Re: [dm-crypt] Encrypt all partitions with dm-crypt

[Arno Wagner <arno@wagner.name>]

On Thu, Sep 06, 2012 at 04:54:18PM +0400, Stayvoid wrote:
> > You solution will work though, although if you do it with
> 
> >? dd_rescue /dev/urandom /dev/sda
> 
> > you get a progess indicator.
> 
> In that case it's also possible to check the progress like this:
> 
> $ kill -USR1 $(pidof dd)
> 
> (This should be typed in another terminal.)
> 
> 
> > No. You just map it like you stated and then create the filesystem
> > on the mapped device.
> 
> How to map it? Will the following work?
> 
> $ cryptsetup create /dev/sda2 boot
> $ cryptsetup create /dev/sda3 main

Yes, "create" is the mapping command for plain dm-crypt.
 
> 
> > mkswap /dev/mapper/main
> 
> Is this a typo? I guess that it should be changed to:
> 
> mkswap /dev/mapper/swap

Yes.

> 
> > No idea. Suspend-to-disk is insecure unless done right and it
> > needs to be done right by your distro.
> 
> What about this option [1]?
> Is it secure?

Well, it does not have the security problems of suspend-to-disk
at least ;-)
Whether it is ecyure depends on some factors. For example, you
need a high-entropy passphrase for plain dm-crypt to be secure.
See FAQ for more info.
 
> I know that some people don't use swap at all because of security issues.
> But I'd like to use it.

Encrypted swap is generally fine, as long as it gets a random
encryption key on system boot. I have been doing that for a 
while now, no problems.

> By the way, are there any differences between a swap partition and a
> swap file (in terms of security)?

Depends. For example, if you use a journaling filesystem or a filesystem
where writes may not overwrite old data, stuff can survive far longer
than expected. The same can happen with SWAP on SSD, even if ut
goes to its own partition.

Usually, the secure option is to use swap on a magnetic disk 
that is encrypted with a random key chosen at system boot. If
you are paranoid, change the key periodically (cron-job).

Arno 

> [1] https://wiki.archlinux.org/index.php/Dm-crypt_with_LUKS#Without_suspend-to-disk_support
> 
> Thanks
> _______________________________________________
> dm-crypt mailing list
> dm-crypt@saout.de
> http://www.saout.de/mailman/listinfo/dm-crypt
> 

-- 
Arno Wagner,    Dr. sc. techn., Dipl. Inform.,   Email: arno@wagner.name 
GnuPG:  ID: 1E25338F  FP: 0C30 5782 9D93 F785 E79C  0296 797F 6B50 1E25 338F
----
One of the painful things about our time is that those who feel certainty 
are stupid, and those with any imagination and understanding are filled 
with doubt and indecision. -- Bertrand Russell