From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <marcosestevesbarbosa@gmail.com>
Received: from mail.saout.de ([127.0.0.1])
 by localhost (mail.saout.de [127.0.0.1]) (amavisd-new, port 10024)
 with ESMTP id WSAYY6VDiv9B for <dm-crypt@saout.de>;
 Wed,  9 Nov 2011 19:42:07 +0100 (CET)
Received: from mail-yx0-f171.google.com (mail-yx0-f171.google.com
 [209.85.213.171]) (using TLSv1 with cipher RC4-SHA (128/128 bits))
 (No client certificate requested)
 by mail.saout.de (Postfix) with ESMTPS
 for <dm-crypt@saout.de>; Wed,  9 Nov 2011 19:42:07 +0100 (CET)
Received: by yenl6 with SMTP id l6so1471135yen.30
 for <dm-crypt@saout.de>; Wed, 09 Nov 2011 10:42:05 -0800 (PST)
MIME-Version: 1.0
From: Marcos Barbosa <marcosestevesbarbosa@gmail.com>
Date: Wed, 9 Nov 2011 16:41:44 -0200
Message-ID: <CAPTy4so2YLyLanwoBQdvZZdoh+FvNsZNM0LzBaxvKWz+YHv0Uw@mail.gmail.com>
Content-Type: multipart/alternative; boundary=000e0cd4c640fac84404b151a457
Subject: [dm-crypt] LiveUSB encrypted.
List-Id: <dm-crypt.saout.de>
List-Unsubscribe: <http://www.saout.de/mailman/options/dm-crypt>,
 <mailto:dm-crypt-request@saout.de?subject=unsubscribe>
List-Archive: <http://www.saout.de/pipermail/dm-crypt>
List-Post: <mailto:dm-crypt@saout.de>
List-Help: <mailto:dm-crypt-request@saout.de?subject=help>
List-Subscribe: <http://www.saout.de/mailman/listinfo/dm-crypt>,
 <mailto:dm-crypt-request@saout.de?subject=subscribe>
To: dm-crypt@saout.de

--000e0cd4c640fac84404b151a457
Content-Type: text/plain; charset=ISO-8859-1

How i create a Ubuntu liveUSB inside a USB stick?
The trick: The casper files is inside a encrypted partition with LUKS.

any ideas?

-- 
Marcos Barbosa <marcosestevesbarbosa@gmail.com>

--000e0cd4c640fac84404b151a457
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

How i create a Ubuntu liveUSB inside a USB stick?<div>The trick: The casper=
 files is inside a encrypted partition with LUKS.</div><div><br></div><div>=
any ideas?</div><div><br></div><div>-- <br>Marcos Barbosa &lt;<a href=3D"ma=
ilto:marcosestevesbarbosa@gmail.com" target=3D"_blank">marcosestevesbarbosa=
@gmail.com</a>&gt;<br>



</div>

--000e0cd4c640fac84404b151a457--

From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <wagner@tansi.org>
Received: from mail.saout.de ([127.0.0.1])
 by localhost (mail.saout.de [127.0.0.1]) (amavisd-new, port 10024)
 with ESMTP id P7_byoXiCL0i for <dm-crypt@saout.de>;
 Wed,  9 Nov 2011 21:34:47 +0100 (CET)
Received: from v4.tansi.org (ns.km33513-03.keymachine.de [87.118.94.3])
 by mail.saout.de (Postfix) with ESMTP
 for <dm-crypt@saout.de>; Wed,  9 Nov 2011 21:34:47 +0100 (CET)
Received: from gatewagner.dyndns.org (84-74-163-71.dclient.hispeed.ch
 [84.74.163.71]) by v4.tansi.org (Postfix) with ESMTPA id 14C201404001
 for <dm-crypt@saout.de>; Wed,  9 Nov 2011 21:34:46 +0100 (CET)
Date: Wed, 9 Nov 2011 21:34:45 +0100
From: Arno Wagner <arno@wagner.name>
Message-ID: <20111109203445.GA4797@tansi.org>
References: <CAPTy4so2YLyLanwoBQdvZZdoh+FvNsZNM0LzBaxvKWz+YHv0Uw@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <CAPTy4so2YLyLanwoBQdvZZdoh+FvNsZNM0LzBaxvKWz+YHv0Uw@mail.gmail.com>
Subject: Re: [dm-crypt] LiveUSB encrypted.
List-Id: <dm-crypt.saout.de>
List-Unsubscribe: <http://www.saout.de/mailman/options/dm-crypt>,
 <mailto:dm-crypt-request@saout.de?subject=unsubscribe>
List-Archive: <http://www.saout.de/pipermail/dm-crypt>
List-Post: <mailto:dm-crypt@saout.de>
List-Help: <mailto:dm-crypt-request@saout.de?subject=help>
List-Subscribe: <http://www.saout.de/mailman/listinfo/dm-crypt>,
 <mailto:dm-crypt-request@saout.de?subject=subscribe>
To: dm-crypt@saout.de

You don't. What you do instead is use an encrypted 
data partition, which may be supported by some
Ubuntu tool.

The problem is that the kernel and an initrd have to
reside outside of the encrypted space. There is no 
way around that. As a consequence, an attacker can
already modify those two and get complete control.

If you are worried about this, use some form of
physical protection. Weak protection comes from using
write-once media like a CD-R. Stronger comes from
using an encrypted memory-stick with keypad. (Beware,
there are secure and insecure ones on the market.)
You can also ware the stick around your neck.

Arno

On Wed, Nov 09, 2011 at 04:41:44PM -0200, Marcos Barbosa wrote:
> How i create a Ubuntu liveUSB inside a USB stick?
> The trick: The casper files is inside a encrypted partition with LUKS.
> 
> any ideas?
> 
> -- 
> Marcos Barbosa <marcosestevesbarbosa@gmail.com>

> _______________________________________________
> dm-crypt mailing list
> dm-crypt@saout.de
> http://www.saout.de/mailman/listinfo/dm-crypt


-- 
Arno Wagner, Dr. sc. techn., Dipl. Inform., CISSP -- Email: arno@wagner.name 
GnuPG:  ID: 1E25338F  FP: 0C30 5782 9D93 F785 E79C  0296 797F 6B50 1E25 338F
----
Cuddly UI's are the manifestation of wishful thinking. -- Dylan Evans

If it's in the news, don't worry about it.  The very definition of 
"news" is "something that hardly ever happens." -- Bruce Schneier 

From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <marcosestevesbarbosa@gmail.com>
Received: from mail.saout.de ([127.0.0.1])
 by localhost (mail.saout.de [127.0.0.1]) (amavisd-new, port 10024)
 with ESMTP id tx48qymcJqkt for <dm-crypt@saout.de>;
 Wed,  9 Nov 2011 22:26:58 +0100 (CET)
Received: from mail-yw0-f50.google.com (mail-yw0-f50.google.com
 [209.85.213.50]) (using TLSv1 with cipher RC4-SHA (128/128 bits))
 (No client certificate requested)
 by mail.saout.de (Postfix) with ESMTPS
 for <dm-crypt@saout.de>; Wed,  9 Nov 2011 22:26:57 +0100 (CET)
Received: by ywp18 with SMTP id 18so1068589ywp.37
 for <dm-crypt@saout.de>; Wed, 09 Nov 2011 13:26:56 -0800 (PST)
MIME-Version: 1.0
In-Reply-To: <20111109203445.GA4797@tansi.org>
References: <CAPTy4so2YLyLanwoBQdvZZdoh+FvNsZNM0LzBaxvKWz+YHv0Uw@mail.gmail.com>
 <20111109203445.GA4797@tansi.org>
From: Marcos Barbosa <marcosestevesbarbosa@gmail.com>
Date: Wed, 9 Nov 2011 19:26:26 -0200
Message-ID: <CAPTy4spQvVrM0N2NVDUZT6ahmf-S-wXcUw-etDbBK_d1XTHwJQ@mail.gmail.com>
Content-Type: multipart/alternative; boundary=000e0cd34f6afcde6c04b153f180
Subject: Re: [dm-crypt] LiveUSB encrypted.
List-Id: <dm-crypt.saout.de>
List-Unsubscribe: <http://www.saout.de/mailman/options/dm-crypt>,
 <mailto:dm-crypt-request@saout.de?subject=unsubscribe>
List-Archive: <http://www.saout.de/pipermail/dm-crypt>
List-Post: <mailto:dm-crypt@saout.de>
List-Help: <mailto:dm-crypt-request@saout.de?subject=help>
List-Subscribe: <http://www.saout.de/mailman/listinfo/dm-crypt>,
 <mailto:dm-crypt-request@saout.de?subject=subscribe>
To: dm-crypt@saout.de

--000e0cd34f6afcde6c04b153f180
Content-Type: text/plain; charset=ISO-8859-1

Hello Arno,

I can survive if kernel and initrd stay in a separated partition. May be i
create a script to generate hash and sign them. If I use a separated
partition, what is the next logical step?

2011/11/9 Arno Wagner <arno@wagner.name>

> You don't. What you do instead is use an encrypted
> data partition, which may be supported by some
> Ubuntu tool.
>
> The problem is that the kernel and an initrd have to
> reside outside of the encrypted space. There is no
> way around that. As a consequence, an attacker can
> already modify those two and get complete control.
>
> If you are worried about this, use some form of
> physical protection. Weak protection comes from using
> write-once media like a CD-R. Stronger comes from
> using an encrypted memory-stick with keypad. (Beware,
> there are secure and insecure ones on the market.)
> You can also ware the stick around your neck.
>
> Arno
>
> On Wed, Nov 09, 2011 at 04:41:44PM -0200, Marcos Barbosa wrote:
> > How i create a Ubuntu liveUSB inside a USB stick?
> > The trick: The casper files is inside a encrypted partition with LUKS.
> >
> > any ideas?
> >
> > --
> > Marcos Barbosa <marcosestevesbarbosa@gmail.com>
>
> > _______________________________________________
> > dm-crypt mailing list
> > dm-crypt@saout.de
> > http://www.saout.de/mailman/listinfo/dm-crypt
>
>
> --
> Arno Wagner, Dr. sc. techn., Dipl. Inform., CISSP -- Email:
> arno@wagner.name
> GnuPG:  ID: 1E25338F  FP: 0C30 5782 9D93 F785 E79C  0296 797F 6B50 1E25
> 338F
> ----
> Cuddly UI's are the manifestation of wishful thinking. -- Dylan Evans
>
> If it's in the news, don't worry about it.  The very definition of
> "news" is "something that hardly ever happens." -- Bruce Schneier
> _______________________________________________
> dm-crypt mailing list
> dm-crypt@saout.de
> http://www.saout.de/mailman/listinfo/dm-crypt
>



-- 
Marcos Barbosa <marcosestevesbarbosa@gmail.com>

--000e0cd34f6afcde6c04b153f180
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

Hello Arno,<div><br></div><div>I can survive if kernel and initrd stay in a=
 separated partition. May be i create a script to generate hash and sign th=
em. If I use a separated partition, what is the next logical step?<br><br>

<div class=3D"gmail_quote">2011/11/9 Arno Wagner <span dir=3D"ltr">&lt;<a h=
ref=3D"mailto:arno@wagner.name">arno@wagner.name</a>&gt;</span><br><blockqu=
ote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc s=
olid;padding-left:1ex;">

You don&#39;t. What you do instead is use an encrypted<br>
data partition, which may be supported by some<br>
Ubuntu tool.<br>
<br>
The problem is that the kernel and an initrd have to<br>
reside outside of the encrypted space. There is no<br>
way around that. As a consequence, an attacker can<br>
already modify those two and get complete control.<br>
<br>
If you are worried about this, use some form of<br>
physical protection. Weak protection comes from using<br>
write-once media like a CD-R. Stronger comes from<br>
using an encrypted memory-stick with keypad. (Beware,<br>
there are secure and insecure ones on the market.)<br>
You can also ware the stick around your neck.<br>
<br>
Arno<br>
<div><div class=3D"h5"><br>
On Wed, Nov 09, 2011 at 04:41:44PM -0200, Marcos Barbosa wrote:<br>
&gt; How i create a Ubuntu liveUSB inside a USB stick?<br>
&gt; The trick: The casper files is inside a encrypted partition with LUKS.=
<br>
&gt;<br>
&gt; any ideas?<br>
&gt;<br>
&gt; --<br>
&gt; Marcos Barbosa &lt;<a href=3D"mailto:marcosestevesbarbosa@gmail.com">m=
arcosestevesbarbosa@gmail.com</a>&gt;<br>
<br>
</div></div>&gt; _______________________________________________<br>
&gt; dm-crypt mailing list<br>
&gt; <a href=3D"mailto:dm-crypt@saout.de">dm-crypt@saout.de</a><br>
&gt; <a href=3D"http://www.saout.de/mailman/listinfo/dm-crypt" target=3D"_b=
lank">http://www.saout.de/mailman/listinfo/dm-crypt</a><br>
<span class=3D"HOEnZb"><font color=3D"#888888"><br>
<br>
--<br>
Arno Wagner, Dr. sc. techn., Dipl. Inform., CISSP -- Email: <a href=3D"mail=
to:arno@wagner.name">arno@wagner.name</a><br>
GnuPG: =A0ID: 1E25338F =A0FP: 0C30 5782 9D93 F785 E79C =A00296 797F 6B50 1E=
25 338F<br>
----<br>
Cuddly UI&#39;s are the manifestation of wishful thinking. -- Dylan Evans<b=
r>
<br>
If it&#39;s in the news, don&#39;t worry about it. =A0The very definition o=
f<br>
&quot;news&quot; is &quot;something that hardly ever happens.&quot; -- Bruc=
e Schneier<br>
_______________________________________________<br>
dm-crypt mailing list<br>
<a href=3D"mailto:dm-crypt@saout.de">dm-crypt@saout.de</a><br>
<a href=3D"http://www.saout.de/mailman/listinfo/dm-crypt" target=3D"_blank"=
>http://www.saout.de/mailman/listinfo/dm-crypt</a><br>
</font></span></blockquote></div><br><br clear=3D"all"><div><br></div>-- <b=
r>Marcos Barbosa &lt;<a href=3D"mailto:marcosestevesbarbosa@gmail.com" targ=
et=3D"_blank">marcosestevesbarbosa@gmail.com</a>&gt;<br>
</div>

--000e0cd34f6afcde6c04b153f180--

From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <wagner@tansi.org>
Received: from mail.saout.de ([127.0.0.1])
 by localhost (mail.saout.de [127.0.0.1]) (amavisd-new, port 10024)
 with ESMTP id gnF8wAmVQPMH for <dm-crypt@saout.de>;
 Thu, 10 Nov 2011 11:30:29 +0100 (CET)
Received: from v4.tansi.org (ns.km33513-03.keymachine.de [87.118.94.3])
 by mail.saout.de (Postfix) with ESMTP
 for <dm-crypt@saout.de>; Thu, 10 Nov 2011 11:30:28 +0100 (CET)
Received: from gatewagner.dyndns.org (84-74-163-71.dclient.hispeed.ch
 [84.74.163.71]) by v4.tansi.org (Postfix) with ESMTPA id 6398C1404001
 for <dm-crypt@saout.de>; Thu, 10 Nov 2011 11:30:28 +0100 (CET)
Date: Thu, 10 Nov 2011 11:30:27 +0100
From: Arno Wagner <arno@wagner.name>
Message-ID: <20111110103027.GA16231@tansi.org>
References: <CAPTy4so2YLyLanwoBQdvZZdoh+FvNsZNM0LzBaxvKWz+YHv0Uw@mail.gmail.com>
 <20111109203445.GA4797@tansi.org>
 <CAPTy4spQvVrM0N2NVDUZT6ahmf-S-wXcUw-etDbBK_d1XTHwJQ@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <CAPTy4spQvVrM0N2NVDUZT6ahmf-S-wXcUw-etDbBK_d1XTHwJQ@mail.gmail.com>
Subject: Re: [dm-crypt] LiveUSB encrypted.
List-Id: <dm-crypt.saout.de>
List-Unsubscribe: <http://www.saout.de/mailman/options/dm-crypt>,
 <mailto:dm-crypt-request@saout.de?subject=unsubscribe>
List-Archive: <http://www.saout.de/pipermail/dm-crypt>
List-Post: <mailto:dm-crypt@saout.de>
List-Help: <mailto:dm-crypt-request@saout.de?subject=help>
List-Subscribe: <http://www.saout.de/mailman/listinfo/dm-crypt>,
 <mailto:dm-crypt-request@saout.de?subject=subscribe>
To: dm-crypt@saout.de

Hi Marcos,

I actually do not know in detail. Basically you need a 
bootloader to load kernel and initrd, and the initrd then needs 
to decrypt the encrypted root partition and mount it as such.

Personally I do not use initrd in my own installations.
For encrypted data on USB, an encrypted user area is quite
enough for me. (I use knoppix, it offers to create one
when booted from USB stick the first time).

There are some people on the list, that have worked on 
something like you want. Maybe search the archves and ask
them directly.

Arno

On Wed, Nov 09, 2011 at 07:26:26PM -0200, Marcos Barbosa wrote:
> Hello Arno,
> 
> I can survive if kernel and initrd stay in a separated partition. May be i
> create a script to generate hash and sign them. If I use a separated
> partition, what is the next logical step?
> 
> 2011/11/9 Arno Wagner <arno@wagner.name>
> 
> > You don't. What you do instead is use an encrypted
> > data partition, which may be supported by some
> > Ubuntu tool.
> >
> > The problem is that the kernel and an initrd have to
> > reside outside of the encrypted space. There is no
> > way around that. As a consequence, an attacker can
> > already modify those two and get complete control.
> >
> > If you are worried about this, use some form of
> > physical protection. Weak protection comes from using
> > write-once media like a CD-R. Stronger comes from
> > using an encrypted memory-stick with keypad. (Beware,
> > there are secure and insecure ones on the market.)
> > You can also ware the stick around your neck.
> >
> > Arno
> >
> > On Wed, Nov 09, 2011 at 04:41:44PM -0200, Marcos Barbosa wrote:
> > > How i create a Ubuntu liveUSB inside a USB stick?
> > > The trick: The casper files is inside a encrypted partition with LUKS.
> > >
> > > any ideas?
> > >
> > > --
> > > Marcos Barbosa <marcosestevesbarbosa@gmail.com>
> >
> > > _______________________________________________
> > > dm-crypt mailing list
> > > dm-crypt@saout.de
> > > http://www.saout.de/mailman/listinfo/dm-crypt
> >
> >
> > --
> > Arno Wagner, Dr. sc. techn., Dipl. Inform., CISSP -- Email:
> > arno@wagner.name
> > GnuPG:  ID: 1E25338F  FP: 0C30 5782 9D93 F785 E79C  0296 797F 6B50 1E25
> > 338F
> > ----
> > Cuddly UI's are the manifestation of wishful thinking. -- Dylan Evans
> >
> > If it's in the news, don't worry about it.  The very definition of
> > "news" is "something that hardly ever happens." -- Bruce Schneier
> > _______________________________________________
> > dm-crypt mailing list
> > dm-crypt@saout.de
> > http://www.saout.de/mailman/listinfo/dm-crypt
> >
> 
> 
> 
> -- 
> Marcos Barbosa <marcosestevesbarbosa@gmail.com>

> _______________________________________________
> dm-crypt mailing list
> dm-crypt@saout.de
> http://www.saout.de/mailman/listinfo/dm-crypt


-- 
Arno Wagner, Dr. sc. techn., Dipl. Inform., CISSP -- Email: arno@wagner.name 
GnuPG:  ID: 1E25338F  FP: 0C30 5782 9D93 F785 E79C  0296 797F 6B50 1E25 338F
----
Cuddly UI's are the manifestation of wishful thinking. -- Dylan Evans

If it's in the news, don't worry about it.  The very definition of 
"news" is "something that hardly ever happens." -- Bruce Schneier 

From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <mbroz@redhat.com>
Received: from mail.saout.de ([127.0.0.1])
 by localhost (mail.saout.de [127.0.0.1]) (amavisd-new, port 10024)
 with ESMTP id 8HeMdIiJlpaF for <dm-crypt@saout.de>;
 Thu, 10 Nov 2011 12:00:41 +0100 (CET)
Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28])
 by mail.saout.de (Postfix) with ESMTP
 for <dm-crypt@saout.de>; Thu, 10 Nov 2011 12:00:40 +0100 (CET)
Received: from int-mx02.intmail.prod.int.phx2.redhat.com
 (int-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.12])
 by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id pAAB0dbe029206
 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK)
 for <dm-crypt@saout.de>; Thu, 10 Nov 2011 06:00:39 -0500
Received: from [10.34.30.35] (tawny.brq.redhat.com [10.34.30.35])
 by int-mx02.intmail.prod.int.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id
 pAAB0bu8018746
 for <dm-crypt@saout.de>; Thu, 10 Nov 2011 06:00:38 -0500
Message-ID: <4EBBAED4.1060308@redhat.com>
Date: Thu, 10 Nov 2011 12:00:36 +0100
From: Milan Broz <mbroz@redhat.com>
MIME-Version: 1.0
References: <CAPTy4so2YLyLanwoBQdvZZdoh+FvNsZNM0LzBaxvKWz+YHv0Uw@mail.gmail.com>
 <20111109203445.GA4797@tansi.org>
 <CAPTy4spQvVrM0N2NVDUZT6ahmf-S-wXcUw-etDbBK_d1XTHwJQ@mail.gmail.com>
 <20111110103027.GA16231@tansi.org>
In-Reply-To: <20111110103027.GA16231@tansi.org>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Subject: Re: [dm-crypt] LiveUSB encrypted.
List-Id: <dm-crypt.saout.de>
List-Unsubscribe: <http://www.saout.de/mailman/options/dm-crypt>,
 <mailto:dm-crypt-request@saout.de?subject=unsubscribe>
List-Archive: <http://www.saout.de/pipermail/dm-crypt>
List-Post: <mailto:dm-crypt@saout.de>
List-Help: <mailto:dm-crypt-request@saout.de?subject=help>
List-Subscribe: <http://www.saout.de/mailman/listinfo/dm-crypt>,
 <mailto:dm-crypt-request@saout.de?subject=subscribe>
To: dm-crypt@saout.de

On 11/10/2011 11:30 AM, Arno Wagner wrote:
> I actually do not know in detail. Basically you need a 
> bootloader to load kernel and initrd, and the initrd then needs 
> to decrypt the encrypted root partition and mount it as such.

grub2 boor loader should be able to decrypt full LUKS mapping without initramfs.

Milan

From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <wagner@tansi.org>
Received: from mail.saout.de ([127.0.0.1])
 by localhost (mail.saout.de [127.0.0.1]) (amavisd-new, port 10024)
 with ESMTP id ho0BNl5Bp3wG for <dm-crypt@saout.de>;
 Thu, 10 Nov 2011 12:44:05 +0100 (CET)
Received: from v4.tansi.org (ns.km33513-03.keymachine.de [87.118.94.3])
 by mail.saout.de (Postfix) with ESMTP
 for <dm-crypt@saout.de>; Thu, 10 Nov 2011 12:44:04 +0100 (CET)
Received: from gatewagner.dyndns.org (84-74-163-71.dclient.hispeed.ch
 [84.74.163.71]) by v4.tansi.org (Postfix) with ESMTPA id B83A11404001
 for <dm-crypt@saout.de>; Thu, 10 Nov 2011 12:44:04 +0100 (CET)
Date: Thu, 10 Nov 2011 12:44:04 +0100
From: Arno Wagner <arno@wagner.name>
Message-ID: <20111110114403.GA17114@tansi.org>
References: <CAPTy4so2YLyLanwoBQdvZZdoh+FvNsZNM0LzBaxvKWz+YHv0Uw@mail.gmail.com>
 <20111109203445.GA4797@tansi.org>
 <CAPTy4spQvVrM0N2NVDUZT6ahmf-S-wXcUw-etDbBK_d1XTHwJQ@mail.gmail.com>
 <20111110103027.GA16231@tansi.org> <4EBBAED4.1060308@redhat.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <4EBBAED4.1060308@redhat.com>
Subject: Re: [dm-crypt] LiveUSB encrypted.
List-Id: <dm-crypt.saout.de>
List-Unsubscribe: <http://www.saout.de/mailman/options/dm-crypt>,
 <mailto:dm-crypt-request@saout.de?subject=unsubscribe>
List-Archive: <http://www.saout.de/pipermail/dm-crypt>
List-Post: <mailto:dm-crypt@saout.de>
List-Help: <mailto:dm-crypt-request@saout.de?subject=help>
List-Subscribe: <http://www.saout.de/mailman/listinfo/dm-crypt>,
 <mailto:dm-crypt-request@saout.de?subject=subscribe>
To: dm-crypt@saout.de

That would be nice. And a reason to switch bootloaders.

Arno

On Thu, Nov 10, 2011 at 12:00:36PM +0100, Milan Broz wrote:
> On 11/10/2011 11:30 AM, Arno Wagner wrote:
> > I actually do not know in detail. Basically you need a 
> > bootloader to load kernel and initrd, and the initrd then needs 
> > to decrypt the encrypted root partition and mount it as such.
> 
> grub2 boor loader should be able to decrypt full LUKS mapping without initramfs.
> 
> Milan
> _______________________________________________
> dm-crypt mailing list
> dm-crypt@saout.de
> http://www.saout.de/mailman/listinfo/dm-crypt
> 

-- 
Arno Wagner, Dr. sc. techn., Dipl. Inform., CISSP -- Email: arno@wagner.name 
GnuPG:  ID: 1E25338F  FP: 0C30 5782 9D93 F785 E79C  0296 797F 6B50 1E25 338F
----
Cuddly UI's are the manifestation of wishful thinking. -- Dylan Evans

If it's in the news, don't worry about it.  The very definition of 
"news" is "something that hardly ever happens." -- Bruce Schneier 

From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <hijacker@oldum.net>
Received: from mail.saout.de ([127.0.0.1])
 by localhost (mail.saout.de [127.0.0.1]) (amavisd-new, port 10024)
 with ESMTP id yJrsXuSdv4vs for <dm-crypt@saout.de>;
 Thu, 10 Nov 2011 14:37:18 +0100 (CET)
Received: from mail.oldum.net (cable-84-43-136-96.mnet.bg [84.43.136.96])
 by mail.saout.de (Postfix) with ESMTP
 for <dm-crypt@saout.de>; Thu, 10 Nov 2011 14:37:17 +0100 (CET)
Received: from [192.168.0.172] (unknown [213.91.163.5])
 (using TLSv1 with cipher AES256-SHA (256/256 bits))
 (No client certificate requested)
 (Authenticated sender: hijacker@services.oldum.net)
 by mail.oldum.net (Postfix) with ESMTPSA id F3A47454AF
 for <dm-crypt@saout.de>; Thu, 10 Nov 2011 15:27:32 +0200 (EET)
Message-ID: <4EBBD144.9020900@oldum.net>
Date: Thu, 10 Nov 2011 15:27:32 +0200
From: Nikolay Kichukov <hijacker@oldum.net>
MIME-Version: 1.0
References: <CAPTy4so2YLyLanwoBQdvZZdoh+FvNsZNM0LzBaxvKWz+YHv0Uw@mail.gmail.com>
 <20111109203445.GA4797@tansi.org>
 <CAPTy4spQvVrM0N2NVDUZT6ahmf-S-wXcUw-etDbBK_d1XTHwJQ@mail.gmail.com>
 <20111110103027.GA16231@tansi.org> <4EBBAED4.1060308@redhat.com>
 <20111110114403.GA17114@tansi.org>
In-Reply-To: <20111110114403.GA17114@tansi.org>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
Subject: Re: [dm-crypt] LiveUSB encrypted.
List-Id: <dm-crypt.saout.de>
List-Unsubscribe: <http://www.saout.de/mailman/options/dm-crypt>,
 <mailto:dm-crypt-request@saout.de?subject=unsubscribe>
List-Archive: <http://www.saout.de/pipermail/dm-crypt>
List-Post: <mailto:dm-crypt@saout.de>
List-Help: <mailto:dm-crypt-request@saout.de?subject=help>
List-Subscribe: <http://www.saout.de/mailman/listinfo/dm-crypt>,
 <mailto:dm-crypt-request@saout.de?subject=subscribe>
To: dm-crypt@saout.de

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

It SHOULD.

When I have attempted to make it boot I failed. The module was in beta development back then, maybe this have changed now.

Cheers,
- -Nik

On 11/10/2011 01:44 PM, Arno Wagner wrote:
> That would be nice. And a reason to switch bootloaders.
> 
> Arno
> 
> On Thu, Nov 10, 2011 at 12:00:36PM +0100, Milan Broz wrote:
>> On 11/10/2011 11:30 AM, Arno Wagner wrote:
>>> I actually do not know in detail. Basically you need a 
>>> bootloader to load kernel and initrd, and the initrd then needs 
>>> to decrypt the encrypted root partition and mount it as such.
>>
>> grub2 boor loader should be able to decrypt full LUKS mapping without initramfs.
>>
>> Milan
>> _______________________________________________
>> dm-crypt mailing list
>> dm-crypt@saout.de
>> http://www.saout.de/mailman/listinfo/dm-crypt
>>
> 
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iQEcBAEBAgAGBQJOu9FEAAoJEDFLYVOGGjgXf5QH/A+gPnSg0YFi/ankNoaE4uln
DxHM+EnV9jwWq41tCDwjnWY9RbZRFs3Ac4azzJD8lW1/SNsMNQ1xV5ZWExUBlbYs
6xGyccG001bILiEfMcB3AOs4F7MaKLMSIbuyR+wcIcyLdU4/fvAmAK/OxdnO/zf7
KJjK/Ha0c5QRQ28AcOKBvOozRb8Ed6axB3ugpHGFYYVd1oo55PBfk/kgZlVJ8qk4
hb1Feoo0BdhgeVxK2DBAAo49dDMDv+V5t75GYQtGAtDeHxfLDz87lqvMx0hYT8We
M3IjoQvvcz9KhuV5G4n3R8oneXARbXX+3zlFq35rnWlG9ncTxr4ELxZBCWIlnX0=
=Hx2j
-----END PGP SIGNATURE-----

From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <marcosestevesbarbosa@gmail.com>
Received: from mail.saout.de ([127.0.0.1])
 by localhost (mail.saout.de [127.0.0.1]) (amavisd-new, port 10024)
 with ESMTP id WeSk_hwqdH6D for <dm-crypt@saout.de>;
 Thu, 10 Nov 2011 15:32:50 +0100 (CET)
Received: from mail-yw0-f50.google.com (mail-yw0-f50.google.com
 [209.85.213.50]) (using TLSv1 with cipher RC4-SHA (128/128 bits))
 (No client certificate requested)
 by mail.saout.de (Postfix) with ESMTPS
 for <dm-crypt@saout.de>; Thu, 10 Nov 2011 15:32:50 +0100 (CET)
Received: by ywm13 with SMTP id 13so369798ywm.37
 for <dm-crypt@saout.de>; Thu, 10 Nov 2011 06:32:48 -0800 (PST)
MIME-Version: 1.0
In-Reply-To: <4EBBD144.9020900@oldum.net>
References: <CAPTy4so2YLyLanwoBQdvZZdoh+FvNsZNM0LzBaxvKWz+YHv0Uw@mail.gmail.com>
 <20111109203445.GA4797@tansi.org>
 <CAPTy4spQvVrM0N2NVDUZT6ahmf-S-wXcUw-etDbBK_d1XTHwJQ@mail.gmail.com>
 <20111110103027.GA16231@tansi.org> <4EBBAED4.1060308@redhat.com>
 <20111110114403.GA17114@tansi.org> <4EBBD144.9020900@oldum.net>
From: Marcos Barbosa <marcosestevesbarbosa@gmail.com>
Date: Thu, 10 Nov 2011 12:32:27 -0200
Message-ID: <CAPTy4spcu9gTv+Wm0LV_bwa6XrEvOLOtDc=Xcrb0GMssae2S5A@mail.gmail.com>
Content-Type: multipart/alternative; boundary=000e0cd3725659a72604b16247c9
Subject: Re: [dm-crypt] LiveUSB encrypted.
List-Id: <dm-crypt.saout.de>
List-Unsubscribe: <http://www.saout.de/mailman/options/dm-crypt>,
 <mailto:dm-crypt-request@saout.de?subject=unsubscribe>
List-Archive: <http://www.saout.de/pipermail/dm-crypt>
List-Post: <mailto:dm-crypt@saout.de>
List-Help: <mailto:dm-crypt-request@saout.de?subject=help>
List-Subscribe: <http://www.saout.de/mailman/listinfo/dm-crypt>,
 <mailto:dm-crypt-request@saout.de?subject=subscribe>
To: dm-crypt@saout.de

--000e0cd3725659a72604b16247c9
Content-Type: text/plain; charset=ISO-8859-1

Thanks guys.

Any details about the use of GRUB2 to decrypt?
parameters, etc. or a link to documentation?

2011/11/10 Nikolay Kichukov <hijacker@oldum.net>

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> It SHOULD.
>
> When I have attempted to make it boot I failed. The module was in beta
> development back then, maybe this have changed now.
>
> Cheers,
> - -Nik
>
> On 11/10/2011 01:44 PM, Arno Wagner wrote:
> > That would be nice. And a reason to switch bootloaders.
> >
> > Arno
> >
> > On Thu, Nov 10, 2011 at 12:00:36PM +0100, Milan Broz wrote:
> >> On 11/10/2011 11:30 AM, Arno Wagner wrote:
> >>> I actually do not know in detail. Basically you need a
> >>> bootloader to load kernel and initrd, and the initrd then needs
> >>> to decrypt the encrypted root partition and mount it as such.
> >>
> >> grub2 boor loader should be able to decrypt full LUKS mapping without
> initramfs.
> >>
> >> Milan
> >> _______________________________________________
> >> dm-crypt mailing list
> >> dm-crypt@saout.de
> >> http://www.saout.de/mailman/listinfo/dm-crypt
> >>
> >
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.11 (GNU/Linux)
> Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
>
> iQEcBAEBAgAGBQJOu9FEAAoJEDFLYVOGGjgXf5QH/A+gPnSg0YFi/ankNoaE4uln
> DxHM+EnV9jwWq41tCDwjnWY9RbZRFs3Ac4azzJD8lW1/SNsMNQ1xV5ZWExUBlbYs
> 6xGyccG001bILiEfMcB3AOs4F7MaKLMSIbuyR+wcIcyLdU4/fvAmAK/OxdnO/zf7
> KJjK/Ha0c5QRQ28AcOKBvOozRb8Ed6axB3ugpHGFYYVd1oo55PBfk/kgZlVJ8qk4
> hb1Feoo0BdhgeVxK2DBAAo49dDMDv+V5t75GYQtGAtDeHxfLDz87lqvMx0hYT8We
> M3IjoQvvcz9KhuV5G4n3R8oneXARbXX+3zlFq35rnWlG9ncTxr4ELxZBCWIlnX0=
> =Hx2j
> -----END PGP SIGNATURE-----
> _______________________________________________
> dm-crypt mailing list
> dm-crypt@saout.de
> http://www.saout.de/mailman/listinfo/dm-crypt
>



-- 
Marcos Barbosa <marcosestevesbarbosa@gmail.com>

--000e0cd3725659a72604b16247c9
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

Thanks guys.<div><br></div><div>Any details about the use of GRUB2 to decry=
pt?</div><div>parameters, etc. or a link to documentation?<br><br><div clas=
s=3D"gmail_quote">2011/11/10 Nikolay Kichukov <span dir=3D"ltr">&lt;<a href=
=3D"mailto:hijacker@oldum.net">hijacker@oldum.net</a>&gt;</span><br>

<blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1p=
x #ccc solid;padding-left:1ex;">-----BEGIN PGP SIGNED MESSAGE-----<br>
Hash: SHA1<br>
<br>
It SHOULD.<br>
<br>
When I have attempted to make it boot I failed. The module was in beta deve=
lopment back then, maybe this have changed now.<br>
<br>
Cheers,<br>
- -Nik<br>
<div class=3D"im"><br>
On 11/10/2011 01:44 PM, Arno Wagner wrote:<br>
&gt; That would be nice. And a reason to switch bootloaders.<br>
&gt;<br>
&gt; Arno<br>
&gt;<br>
&gt; On Thu, Nov 10, 2011 at 12:00:36PM +0100, Milan Broz wrote:<br>
&gt;&gt; On 11/10/2011 11:30 AM, Arno Wagner wrote:<br>
&gt;&gt;&gt; I actually do not know in detail. Basically you need a<br>
&gt;&gt;&gt; bootloader to load kernel and initrd, and the initrd then need=
s<br>
&gt;&gt;&gt; to decrypt the encrypted root partition and mount it as such.<=
br>
&gt;&gt;<br>
&gt;&gt; grub2 boor loader should be able to decrypt full LUKS mapping with=
out initramfs.<br>
&gt;&gt;<br>
&gt;&gt; Milan<br>
&gt;&gt; _______________________________________________<br>
&gt;&gt; dm-crypt mailing list<br>
&gt;&gt; <a href=3D"mailto:dm-crypt@saout.de">dm-crypt@saout.de</a><br>
&gt;&gt; <a href=3D"http://www.saout.de/mailman/listinfo/dm-crypt" target=
=3D"_blank">http://www.saout.de/mailman/listinfo/dm-crypt</a><br>
&gt;&gt;<br>
&gt;<br>
</div>-----BEGIN PGP SIGNATURE-----<br>
Version: GnuPG v1.4.11 (GNU/Linux)<br>
Comment: Using GnuPG with Mozilla - <a href=3D"http://enigmail.mozdev.org/"=
 target=3D"_blank">http://enigmail.mozdev.org/</a><br>
<br>
iQEcBAEBAgAGBQJOu9FEAAoJEDFLYVOGGjgXf5QH/A+gPnSg0YFi/ankNoaE4uln<br>
DxHM+EnV9jwWq41tCDwjnWY9RbZRFs3Ac4azzJD8lW1/SNsMNQ1xV5ZWExUBlbYs<br>
6xGyccG001bILiEfMcB3AOs4F7MaKLMSIbuyR+wcIcyLdU4/fvAmAK/OxdnO/zf7<br>
KJjK/Ha0c5QRQ28AcOKBvOozRb8Ed6axB3ugpHGFYYVd1oo55PBfk/kgZlVJ8qk4<br>
hb1Feoo0BdhgeVxK2DBAAo49dDMDv+V5t75GYQtGAtDeHxfLDz87lqvMx0hYT8We<br>
M3IjoQvvcz9KhuV5G4n3R8oneXARbXX+3zlFq35rnWlG9ncTxr4ELxZBCWIlnX0=3D<br>
=3DHx2j<br>
-----END PGP SIGNATURE-----<br>
<div class=3D"HOEnZb"><div class=3D"h5">___________________________________=
____________<br>
dm-crypt mailing list<br>
<a href=3D"mailto:dm-crypt@saout.de">dm-crypt@saout.de</a><br>
<a href=3D"http://www.saout.de/mailman/listinfo/dm-crypt" target=3D"_blank"=
>http://www.saout.de/mailman/listinfo/dm-crypt</a><br>
</div></div></blockquote></div><br><br clear=3D"all"><div><br></div>-- <br>=
Marcos Barbosa &lt;<a href=3D"mailto:marcosestevesbarbosa@gmail.com" target=
=3D"_blank">marcosestevesbarbosa@gmail.com</a>&gt;<br>
</div>

--000e0cd3725659a72604b16247c9--