Encrypted Dapper filesystems?

centos at rio.vg centos at rio.vg
Sat Jun 10 15:22:01 UTC 2006


pulver wrote:
> 
> Yes, but personally I don't care much about small performence losses,
> and do encrypt everything. You were the one mentioning threat models,
> the fbi, mafia...
> 

I've been running my personal systems with encrypted home directories,
but never really saw the point in encrypting /usr.  Since the files are
unencrypted and accessible while the system is online, it doesn't help
you against malware or someone hacking into a live system.  If someone
steals my laptop, they're not gonna get any personal data out of those
areas...

Here's another advantage: Use loopfs, and it makes it nice and easy to
create backups.  Just logoff, unmount, unloop, and copy the loopfile to
CD or DVD for an encrypted backup.

> Besides encrypting my private files, I also at least want to encrypt
> swap and tmp. Besides that one want to make sure that the system
> binaries haven't been tampered with. Encrypting everything is an easy
> approach to get one step further in that direction.

I highly recommend using tmpfs for /tmp, rather than encrypting it.
There's no need to keep /tmp files around between boots, so instead of
encrypting it, it will simply be wiped out.

Encrypting the binaries will _NOT_ ensure that they haven't been
tampered with while the machine is running.  Use tripwire for that.
Unfortunately, the free version of tripwire has been getting rather
stale and I think the only system that performs similarly is samhain,
which is a bit more complicated.

(Note: aide does NOT protect your files, since the database it creates
is vulnerable.  Tripwire signs it's database, so you can be assured it
hasn't been tampered with.)




More information about the ubuntu-users mailing list