I regularly have
14 >> drives "die" in an enclosure and then work fine when I take them out.
15 >>
16 >> That's why I bought an open bay - it's eSATA and the only bit of the
17 >> drive that is enclosed is the connectors. Keeps the drive from
18 >cooking
19 >> ...
20 >>
21 >> Oh - the other thing - if it's PMR and you're copying files onto it,
22 >> expect a puke! That thing on WD Reds going PMR, I copied most of that
23 >> on to the linux raid mailing list and the general feeling I get is
24 >> "PMR is bad".
25 >>
26 >> Cheers,
27 >> Wol
28 >>
29 >>
30 >
31 >
32 >I may test it later by connecting it directly to the SATA card but I
33 >suspect the drive is bad.  I managed to get the selftest data from the
34 >drive once after several tries and it had a lot of failures.  It had
35 >more than one type of error as well.  At this point, I don't see me
36 >trusting any data on it anyway.  The first type of enclosure I think is
37 >just cheaply made.  The new types, rock solid. 
38 >
39 >Read other replies, yea, SMR isn't good for my use case.  I do have a
40 >external drive that I do incremental backups on that is SMR.  It works
41 >OK but the other day I had a rather large list of new files.  It got a
42 >little slow toward the end.  I suspect its PMR section got full.  It
43 >eventually finished but I did notice a slow down, a good sized one. 
44 >Avoiding SMR like its the plague. 
45 >
46 >Reading other replies, some two or three times.  ;-)  Lots of good
47 >info.  I'm wanting to encrypt /home but also want another drive that
48 >when I'm gone, it is no longer accessible.  A person can dd the drive
49 >or
50 >something and start over but not access the data on it.  Right now, the
51 >3TB will be more than enough for that. 
52 >
53 >Thanks to all for the info.  Getting new reading glasses today.  Should
54 >have new prescription glasses this coming week, hope anyway.  Sometimes
55 >it takes a while to get the lenses made.  They have to use a really
56 >complicated process.  I think each lens costs around $200.  My eyes
57 >aren't much to work with.  Basically, I'm more cyclops, just in the
58 >right place.  :/
59 >
60 >Dale
61 >
62 >:-)  :-)
63
64 One thing to add to this: Encryption keys are stored in memory (or else it doesn't work)
65 This can also be leaked to disk (SWAP, for instance).
66
67 I tend to either encrypt it all (apart from the boot partition) or don't bother at all.
68 For me, it depends in how and where the system is used. Laptops travel with me and if they can be physically compromised, they get reinstalled with a fully new encryption key. Normally, the laptop is fully switched off when nog in use and the boot process, on the encrypted section, will check the boot partition with a known clean state. If it fails that check, there is a big warning and several services will fail to start.
69
70 --
71 Joost
72 --
73 Sent from my Android device with K-9 Mail. Please excuse my brevity.