rhear@cs.winthrop.eduArchived Document Notice: This document has been archived by the LDP because it does not apply to modern Linux systems. It is no longer being actively maintained.
This process requires the kernel source code, knowledge of compiling this code, and a lot of patience. I highly recommend having a boot disk ready. Also, be sure to have a backup before you permanently store your important data on the encrypted filesystem - it can be corrupted like any other filesystem.
As a minimum, you will have to patch to at least version 2.2.9 of the linux kernel before continuing. There are further instructions on applying patches in the Details section later in this document.
Kernel source can be found at:
ftp://ftp.kerneli.org/There is a HOWTO on the process of recompiling kernels at:
http://metalab.unc.edu/LDP/HOWTO/This document may be reproduced and distributed in whole or in part, without fee, subject to the following conditions:
ftp://prep.ai.mit.edu/pub/gnu/COPYING/
The process uses the device '/dev/loop*' (where * can be 0-7 on most installations) to mount a loopback filesystem. The same process can be used without encryption to store a linux filesystem on a non-linux partition. There is a HOWTO on this at the LDP site mentioned previously.
Different types of encryption can be used, including XOR, DES, twofish, blowfish, cast128, serpent, MARS, RC6, DFC, and IDEA. The program 'losetup' (loopback setup) is what associates your encrypted file with a filesystem and it's cipher type. According to Alexander Kjeldaas, who maintains kerneli.org and the international crypto patches, DES and losetup are currently incompatible. This is due to differences in the way the two handle parity bits. There are no plans to support DES as it is much more insecure than the other ciphers.
Twofish, blowfish, cast128, and serpent are all licensed free for any use. The others may or may not have licensing restrictions. Several of them are candidates for the AES standard. The finalists will provide royalty free use of their ciphers worldwide.
This document uses the serpent algorithm because it is strong yet remarkably fast, and it's freely distributable under the GPL. According to it's documentation, serpent uses a 128-bit block cipher designed by Ross Anderson, Eli Biham and Lars Knudsen. It provides users with the highest practical level of assurance that no shortcut attacks will be found. The documentation on serpent as well as the source code can be found at:
http://www.cl.cam.ac.uk/~rja14/serpent.htmlAlso, this document assumes that the ciphers are compiled directly into the kernel. You may install them as modules, but the technique is not discussed in this document. You will have to edit the file '/etc/conf.module'; the process is discussed in detail in the kernel compilation HOWTO referenced previously.
There are many steps involved in the process. I will provide Details for these steps in the next section. I thought it would be nice to provide a summary first to provide reference (if you are experienced with unix/linux you probably don't need the details anyway). Here they are summarized as follows:
http://ftp.kerneli.org/pub/kerneli/
ftp://ftp.kernel.org/pub/linux/utils/util-linux/
/dev/loop0 /mnt/crypt ext2 user,noauto,rw,loop 0 0
dd if=/dev/urandom of=/etc/cryptfile bs=1M count=10
losetup -e serpent /dev/loop0 /etc/cryptfile
You only have one chance to enter the password, be careful. If you want to double-check your password, you can use the command:
losetup -d /dev/loop0
This will deactivate your loop device. Next you will run losetup again to test your password, as follows:
losetup -e serpent /dev/loop0 /etc/cryptfile
mkfs -t ext2 /dev/loop0
mount -t ext2 /dev/loop0 /mnt/crypt
umount /dev/loop0
losetup -d /dev/loop0
Kernel Patches:
You can upgrade from '2.2.x' releases by patching. Each patch that is released for '2.2.x' contains bugfixes. New features will be added to the Linux '2.3.x' development kernel. To install by patching, get all the newer patch files and do the following:
cd /usr/src
gzip -cd patchXX.gz | patch -p0
Repeat xx for all versions bigger than the version of your current source tree, IN ORDER.
The default directory for the kernel source is '/usr/src/linux'. If your source is installed somewhere else, I would suggest using a symbolic link from '/usr/src/linux'.
Editing 'MCONFIG' for the 'util-linux' package compilation:
The following are excerpts from the 'MCONFIG' file I used to compile the 'util-linux' package. Note that this is fairly specific for my setup, which is loosely based on RedHat 5.2. The point is to make sure you don't overwrite any important system tools such as 'login', 'getty', or 'passwd'. Anyway, here are the important lines as follows:
CPU=$(shell uname -m | sed s/I.86/intel/)
LOCALEDIR=/usr/share/locale
HAVE_PAM=no
HAVE_SHADOW=yes
HAVE_PASSWD=yes
REQUIRE_PASSWORD=yes
ONLY_LISTED_SHELLS=yes
HAVE_SYSVINIT=yes
HAVE_SYSVINIT_UTILS=yes
HAVE_GETTY=yes
USE_TTY_GROUP=yes
HAVE_RESET=yes
HAVE_SLN=yes
CC=gcc
Suggestions:
Note that you could use any of the eight loopback devices, from 'dev/loop0' to '/dev/loop7'. Use an inconspicuous directory for the mount point. I would suggest creating a folder with 700 permissions inside your home folder. The same goes for the file that holds the data. I use a filename like 'sysfile' or 'config.data' inside the '/etc' folder. This will usually get overlooked.
I created very simple Perl scripts to mount and unmount the filesystem with one command. Write these, make them executable (chmod u+x), and store them somewhere in your path.
#!/usr/bin/perl -w
#
#minimal utility to setup loopback encryption filesystem
#Copyright 1999 by Ryan T. Rhea
`losetup -e serpent /dev/loop0 /etc/cryptfile`;
`mount /mnt/crypt`;
Name the above script 'loop', and then you can be on your way with one command ('loop') and a password.
#!/usr/bin/perl -w
#
#minimal utility to deactivate loopback encryption filesystem
#Copyright 1999 by Ryan T. Rhea
`umount /mount/crypt`;
`losetup -d /dev/loop0`;
Name the second one 'unloop', and then typing 'unloop' will quickly deactivate your filesystem.