[Bug 432785] Re: add support to ecryptfs-setup-swap for keyed hibernation

[Dmitrijs Ledkovs]

I unlinked this bug from ubiquity-lvm-luks as this is not entirely
related. That spec deals with cryptsetup (dm-crypt/LUKS) as currently
supported by d-i. There is no scope in that spec for encryptfs.

Also I am not sure if this is needed. Users can simply do cryptsetup
with passphrase for their swap if they want encrypted swap &
hibernation.

As ubiquity now has support for:
- auto full disk encryption (that includes swap as well)
- manual partitioning (to e.g. setup just some parts encrypted) (in a branch will be commited soon)

I am closing ubiquity task. If ecryptfs gains additional features and
ubiquity/d-i integration is wanted, please open a new bug.

** Changed in: ubiquity (Ubuntu)
       Status: Confirmed => Invalid

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to ubiquity in Ubuntu.
https://bugs.launchpad.net/bugs/432785

Title:
  add support to ecryptfs-setup-swap for keyed hibernation

Status in eCryptfs:
  Triaged
Status in “ecryptfs-utils” package in Ubuntu:
  Confirmed
Status in “ubiquity” package in Ubuntu:
  Invalid

Bug description:
  ecryptfs-setup-swap currently creates entries in /etc/fstab and
  /etc/crypttab for encrypted swap, in order to increase the security of
  systems using ecryptfs.

  However, in its current implementation, this breaks hibernation
  support in most cases.  The current implementation just creates a
  randomly generated key each boot for swap space.

  The advantage of this approach is that this allows the system to boot
  unattended, without prompting for a passphrase until system login
  screens.

  However, in the long term, we would like to eventually fix this
  problem, and cleanly support hibernation to encrypted swap.

  As I see it, there are a few approaches...

   1) configure encrypted swap using a single static passphrase stored
  in LUKS, which is required at system boot; this same passphrase would
  be required to resume the system; this breaks unattended boots, and
  requires all users on a system to share the same swap passphrase

   2) randomly generate the passphrase at boot, but wrap this passphrase
  using a pam module each time a user logs in (up to 7 different users),
  and stuff this wrapped passphrase in LUKS; this would allow any user
  who has logged into the system to resume it; each user would use their
  own passphrase to resume; and this would *not* break unattended boots

   3) create and setup a swap file at user login, rather than at boot,
  hook pam to put that passphrase into LUKS; no passphrase required
  until login; only one user really supported, which is perhaps okay for
  some laptop setups; no swap space available during boot, which perhaps
  isn't that big of a deal

  
  :-Dustin

To manage notifications about this bug go to:
https://bugs.launchpad.net/ecryptfs/+bug/432785/+subscriptions